Add checkov GitHub actions

.github/workflows/checkov.yml

@@ -0,0 +1,35 @@
+name: Run checkov
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+    - main
+  pull_request:
+    branches:
+    - main
+    - v2m*
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Python 3.8
+        uses: actions/setup-python@v4
+        with:
+          python-version: 3.8
+      - name: Test with Checkov
+        id: checkov
+        uses: bridgecrewio/checkov-action@master
+        with:
+          directory: .
+          quiet: true
+          skip_path: tests/, .github, compose/, docker/dev/
+          hard_fail_on: MEDIUM
+          soft_fail_on: LOW
+          skip_check: CKV_DOCKER_2,CKV_DOCKER_4

deploy/cdk_exec_policy/cdkExecPolicy.yaml

@@ -11,6 +11,10 @@ Parameters:
 Resources:
   CDKCustomExecutionPolicy0:
     Type: 'AWS::IAM::ManagedPolicy'
+    # checkov:skip=CKV_AWS_107:Ensure IAM policies does not allow credentials exposure
+    # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints
+    # checkov:skip=CKV_AWS_110:Ensure IAM policies does not allow privilege escalation
+    # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints
     Properties:
       ManagedPolicyName: !Ref PolicyName
       PolicyDocument:

deploy/pivot_role/pivotRole.yaml

@@ -48,6 +48,8 @@ Resources:
                 ]
   PivotRolePolicy0:
     Type: 'AWS::IAM::ManagedPolicy'
+    # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints
+    # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints
     Properties:
       PolicyDocument:
         Version: 2012-10-17
@@ -221,6 +223,8 @@ Resources:
 
   PivotRolePolicy1:
     Type: 'AWS::IAM::ManagedPolicy'
+    # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints
+    # checkov:skip=CKV_AWS_111:Ensure IAM policies does not allow write access without constraints
     Properties:
       PolicyDocument:
         Version: 2012-10-17
@@ -421,6 +425,7 @@ Resources:
 
   PivotRolepolicy3:
     Type: 'AWS::IAM::ManagedPolicy'
+    # checkov:skip=CKV_AWS_109:Ensure IAM policies does not allow permissions management without constraints
     Properties:
       PolicyDocument:
         Version: 2012-10-17