Checkov and Tirith: Governing Your Own Rules in Every IaC Pipeline

Your pipeline already runs Checkov, and the scan passes. An encrypted, private bucket can still be missing the owner tag your incident process depends on, and a valid plan can still go over the monthly cost limit finance agreed to. Checkov checks that resources are secure. Rules like these come from how your organization operates, so they need their own owner and a way to be enforced.

The rules that come from your organization

Most platform teams need to know who owns each resource, whether a change fits the budget, and whether every repository enforces the same version of a rule.

That last one is where things slip. A team can run the right checks in one repository while another repository runs a copy of the policy that was last updated a year ago.

Writing those rules as Tirith policies

Tirith is StackGuardian's open-source policy engine. It runs as an additional step in the pipeline you already have, so Checkov and your other checks keep running as they are.

A Tirith policy is declarative JSON with one consistent structure: you choose a provider, select the value or operation, then state the condition. Providers exist for Terraform plans, Infracost estimates, Kubernetes manifests and workflow files, so an owner-tag rule and a cost rule are written the same way, and reviewers read them the same way.

To connect a pipeline, you add one step after terraform plan: the Tirith GitHub Action, the Tirith GitLab CI/CD component or a Tirith step in Bitbucket Pipelines. Your apply jobs stay where they are.

To install Tirith, use the pinned release from GitHub:

pip install "git+https://github.com/StackGuardian/tirith.git@1.2.1"
tirith --version

Warning: pip install tirith installs a different, unrelated package with the same name on PyPI.

Keeping every pipeline on the same policy

Every route works in local mode first, evaluating the policy files committed to the repository. Copy the same file into fifty repositories, though, and over time you have fifty versions. Platform mode is optional: the same step evaluates plans against the policies your StackGuardian organization enforces, so policy owners change a rule once and every connected pipeline picks it up on its next run.

Depending on your plan and setup, StackGuardian can also run Tirith and Checkov on your plans, keep every result linked to the run that produced it for audit, and report the pipelines that skip the checks.

Wrapping up

Start with a rule your engineers still check by hand and try it in one pipeline. The full guide has a minimal owner-tag policy and the exact plan, check, apply sequence. It also covers what reviewers see in each CI system when a policy fails, how a finding becomes a reviewed and tested Tirith policy, and which features are in Tirith 1.2.1 and which are still in development.

Read the full guide: Checkov and Tirith: Governing Every IaC Pipeline With StackGuardian