.checkov.yml

# Checkov configuration file
# This file is used to configure Checkov, a static code analysis tool for infrastructure as code.
---
skip-check:
  # IAM Resourcing using wildcards
  - CKV_AWS_356
  - CKV_AWS_111

  # Lambda Encryption and Dead Letter Queue
  - CKV_AWS_173
  - CKV_AWS_116

  # Cloudwatch Logs KMS Encryption and Retention
  - CKV_AWS_158
  - CKV_AWS_338

  # Pin module sources to a commit hash (false positive)
  - CKV_TF_1

  # Ignore unrestricted egress to any IP address
  # SPP use the same pattern so it's not a concern for us
  - CKV_AWS_382

  # Ignore adding code-signing to Lambda.
  # It is not needed here since our Lambda functions use container
  # images over uploading .zip files for layers.
  - CKV_AWS_272

  # AWS-managed key encryption is sufficient and CMK not required for this service
  - CKV_AWS_149

  # IAM user required for local development
  - CKV_AWS_273

  # Key rotation is already provisioned by external module
  - CKV2_AWS_57