checkov-terraform-demo/
├── insecure/          # Intentionally vulnerable Terraform code
│   ├── provider.tf
│   ├── s3.tf
│   ├── sg.tf
│   ├── rds.tf
│   ├── iam.tf
│   └── cloudtrail.tf
├── secure/            # Hardened Terraform code
│   ├── provider.tf
│   ├── s3.tf
│   ├── sg.tf
│   ├── rds.tf
│   ├── iam.tf
│   └── cloudtrail.tf
└── .github/workflows/
    └── checkov.yml

resource "aws_s3_bucket" "data" {
  bucket = "demo-insecure-bucket"
}
 
resource "aws_s3_bucket_acl" "data" {
  bucket = aws_s3_bucket.data.id
  acl    = "public-read"
}

resource "aws_security_group" "web" {
  name        = "demo-insecure-sg"
  description = "Insecure security group for demo"
 
  ingress {
    from_port   = 0
    to_port     = 65535
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
 
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
 
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_db_instance" "main" {
  identifier        = "demo-insecure-db"
  engine            = "mysql"
  engine_version    = "8.0"
  instance_class    = "db.t3.micro"
  allocated_storage = 20
  username          = "admin"
  password          = "password123"
 
  publicly_accessible = true
  storage_encrypted   = false
  skip_final_snapshot = true
}

resource "aws_iam_policy" "admin" {
  name = "demo-insecure-policy"
 
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = "*"
        Resource = "*"
      }
    ]
  })
}

resource "aws_cloudtrail" "main" {
  name                       = "demo-insecure-trail"
  s3_bucket_name             = aws_s3_bucket.data.id
  enable_log_file_validation = false
}

pip install checkov

checkov -d insecure/ --framework terraform

resource "aws_s3_bucket" "data" {
  bucket = "demo-secure-bucket"
}
 
resource "aws_s3_bucket_versioning" "data" {
  bucket = aws_s3_bucket.data.id
 
  versioning_configuration {
    status = "Enabled"
  }
}
 
resource "aws_s3_bucket_server_side_encryption_configuration" "data" {
  bucket = aws_s3_bucket.data.id
 
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "aws:kms"
    }
    bucket_key_enabled = true
  }
}
 
resource "aws_s3_bucket_public_access_block" "data" {
  bucket = aws_s3_bucket.data.id
 
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

variable "allowed_ssh_cidr" {
  description = "CIDR block allowed to SSH"
  type        = string
  default     = "203.0.113.0/24"
}
 
resource "aws_security_group" "web" {
  name        = "demo-secure-sg"
  description = "Secure security group for demo - restricted access"
 
  ingress {
    description = "HTTPS from anywhere"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
 
  ingress {
    description = "SSH from allowed CIDR only"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = [var.allowed_ssh_cidr]
  }
 
  egress {
    description = "Allow HTTPS outbound"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

variable "db_password" {
  description = "Database master password"
  type        = string
  sensitive   = true
}
 
resource "aws_db_instance" "main" {
  identifier        = "demo-secure-db"
  engine            = "mysql"
  engine_version    = "8.0"
  instance_class    = "db.t3.micro"
  allocated_storage = 20
  username          = "admin"
  password          = var.db_password
 
  publicly_accessible                 = false
  storage_encrypted                   = true
  copy_tags_to_snapshot               = true
  auto_minor_version_upgrade          = true
  deletion_protection                 = true
  iam_database_authentication_enabled = true
  multi_az                            = true
  monitoring_interval                 = 60
  monitoring_role_arn                 = aws_iam_role.rds_monitoring.arn
  enabled_cloudwatch_logs_exports     = ["audit", "error", "general", "slowquery"]
}

resource "aws_iam_policy" "app" {
  name        = "demo-secure-policy"
  description = "Least privilege policy for application"
 
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "s3:GetObject",
          "s3:PutObject",
          "s3:ListBucket"
        ]
        Resource = [
          "arn:aws:s3:::demo-secure-bucket",
          "arn:aws:s3:::demo-secure-bucket/*"
        ]
      }
    ]
  })
}

resource "aws_cloudtrail" "main" {
  name                       = "demo-secure-trail"
  s3_bucket_name             = aws_s3_bucket.data.id
  is_multi_region_trail      = true
  enable_log_file_validation = true
  kms_key_id                 = aws_kms_key.cloudtrail.arn
  cloud_watch_logs_group_arn = "${aws_cloudwatch_log_group.cloudtrail.arn}:*"
  cloud_watch_logs_role_arn  = aws_iam_role.cloudtrail_cloudwatch.arn
 
  sns_topic_name = aws_sns_topic.cloudtrail.arn
}

checkov -d secure/ --framework terraform

name: Checkov
 
on:
  push:
    branches: [main]
    paths:
      - "insecure/**"
      - "secure/**"
      - ".github/workflows/checkov.yml"
  pull_request:
    branches: [main]
    paths:
      - "insecure/**"
      - "secure/**"
      - ".github/workflows/checkov.yml"
 
permissions:
  contents: read
  pull-requests: write
 
jobs:
  scan-insecure:
    name: "Scan insecure/"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Run Checkov on insecure/
        id: checkov
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: insecure/
          framework: terraform
          soft_fail: true
          output_format: cli
 
  scan-secure:
    name: "Scan secure/"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Check if secure/ exists
        id: check
        run: |
          if [ -d "secure" ] && [ "$(ls -A secure/)" ]; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi
 
      - name: Run Checkov on secure/
        if: steps.check.outputs.exists == 'true'
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: secure/
          framework: terraform
          soft_fail: false
          output_format: cli