checkov --skip-check: Suppress Specific Policies
checkov --skip-check excludes named policies from a run, and inline checkov:skip comments suppress one finding on one resource.
Some Checkov policies will not apply to your setup. You can drop them for a whole run, run only a chosen subset, or annotate a single resource with a justification, keeping the suppression visible in code.
What it does
--skip-check takes a comma-separated list of check IDs (or wildcard patterns) to exclude; --check runs only the listed checks. An inline #checkov:skip=CKV_AWS_18:reason comment inside a resource suppresses that one check for that one resource and records the reason in the output.
Common usage
# skip two checks for the whole run
checkov -d . --skip-check CKV_AWS_18,CKV_AWS_21
# run only a subset
checkov -d . --check CKV_AWS_20,CKV_AWS_23
# wildcard: skip all secrets checks
checkov -d . --skip-check CKV_SECRET_*Inline suppression
resource "aws_s3_bucket" "logs" {
#checkov:skip=CKV_AWS_18:access logging is handled centrally
bucket = "central-logs"
}Options
| Mechanism | What it does |
|---|---|
| --skip-check <ids> | Exclude these check IDs (supports wildcards) |
| --check <ids> | Run only these check IDs |
| #checkov:skip=<id>:<reason> | Suppress one check for one resource |
| --skip-path <regex> | Skip files or directories matching a pattern |
In CI
Prefer inline #checkov:skip=ID:reason over a global --skip-check, because the exception lives next to the resource and the reason shows up in the scan output and PR review. Reserve --skip-check for policies that genuinely never apply to the repo.
Common errors in CI
A check you tried to skip still failing usually means a wrong ID; the inline form needs the exact CKV_* from the report. A --check run reporting almost nothing is expected, it runs only the listed checks. If a wildcard like CKV_AWS_* skips more than intended, narrow the list to explicit IDs.