> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/checkov-iac-scan.md).

# Checkov IaC scanning

You can easily set up a Checkov step to run automated scans in your Harness pipeline. This step scans the IaC repository you specify using the Checkov CLI. Then it correlates, deduplicates, and ingests the scan results into Harness. You can see your scan results in the [Vulnerabilities](/security-testing-orchestration/3.0/use-sto/sto-security-issues/view-scan-results.md) tab of the pipeline execution.

### Important notes for running Checkov scans in STO <a href="#important-notes-for-running-checkov-scans-in-sto" id="important-notes-for-running-checkov-scans-in-sto"></a>

* You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer [Configure your pipeline to use STO images from private registry](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/configure-pipeline-to-use-sto-images-from-private-registry.md).

### Set-up workflows <a href="#set-up-workflows" id="set-up-workflows"></a>

<details>

<summary>Orchestration scans for IaC repositories</summary>

**Prerequisites**

* You can run STO scans in [Harness Cloud](/continuous-integration/use-harness-ci/use-harness-ci/set-up-build-infrastructure/use-harness-cloud-build-infrastructure.md), which requires no setup. You can also use a [Kubernetes](/continuous-integration/use-harness-ci/use-harness-ci/set-up-build-infrastructure/k8s-build-infrastructure/set-up-a-kubernetes-cluster-build-infrastructure.md) or [Docker](/continuous-integration/use-harness-ci/use-harness-ci/set-up-build-infrastructure/define-a-docker-build-infrastructure.md) build infrastructure.
* [Harness text secrets](/harness-ai/use-harness-platform/secrets/add-use-text-secrets.md) for your `client-id` and `client-secret` to authenticate with the Checkov CLI

**Add the Checkov scanner**

```
Do the following:

1. Add a Security, Build, or Infrastructure stage to your pipeline.
2. Add a Checkov step to the stage.
```

**Set up the Checkov step**

**Required settings**

```
1. [Scan mode](#scan-mode) = **Orchestration**
2. [Target and Variant Detection](#detect-target-and-variant) = **Auto**
```

**Optional settings**

* [Fail on Severity](#fail-on-severity) — Stop the pipeline if the scan detects any issues at a specified severity or higher
* [Log Level](#log-level) — Useful for debugging

</details>

<details>

<summary>Ingestion scans for IaC repositories</summary>

{% hint style="info" %}
Harness STO can ingest both JSON and SARIF data from Checkov, but Harness recommends publishing to JSON because this format includes more detailed information.
{% endhint %}

**Add a shared path for your scan results**

1. Add a Security, Build, or Infrastructure stage to your pipeline. 2. In the stage **Overview**, add a shared path such as `/shared/scan_results`.

**Copy scan results to the shared path**

There are two primary workflows to do this:

* Add a Run step that runs a Checkov scan from the command line and then copies the results to the shared path.
* Copy results from a Checkov scan that ran outside the pipeline.

  For more information and examples, go to [Ingestion scans](/security-testing-orchestration/3.0/new-to-sto/key-concepts/ingest-scan-results-into-an-sto-pipeline.md).

**Set up the Checkov scanner**

Add a Checkov step to the stage and set it up as follows.

**Required settings**

1. [Scan mode](#scan-mode) = **Ingestion**
2. [Target name](#name) — Usually the repo name
3. [Target variant](#name) — Usually the scanned branch. You can also use a [runtime input](/harness-ai/use-harness-platform/variables-and-expressions/runtime-input-usage.md) and specify the branch at runtime.
4. [Ingestion file](#ingestion-file) — For example, `/shared/scan_results/checkov-iac-scan.json`

**Optional settings**

* [Fail on Severity](#fail-on-severity) — Stop the pipeline if the scan detects any issues at a specified severity or higher.
* [Log Level](#log-level) — Useful for debugging

</details>

### Checkov step settings reference <a href="#checkov-step-settings-reference" id="checkov-step-settings-reference"></a>

#### Scan <a href="#scan" id="scan"></a>

**Scan Mode**

#### Target <a href="#target" id="target"></a>

**Type**

**Target and Variant Detection**

**Name**

The identifier for the [target](/security-testing-orchestration/3.0/new-to-sto/key-concepts/targets-and-baselines.md) such `codebaseAlpha`. Descriptive target names make it much easier to navigate your scan data in the STO UI.

It is good practice to [specify a baseline](/security-testing-orchestration/3.0/new-to-sto/key-concepts/targets-and-baselines.md#every-target-needs-a-baseline) for every target.

**Variant**

**Workspace**

#### Ingestion File <a href="#ingestion-file" id="ingestion-file"></a>

The path to your scan results when running an [Ingestion scan](/security-testing-orchestration/3.0/new-to-sto/key-concepts/ingest-scan-results-into-an-sto-pipeline.md), for example `/shared/scan_results/checkov.sarif`.

* The data file must be in a [supported format](/security-testing-orchestration/3.0/new-to-sto/sto-whats-supported/scanners.md#supported-ingestion-formats) for the scanner.
* The data file must be accessible to the scan step. It's good practice to save your results files to a [shared path](/continuous-integration/new-to-harness-ci/key-concepts.md#stages) in your stage. In the visual editor, go to the stage where you're running the scan. Then go to **Overview** > **Shared Paths**. You can also add the path to the YAML stage definition like this:

  ```yaml
      - stage:
        spec:
          sharedPaths:
            - /shared/scan_results
  ```

#### Log Level <a href="#log-level" id="log-level"></a>

#### Additional CLI flags <a href="#additional-cli-flags" id="additional-cli-flags"></a>

{% hint style="warning" %}
Passing CLI flags is an advanced feature. Some flags might not work in the context of STO. You should test your flags and arguments thoroughly before you use them in your production environment.
{% endhint %}

#### Fail on Severity <a href="#fail-on-severity" id="fail-on-severity"></a>

#### Settings <a href="#settings" id="settings"></a>

You can add more settings to the scan step as needed.

#### Additional Configuration <a href="#additional-configuration" id="additional-configuration"></a>

#### Advanced settings <a href="#advanced-settings" id="advanced-settings"></a>

### Configure Checkov as a Built-in Scanner <a href="#configure-checkov-as-a-built-in-scanner" id="configure-checkov-as-a-built-in-scanner"></a>

The Checkov scanner is available as a built-in scanner in STO. Configuring it as a built-in scanner enables the step to automatically perform scans using the free version without requiring any licenses. Follow these steps to set it up:

1. Search for **IaC** in the step palette or navigate to the **Built-in Scanners** section and select the **IaC** step.
2. Expand the **Additional CLI Flags** section if you want to configure optional CLI flags.
3. Click **Add Scanner** to save the configuration.

The scanner will automatically use the free version, detect scan targets, and can be further configured by clicking on the step whenever needed.

### Proxy settings <a href="#proxy-settings" id="proxy-settings"></a>