Checkov doesn't natively support TerraGrunt

GrahamGoldENG — Mon, 06 Nov 2023 10:53:55 GMT

We had issues with secret scanning output in checkov (see https://live.paloaltonetworks.com/t5/prisma-cloud-discussions/checkov-secrets-framework-scanning-exposes-secrets-in-junit-test/td-p/564324 )

However, if checkov natively supported TerraGrunt, then we wouldn't need to output the terraform plan to a file for checkov to be able to scan it, and therefore the secrets would not be visible if they are protected via a Sensitive flag.

We raised a feature request (See here - Checkov should support | Prisma Cloud New Features Request Portal (aha.io)).

However, as votes are normalised by customer, 1 vote from us vs 100 votes from us is still 1 vote - so if you also think that our enhancement request should be prioritised, please upvote the above linked Feature Request.

Thanks,

Graham

Re: Checkov doesn't natively support TerraGrunt

JayGolf — Wed, 08 Nov 2023 04:35:46 GMT

Hi @GrahamGoldENG ,

I would also recommend posting to the General Topics area. This could increase visibility with a wider range of users. Another avenue you can use if posting to the Palo Alto Networks Reddit. This isn't officially owned by Palo Alto, but there is great engagement and visibility there.

topic Checkov doesn't natively support TerraGrunt in Prisma Cloud Discussions

Checkov doesn't natively support TerraGrunt

Re: Checkov doesn't natively support TerraGrunt