Leveraging networkx in-memory graphs for securing your cloud infrastructure
summary
Checkov uses networkx digraph to build an in-memory DAG of Terraform and other IaC blocks, replacing a slow Neptune experiment and enabling fast graph queries. It performs variable rendering by backpropagating defaults through edges so checks see concrete values (example: S3 bucket encryption resolved via a linked kms key). Policies run via a Bridge Query Language over the graph; the project has ~2,500 built-in policies, ~4k GitHub stars and 8M pip installs, and the graph augmentation catches multi-resource misconfigurations that single-file scans miss.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 0:28Speaker introduction
- 1:09What we'll cover
- 3:16Infrastructure as code basics
- 7:07Secured IaC importance
- 8:31Introducing Checkov
- 13:26Dependencies and visualizing them
- 15:35Problem with independent scanning
- 17:40Modeling with NetworkX
- 21:10Graph implementation in Checkov
- 25:20Variable rendering in graphs
- 28:07Querying graphs with BQL
- 33:25Policy evaluation demo
- 34:49Q&A
related talks
26mStandard Classification: Introducing graph theory to Policy-As-Code
57mNeptune: Using graphs to gain security insights
32mFrom Edge To Insight: Cybersecurity Intelligence With Kubeflow...
22mInside Out - The Cloud has Never been so Close
40mHow to Map Networked Devices Using Graph-Based AI to Preempt Cyber Threats
45mConnecting the dots to go from tabular security incident data to behavioral graph understanding
12mEnd-to-end policy-as-code from IaC to Running Workloads
32mCloud Native Policy as Code: Principles and Best Practices