checkov

Checkov scans your infrastructure-as-code for security and compliance problems before you deploy it. Terraform, CloudFormation, Kubernetes manifests, Helm, ARM, and more get checked against thousands of built-in policies: open ports, missing encryption, over-broad IAM. It's open source and free, and it runs in seconds.

It's a Python tool you run locally or in CI, and it fails the build when a check trips. The policy library is huge out of the box, and you can write custom policies in Python or YAML. Because it catches misconfigurations at the code stage, you fix them in a pull request instead of discovering them live in production.

Checkov is free. Bridgecrew, now part of Palo Alto's Prisma Cloud, is the commercial platform built around it, adding a dashboard, drift detection, and org-wide policy management. Solo and small teams, the CLI in CI is the whole value. Larger orgs already on Prisma Cloud get Checkov folded into the paid platform.

The catch: thousands of policies means a real signal-to-noise problem on day one. A mature Terraform repo can light up with hundreds of findings, many of them things you've consciously accepted. Budget time to tune the ruleset and suppress what doesn't apply, or your team learns to ignore the whole thing.