-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Description
Describe the problem
When running terraform plan, we rely on the outputs section to inject values downstream (for example, into Helm charts for Kubernetes deployments). Currently, Checkov does not scan or validate the outputs section of Terraform JSON plan files. If outputs are missing, malformed, or not generated, downstream services can fail during deployment.
Describe the desired solution
Add support in Checkov to:
Parse the outputs object from Terraform plan JSON files.
So, that we can allow checks/policies to validate output keys for presence, non-null values, correct formatting, etc.
Report missing or problematic outputs in the scan results, just as failed resource checks are reported.
Describe the value
This feature would:
Ensure that all required outputs are generated as expected before downstream deployment.
Improve pipeline reliability by catching misconfigurations early.
Enable teams to enforce standards on output values (naming, formatting, required keys, etc.).
Example workflow
Run terraform plan --out plan.tfplan
Convert to JSON: terraform show -json plan.tfplan > plan.json
Run Checkov: checkov -f plan.json
Receive validation results for both resources and outputs.
Additional context
We use outputs to inject values into Helm deployments and other automation. It’s critical that outputs are validated before use.