这是indexloc提供的服务,不要输入任何密码
Skip to content

Feature Request: Scan and Validate Outputs in Terraform Plan Files #7354

@ppapishe

Description

@ppapishe

Describe the problem

When running terraform plan, we rely on the outputs section to inject values downstream (for example, into Helm charts for Kubernetes deployments). Currently, Checkov does not scan or validate the outputs section of Terraform JSON plan files. If outputs are missing, malformed, or not generated, downstream services can fail during deployment.

Describe the desired solution
Add support in Checkov to:

Parse the outputs object from Terraform plan JSON files.
So, that we can allow checks/policies to validate output keys for presence, non-null values, correct formatting, etc.
Report missing or problematic outputs in the scan results, just as failed resource checks are reported.
Describe the value
This feature would:

Ensure that all required outputs are generated as expected before downstream deployment.
Improve pipeline reliability by catching misconfigurations early.
Enable teams to enforce standards on output values (naming, formatting, required keys, etc.).
Example workflow

Run terraform plan --out plan.tfplan
Convert to JSON: terraform show -json plan.tfplan > plan.json
Run Checkov: checkov -f plan.json
Receive validation results for both resources and outputs.
Additional context
We use outputs to inject values into Helm deployments and other automation. It’s critical that outputs are validated before use.

Metadata

Metadata

Assignees

No one assigned

    Labels

    contribution requestedThis is a great feature idea, but we will need a contribution to get it added to Checkov.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions