Checkov

• Category: iac
• Fingerprint: rule-file-surrounding-3-lines-v1
• License: Apache-2.0

Checkov covers Terraform, CloudFormation, Kubernetes, Dockerfiles, Helm, and GitHub Actions. When enabled it replaces Trivy's IaC path for those formats.

iac:
  enabled: true
  checkov: { enabled: true }

When to enable

Any repo with *.tf, k8s/, .github/workflows/, or Dockerfile content. Noise is generally low — most findings are real.