← Back to Terraform Plan Secret Exposure Check
Checkov, an open-source project originally from Bridgecrew and now maintained
under Palo Alto Networks' Prisma Cloud, is a broad static analysis engine for infrastructure as
code. Out of the box it ships hundreds of built-in policies spanning Terraform, CloudFormation,
Kubernetes manifests, Dockerfiles, Helm charts, and more -- public storage buckets, open security
groups, missing encryption at rest, weak IAM policies, and dozens of other misconfiguration
classes. A general-purpose secrets scanner is bundled in as one module among that much larger
policy set. It is a Python package, installed with pip install checkov, and it can
scan a Terraform structured plan JSON in addition to raw source.
This checker does one narrow thing and nothing else. It is a zero-dependency, zero-install
browser page and a single Node file: it reads a Terraform structured plan
(terraform show -json), reads the plan's own
before_sensitive/after_sensitive markers first, and flags only the
attribute values that look like a real secret -- an AWS access key, a PEM private key, a JWT, or
a URL with an embedded username and password -- and which Terraform's own provider
schema did not already mark sensitive. It has no policy database, no misconfiguration rules, no
other IaC frameworks, and nothing to install: node cli.mjs check plan.json.
| What you are trying to do | Where to do it |
|---|---|
| Catch misconfigurations across Terraform, CloudFormation, Kubernetes, or Dockerfiles -- public buckets, open security groups, missing encryption, weak IAM. | Checkov -- that breadth is its core product. |
| Run one broad policy-as-code gate across an entire multi-framework IaC repository, with hundreds of rules to enable, suppress, or customise. | Checkov. |
Know specifically whether a Terraform plan's provider schema missed marking an attribute sensitive, so a real secret would print in plaintext into a CI log. |
This checker -- that is the one thing it checks, respecting Terraform's own sensitivity markers first so it does not re-flag a value Terraform already redacts. |
| Gate a deploy in CI on that one specific failure with zero installs, zero dependencies, and zero configuration. | This checker -- node cli.mjs check plan.json exits non-zero on a finding, no pip install required. |
| Get broad, continuously updated policy coverage maintained by a vendor with a dedicated security research team. | Checkov -- this checker maintains four fixed secret-shape patterns and nothing else. |
| Check a single plan file with no install, no Python environment, and nothing uploaded anywhere. | This checker -- open the page, paste or load the file, done. |
These compose rather than compete. A team already running Checkov for broad IaC policy coverage loses nothing by also wiring this narrower checker into the same pre-apply step -- it costs one dependency-free file and checks a distinction (respecting Terraform's own sensitivity markers) that a general-purpose secrets scanner is not built to reason about. And a team that finds Checkov's hundreds of policies more than it wants to configure just for the secrets question can reach for this instead, with no install at all. Neither replaces the other; they answer different questions at very different scopes.
They overlap on one narrow point and differ everywhere else. Checkov is a general-purpose static analysis engine: it ships hundreds of built-in policies covering misconfigurations across Terraform, CloudFormation, Kubernetes, Dockerfiles, and more -- public buckets, open security groups, missing encryption -- and a general-purpose secrets scanner is one feature bundled inside that much larger policy set. This tool checks exactly one thing: does this Terraform structured plan contain a value that looks like a real secret (an AWS key, a PEM private key, a JWT, or a credential-embedded URL) which the provider schema did not already mark sensitive. If you want broad IaC policy coverage across multiple frameworks, reach for Checkov. If you want a zero-install, zero-dependency gate for one specific, narrow, high-confidence failure right before an apply, this is built for exactly that and nothing else.
Checkov's secrets scanning is general-purpose pattern and entropy detection aimed at source files broadly, run as one module inside a much larger policy engine. This tool is narrower and more specific on purpose: it reads the structured plan's before_sensitive/after_sensitive markers first, so it only flags a value Terraform's own schema left unmarked -- a value Terraform already redacts is correctly ignored rather than re-flagged. That distinction is the whole point of this tool and is not what a general secrets scanner is built to reason about.
Because they cost different amounts to adopt for this one job. Checkov is a Python package with its own install, update cadence, and hundreds of policies to configure or suppress if you only want the secrets angle. This tool is one dependency-free JavaScript file: node cli.mjs check plan.json, nothing to install, nothing to configure, exits non-zero on a finding. If a team already runs Checkov for its broader policy coverage, this does not replace it -- it is a much smaller, more specific gate for the one failure it was built to catch, worth adding regardless of what else runs in CI.
No. This site is not affiliated with, endorsed by, or sponsored by Checkov, Bridgecrew, or their parent company Palo Alto Networks, named here only to describe what this checker is and is not. What Checkov currently scans and how it is licensed are described on its own project page and repository -- check there for what it covers today.
Only point either tool at a plan or repository you own or are authorised to test. That rule is unchanged by which one you pick.