| file | File with infrastructure code or packages to scan | no | — |
| directory | Directory with infrastructure code and/or package manager files to scan | no | . |
| check | Run scan only on a specific check identifier (comma separated) | no | — |
| skip_check | Run scan on all checks but a specific check identifier (comma separated) | no | — |
| compact | Do not display code blocks in output | no | — |
| quiet | display only failed checks | no | — |
| api-key | Environment variable name of the Bridgecrew API key from Bridgecrew app | no | — |
| output_bc_ids | Output Bridgecrew IDs (BC...) instead of Checkov IDs (CKV...) | no | — |
| use_enforcement_rules | Use the Enforcement rules configured in the platform for hard / soft fail logic. See checkov help text for more details on the nuances of this option. | no | — |
| skip_results_upload | Do not upload scan results to the platform to view in the console. Results are only available locally. If you use the --support flag, logs will still get uploaded. | no | — |
| soft_fail | do not return an error code if there are failed checks | no | — |
| framework | run only on a specific infrastructure | no | — |
| skip_framework | skip a specific infrastructure | no | — |
| external_checks_dirs | comma separated list of external (custom) checks directories | no | — |
| external_checks_repos | comma separated list of external (custom) checks repositories | no | — |
| output_format | The format of the output. cli, json, junitxml, github_failed_only, or sarif (comma separated) | no | sarif |
| output_file_path | Path and name for output file, needs to end with a comma for a single output format | no | — |
| download_external_modules | download external terraform modules from public git repositories and terraform registry:true, false | no | — |
| enable_secrets_scan_all_files | Scan all files for secrets | no | — |
| log_level | log level | no | WARNING |
| config_file | checkov configuration file | no | — |
| baseline | Path to a .checkov.baseline file to compare. Report will include only failed checks that are not in the baseline | no | — |
| soft_fail_on | Do not return an error code only for specific check identifiers (comma separated) | no | — |
| hard_fail_on | Return an error code only for specific check identifiers (comma separated) | no | — |
| container_user | Set the username or UID used and optionally the groupname or GID for the action to run under | no | 0 |
| docker_image | Name of the docker image with the tags. Only works with an API and Dockerfile path | no | — |
| dockerfile_path | Path to the Dockerfile of the scanned docker image | no | — |
| var_file | Variable files to load in addition to the default files. Currently only supported for source Terraform (.tf file), and Helm chart scans. Requires using --directory, not --file. (comma separated) | no | — |
| github_pat | Environment variable name for a Github personal access token for scanning external modules sourced from private repositories | no | — |
| tfc_token | (deprecated, use tf_registry_token) Environment variable name for a Terraform Cloud token for scanning external modules sourced from private registries | no | — |
| tf_registry_token | Environment variable name for a Terraform registry token for scanning external modules sourced from private registries | no | — |
| ckv_validate_secrets | Environment variable to enable local validation of secrets. Off by default. | no | — |
| vcs_base_url | Environment variable name for the base url of a self hosted VCS with external modules. To be used with vcs_username and vcs_token | no | — |
| vcs_username | Environment variable name for the username for basic auth against a self hosted VCS with external modules. To be used with vcs_base_url and vcs_token | no | — |
| vcs_token | Environment variable name for the password (personal access token) for basic auth against a self hosted VCS with external modules. To be used with vcs_base_url and vcs_username | no | — |
| bitbucket_token | Environment variable name for a Bitbucket access token to scan external modules sourced from a private Bitbucket repository | no | — |
| bitbucket_app_password | Environment variable name for a Bitbucket app password to perform basic auth in order to scan external modules sourced from a private Bitbucket repository. To be used with bitbucket_usernam | no | — |
| bitbucket_username | Environment variable name for a Bitbucket username to perform basic auth in order to scan external modules sourced from a private Bitbucket repository. To be used with bitbucket_app_password | no | — |
| repo_root_for_plan_enrichment | Directory containing the hcl code used to generate a given plan file. Use with `file` | no | — |
| deep_analysis | Combine the TF Plan and TF graphs to make additional connections. Must be used with `repo_root_for_plan_enrichment` | no | — |
| policy_metadata_filter | Comma separated key:value string to filter policies based on Prisma Cloud policy metadata. See https://prisma.pan.dev/api/cloud/cspm/policy#operation/get-policy-filters-and-options for information on allowed filters. Format: policy.label=test,cloud.type=aws | no | — |
| policy_metadata_filter_exception | Comma separated key:value string to exclude filtered policies based on Prisma Cloud policy metadata. When used with policy_metadata_filter, the exceptions override any policies selected asa result of the policy_metadata_filter flag.See https://prisma.pan.dev/api/cloud/cspm/policy#operation/get-policy-filters-and-options for information on allowed filters. Format: policy.label=test,cloud.type=aws | no | — |
| skip_path | Path (file or directory) to skip, using regular expression logic, relative to the current working directory. Word boundaries are not implicit; i.e., specifying "dir1" will skip any directory or subdirectory named "dir1". Ignored with -f. (comma separated) | no | — |
| skip_cve_package | Filter scan to run on all packages except for a specific CVE package identifier, e.g. CVE-2018-19788 (comma separated) | no | — |
| skip_download | Do not download any data from Bridgecrew. This will omit doc links, severities, etc., as well as custom policies and suppressions if using an API token. Note: it will prevent BC platform IDs from being available in Checkov. | no | — |
| prisma-api-url | Prisma API URL for prisma platform features | no | — |