Listing 1: Beispielcode S3-Bucket

resource "aws_s3_bucket" "foo-bucket" {
region = var.region
bucket = local.bucket_name
force_destroy = true
tags = {
Name = "foo-
${data.aws_caller_identity.current.
account_id}"
}
versioning {
enabled = true
}
logging {
target_bucket = "${aws_s3_bucket.
log_bucket.id}"
target_prefix = "log/"
}
server_side_encryption_configuration {
rule {
apply_server_side_encryption_by_default
{
kms_master_key_id =
"${aws_kms_key.mykey.arn}"
sse_algorithm = "aws:kms"
}
}
}
acl = "public-read"
}


Listing 2: Beispielcode AWS-Lambda-Funktion

data "aws_iam_policy_document"
"lambda_assume_role" {
statement {
effect = "Allow"
principals {
type = "Service"
identifiers = ["lambda.amazonaws.com"]
}
actions = ["sts:AssumeRole"]
}
}
resource "aws_iam_role" "lambda_role" {
name = "lambda_role"
assume_role_policy = data.aws_iam_policy_
document.lambda_assume_role.json
}
resource "aws_lambda_function" "test_lambda"
{
filename = "lambda.zip"
function_name = "checkov_lambda"
role =
aws_iam_role.lambda_role.arn
handler = "index.lambda_handler"
memory_size = 2048
runtime = "nodejs22.x"
}


Listing 3: Custom Policy für AWS-Cloud-Control-API

from checkov.terraform.checks.provider.base_
check import BaseProviderCheck
from checkov.common.models.enums import
CheckCategories, CheckResult
class AWSCCCredentials(BaseProviderCheck):
def __init__(self) -> None:
name = "Ensure no hard coded AWS access
key and secret key exists in provider"
id = "CKV_AWS_41"
supported_provider = ["awscc"]
categories = [CheckCategories.SECRETS]
super().__init__(name=name, id=id,
categories=categories, supported_
provider=supported_provider)
def scan_provider_conf(self, conf:
Dict[str, List[Any]]) -> CheckResult:
result = CheckResult.PASSED
if self.secret_found(conf,
"access_key", access_key_pattern):
result = CheckResult.FAILED
if self.secret_found(conf, "secret_key",
secret_key_pattern):
result = CheckResult.FAILED
return result


Listing 4: YAML-Konfiguration für die Komponenten

---
spec:
inputs:
# General
job_name:
description: "Name des Jobs"
default: "checkov"
stage:
description: "Die Phase in der Checkov
ausgeführt wird"
default: "test"
image:
description: "Das genutzte ContainerImage"
default: $TF_IMAGE
context:
description: "Ordner mit Ihren
Terraform-Files"
default: ""
# Configuration checkov
scan_external_modules:
description: "Sollen externe Module
heruntergeladen und gescannt werden?"
type: boolean
default: false
---
# Startet Checkov für Codeanalyse
$[[ inputs.job_name ]]:
stage: $[[ inputs.stage ]]
image: $[[ inputs.image ]]
script:
- |
checkov \
--file ${TF_ROOT}/plan.json \
--output cli \
--output junitxml \
--output-file-path console,
checkov-sast.xml \
--download-external-modules $[[
inputs.scan_external_modules ]] \
--repo-root-for-plan-enrichment
${TF_ROOT} \
--deep-analysis \
--quiet \
--compact
artifacts:
when: always
paths:
- "checkov-sast.xml"
reports:
junit: "checkov-sast.xml"
allow_failure: false
interruptible: false
variables:
TF_CONTEXT: $[[ inputs.context ]]