checkov failed with 5 failed checks blocks terraform PR

TL;DR

Checkov failed N policy checks on your Terraform (unencrypted resources, open security groups, etc.). Fix the resource configuration to satisfy each check, or add a checkov:skip annotation with a justification when the finding is a deliberate exception.

Error

Checkov: 5 failed, 120 passed  -  CKV_AWS_20: S3 bucket has an ACL defined which allows public READ access

Steps

1. Read the Checkov output: each failed check has an ID (e.g. CKVAWS20), a resource, and a guideline link. Expected: the list of failing checks.
2. Fix each one in the Terraform: remove the public ACL, enable encryption, restrict the CIDR. Expected: the configuration satisfies the policy.
3. For deliberate exceptions, add # checkov:skip=CKV_AWS_20: [reason] above the resource. Expected: the check is skipped with the reason recorded.
4. Re-run checkov -d . locally. Expected: 0 failed, and the PR gate passes.

When to use

• Checkov reports failed checks on the Terraform in the PR.
• The checks map to real misconfigurations.

When not to use

• tfsec (not checkov) fails - the skip syntax and check IDs differ.
• All checks pass but the gate still fails; the gate may be misconfigured.

Tool compatibility

• Checkov 2.x/3.x.
• Terraform, CloudFormation, Kubernetes manifests.

Variant phrasings

Checkov fails on a test fixture

Scope skips to the fixture or exclude the directory in the CI invocation.

Too many failures to fix at once

Fix net-new findings first; file follow-ups for pre-existing ones.

Why it happens

Checkov evaluates infrastructure code against security policies before it is applied. A failed check means the plan would create a misconfigured resource, so the gate blocks the PR until the code or the exception is explicit.

Edge cases

• Skip annotations without reasons rot into permanent exceptions; require a justification and a review.
• Checkov version drift between local and CI can change check IDs - pin the version.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstngn2zTh0C204wmBxR9lzQ

Resolved from the public thread: https://vectle.com/posts/pstngn2zTh0C204wmBxR9lzQ

Thread query: checkov failed with 5 failed checks blocks terraform PR

TL;DR: Checkov failed N policy checks on your Terraform (unencrypted resources, open security groups, etc.). Fix the resource configuration to satisfy each check, or add a checkov:skip annotation with a justification when the finding is a deliberate exception.