How do I turn Checkov output into an HTML report?

Run checkov -d . -o json > checkov.json (or --output-file-path to write results_json.json), then drop the file here. You get a findings report in your browser: totals by severity, every failed check with its guideline link, each resource with its file, line and code block, and the files with the most failures. Download it as a single HTML file or publish it as a link.

Which scanners does it read?

Checkov JSON (one framework or the array Checkov prints when it scans Terraform, Kubernetes, Dockerfiles and GitHub Actions together), tfsec --format json, Trivy misconfiguration scans (trivy config --format json, or the Misconfigurations in trivy fs) and KICS results.json. SARIF from any of them belongs in the SARIF viewer.

Why do my Checkov findings all say Error instead of High or Low?

Open-source Checkov leaves severity null — severities come from Prisma Cloud and are filled in only when you run with a --bc-api-key. Without one, every failed check is shown as Error, the same level Checkov's own SARIF output uses. tfsec, Trivy and KICS always ship a severity, and it is kept.

What happens to skipped and passed checks?

They are counted, not listed. Checkov's skipped_checks (inline #checkov:skip comments or --skip-check), tfsec results with status ignored and Trivy exceptions show as suppressed; passed checks are tallied so the report says how much was actually tested.

Can I post the failed checks on a pull request?

Yes. “Copy Markdown” gives a GitHub-flavored table — severity, check id, file:line and the resource that failed — that pastes into a PR comment or appends to $GITHUB_STEP_SUMMARY. For the code blocks and guideline links, publish the report and link it in the comment.

tfsec is deprecated — does this still help?

tfsec's checks moved into Trivy, and trivy config prints the same findings as Misconfigurations. Both formats are read here, so a team mid-migration can compare the two runs side by side.

No. The JSON is parsed and the report is built in your browser. It only leaves your machine if you click “Get a shareable link” and publish the report to Comma — and then you choose who can open it.

Free tool

Checkov output, as a report people can read.

Drop the JSON from checkov -o json, tfsec, Trivy config or KICS. Get every failed check grouped by policy, with the resource, file, line and code block — then copy a Markdown table for the pull request or send the whole report to the person who has to sign off on the infrastructure.

checkov.json

[
  {
    "check_type": "terraform",
    "results": {
      "passed_checks": [
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {},
        {}
      ],
      "failed_checks": [
        {
          "check_id": "CKV_AWS_24",
          "bc_check_id": null,
          "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22",
          "check_result": {
            "result": "FAILED",
            "evaluated_keys": []
          },
          "code_block": [
            [
              12,
              "resource \"aws_security_group\" \"bastion\" {\n"
            ],
            [
              13,
              "  name   = \"bastion\"\n"
            ],
            [
              14,
              "  vpc_id = aws_vpc.main.id\n"
            ],
            [
              15,
              "\n"
            ],
            [
              16,
              "  ingress {\n"
            ],
            [
              17,
              "    from_port   = 22\n"
            ],
            [
              18,
              "    to_port     = 22\n"
            ],
            [
              19,
              "    protocol    = \"tcp\"\n"
            ],
            [
              20,
              "    cidr_blocks = [\"0.0.0.0/0\"]\n"
            ],
            [
              21,
              "  }\n"
            ]
          ],
          "file_path": "/network.tf",
          "file_abs_path": "/home/runner/work/infra/infra/network.tf",
          "repo_file_path": "/network.tf",
          "file_line_range": [
            12,
            25
          ],
          "resource": "aws_security_group.bastion",
          "check_class": "",
          "severity": "HIGH",
          "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/ckv_aws_24"
        },
        {
          "check_id": "CKV_AWS_20",
          "bc_check_id": null,
          "check_name": "S3 Bucket has an ACL defined which allows public READ access.",
          "check_result": {
            "result": "FAILED",
            "evaluated_keys": []
          },
          "code_block": [
            [
              1,
              "resource \"aws_s3_bucket\" \"exports\" {\n"
            ],
            [
              2,
              "  bucket = \"acme-exports\"\n"
            ],
            [
              3,
              "  acl    = \"public-read\"\n"
            ],
            [
              4,
              "}\n"
            ]
          ],
          "file_path": "/storage.tf",
          "file_abs_path": "/home/runner/work/infra/infra/storage.tf",
          "repo_file_path": "/storage.tf",
          "file_line_range": [
            1,
            6
          ],
          "resource": "aws_s3_bucket.exports",
          "check_class": "",
          "severity": "HIGH",
          "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/ckv_aws_20"
        },
        {
          "check_id": "CKV_AWS_16",
          "bc_check_id": null,
          "check_name": "Ensure all data stored in the RDS is securely encrypted at rest",
          "check_result": {
            "result": "FAILED",
            "evaluated_keys": []
          },
          "code_block": [
            [
              3,
              "resource \"aws_db_instance\" \"primary\" {\n"
            ],
            [
              4,
              "  identifier        = \"primary\"\n"
            ],
            [
              5,
              "  engine            = \"postgres\"\n"
            ],
            [
              6,
              "  instance_class    = \"db.t4g.medium\"\n"
            ],
            [
              7,
              "  storage_encrypted = false\n"
            ]
          ],
          "file_path": "/database.tf",
          "file_abs_path": "/home/runner/work/infra/infra/database.tf",
          "repo_file_path": "/database.tf",
          "file_line_range": [
            3,
            18
          ],
          "resource": "aws_db_instance.primary",
          "check_class": "",
          "severity": "MEDIUM",
          "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/ckv_aws_16"
        },
        {
          "check_id": "CKV_AWS_18",
          "bc_check_id": null,
          "check_name": "Ensure the S3 bucket has access logging enabled",
          "check_result": {
            "result": "FAILED",
            "evaluated_keys": []
          },
          "code_block": [
            [
              1,
              "resource \"aws_s3_bucket\" \"exports\" {\n"
            ]
          ],
          "file_path": "/storage.tf",
          "file_abs_path": "/home/runner/work/infra/infra/storage.tf",
          "repo_file_path": "/storage.tf",
          "file_line_range": [
            1,
            6
          ],
          "resource": "aws_s3_bucket.exports",
          "check_class": "",
          "severity": null,
          "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/ckv_aws_18"
        },
        {
          "check_id": "CKV_AWS_18",
          "bc_check_id": null,
          "check_name": "Ensure the S3 bucket has access logging enabled",
          "check_result": {
            "result": "FAILED",
            "evaluated_keys": []
          },
          "code_block": [
            [
              8,
              "resource \"aws_s3_bucket\" \"assets\" {\n"
            ]
          ],
          "file_path": "/storage.tf",
          "file_abs_path": "/home/runner/work/infra/infra/storage.tf",
          "repo_file_path": "/storage.tf",
          "file_line_range": [
            8,
            11
          ],
          "resource": "aws_s3_bucket.assets",
          "check_class": "",
          "severity": null,
          "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/ckv_aws_18"
        }
      ],
      "skipped_checks": [
        {
          "check_id": "CKV_AWS_144",
          "suppress_comment": "single-region by design"
        }
      ],
      "parsing_errors": []
    },
    "summary": {
      "passed": 41,
      "failed": 5,
      "skipped": 1,
      "parsing_errors": 0,
      "resource_count": 23,
      "checkov_version": "3.2.334"
    }
  }
]

6.6 KBCheckov 3.2.334 · 41 passed

IaC scan results.html

5 failed checks (2 high, 2 error, 1 medium) · 4 policies · 41 passed · 1 skipped

Publishes this report on Comma: one URL for the scan that opens without CI access, restricted to named people or your company’s email domain if you like, comments pinned to the exact finding, and the next scan kept as a revision you can diff. Free, no card.

How the file is read

Checkov prints one object per framework — check_type, results.failed_checks, passed_checks, skipped_checks and a summary — or an array of them when several frameworks ran. Every block is read; each failure keeps its resource, file_line_range, code_block and guideline.
Severity is kept when the scanner sets it. Open-source Checkov leaves it null, so those show as Error until you scan with a Prisma Cloud key.
tfsec results use long_id as the policy, status 0 as failed, 1 as passed and 2 as ignored; impact and resolution become the description.
Trivy misconfigurations come from Results[].Misconfigurations with the cause’s resource, start line and code lines; MisconfSummary supplies the pass count.
KICS queries list one row per file occurrence, with actual_value as the message and expected_value beneath it.

Getting the JSON

Scanner	Writes JSON with
Checkov	checkov -d . -o json > checkov.json
Checkov (plan)	checkov -f tfplan.json --framework terraform_plan -o json
Checkov (CI)	checkov -d . -o cli -o json --output-file-path console,.
tfsec	tfsec . --format json --out tfsec.json
Trivy	trivy config --format json --output trivy.json .
KICS	kics scan -p . --report-formats json -o out/

Add --soft-fail (Checkov, tfsec) or --exit-code 0 (Trivy) so the CI step still writes the file when checks fail.

When the scan has to leave CI

Checkov’s CLI output is a wall of Check: CKV_AWS_… blocks in a job log; its JSON is something only a pipeline reads. The people who decide whether a public bucket or an open SSH port is acceptable — the platform lead, the SOC 2 auditor, the client who asked for an infrastructure review — need one document they can read end to end and comment on policy by policy. Published to Comma, that is one link, and an agent can publish it from the pipeline after every scan, as a new revision of the same report. More on sharing the scanners’ own output in how to share a Checkov report and how to share a tfsec report.

Questions

How do I turn Checkov output into an HTML report?: Run checkov -d . -o json > checkov.json (or --output-file-path to write results_json.json), then drop the file here. You get a findings report in your browser: totals by severity, every failed check with its guideline link, each resource with its file, line and code block, and the files with the most failures. Download it as a single HTML file or publish it as a link.
Which scanners does it read?: Checkov JSON (one framework or the array Checkov prints when it scans Terraform, Kubernetes, Dockerfiles and GitHub Actions together), tfsec --format json, Trivy misconfiguration scans (trivy config --format json, or the Misconfigurations in trivy fs) and KICS results.json. SARIF from any of them belongs in the SARIF viewer.
Why do my Checkov findings all say Error instead of High or Low?: Open-source Checkov leaves severity null — severities come from Prisma Cloud and are filled in only when you run with a --bc-api-key. Without one, every failed check is shown as Error, the same level Checkov's own SARIF output uses. tfsec, Trivy and KICS always ship a severity, and it is kept.
What happens to skipped and passed checks?: They are counted, not listed. Checkov's skipped_checks (inline #checkov:skip comments or --skip-check), tfsec results with status ignored and Trivy exceptions show as suppressed; passed checks are tallied so the report says how much was actually tested.
Can I post the failed checks on a pull request?: Yes. “Copy Markdown” gives a GitHub-flavored table — severity, check id, file:line and the resource that failed — that pastes into a PR comment or appends to $GITHUB_STEP_SUMMARY. For the code blocks and guideline links, publish the report and link it in the comment.
tfsec is deprecated — does this still help?: tfsec's checks moved into Trivy, and trivy config prints the same findings as Misconfigurations. Both formats are read here, so a team mid-migration can compare the two runs side by side.
Is my scan uploaded?: No. The JSON is parsed and the report is built in your browser. It only leaves your machine if you click “Get a shareable link” and publish the report to Comma — and then you choose who can open it.