exclude a family of checks: --skip-checks-prefix

Is your feature request related to a problem? Please describe. It is useful for CI tools to run checks on specific families of checks, and exclude the default rules, or rules, matching the prefix. this is separate from the existing check_id exclusion, or, the inline “nosec” feature.

Describe the solution you’d like a flag similar to --skip-checks-prefix. Input is a prefix string. Checkov will skip/disable checks that match the prefix “$prefix-*” and exclude them from reports.

Describe alternatives you’ve considered I’ve considered filtering the output of the scan results in my CI tooling. I would prefer if an individual GHAction or CircleCI orb fail the build right from checkov, rather than maintain a second step in my CI tools.

Additional context For example, we have an internal set of controls related to Trust Service Criteria and other internal controls. It would be helpful to run checkov ONLY against the TSC_* or ACME_CNTRL_* rules, which would “Fail” the scans invoked by the compliance/sec-ops teams.

[schosterbarak]

can you please open a new issue? @vangundy-jason-pfg

[vangundy-jason-pfg]

https://github.com/bridgecrewio/checkov/pull/750 does not seem to be working as expected. For a simple recreation I have a file with an aws secret in it. The following fails appropriately:

checkov --file iac/CKV_SECRET_2.json


       _               _
   ___| |__   ___  ___| | _______   __
  / __| '_ \ / _ \/ __| |/ / _ \ \ / /
 | (__| | | |  __/ (__|   < (_) \ V /
  \___|_| |_|\___|\___|_|\_\___/ \_/

By bridgecrew.io | version: 2.0.430

secrets scan results:

Passed checks: 0, Failed checks: 1, Skipped checks: 0

Check: CKV_SECRET_2: "AWS Access Key"
        FAILED for resource: 25910f981e85ca04baf359199dd0bd4a3ae738b6
        File: /iac/CKV_SECRET_2.json:6-7
        Guide: https://docs.bridgecrew.io/docs/git_secrets_2

                6 |         "Any": "AKIAIOSFODNN7EXAMPLE"

But then the following wildcard attempt to skip this check does not work (i.e. it still runs and fails):

checkov --file iac/CKV_SECRET_2.json --skip-check 'CKV_SECRET*'


       _               _
   ___| |__   ___  ___| | _______   __
  / __| '_ \ / _ \/ __| |/ / _ \ \ / /
 | (__| | | |  __/ (__|   < (_) \ V /
  \___|_| |_|\___|\___|_|\_\___/ \_/

By bridgecrew.io | version: 2.0.430

secrets scan results:

Passed checks: 0, Failed checks: 1, Skipped checks: 0

Check: CKV_SECRET_2: "AWS Access Key"
        FAILED for resource: 25910f981e85ca04baf359199dd0bd4a3ae738b6
        File: /iac/CKV_SECRET_2.json:6-7
        Guide: https://docs.bridgecrew.io/docs/git_secrets_2

                6 |         "Any": "AKIAIOSFODNN7EXAMPLE"

Would it be best to file this as a new / separate issue @metahertz ?