---
name: checkov-skip
description: Adds local Checkov suppression (`#checkov:skip=`) comments to Terraform resources that fail Checkov checks on a PR. Use when a PR has failing Checkov checks that should be suppressed in-code (e.g. migrating existing infrastructure as-is) rather than remediated. Triggers on phrases like "add checkov skip", "suppress checkov", "checkov check FAILED".
---

# Checkov Skip

Adds in-code Checkov suppressions for resources flagged on a pull request, when the
finding is an accepted risk (commonly: importing/migrating existing infrastructure
as-is, where remediation would change the live resource).

> Prefer remediation over suppression. Only suppress when the check cannot or should
> not be fixed (e.g. an import PR that must produce a "No changes" plan). The repo's
> CLAUDE.md says: "Resolve Checkov warnings where possible instead of silencing." If a
> fix is reasonable, propose it instead and confirm with the user before suppressing.

## Inputs to gather (prompt if not provided)

* **Which check(s)** to suppress — the Checkov ID(s), e.g. `CKV2_AWS_73`, `CKV_AWS_135`.
  If not given, suppress every distinct failing check reported on the PR (confirm the
  list with the user first).
* **PR number** — default to the PR for the current branch.
* **Justification** — a short reason appended to each skip. Default to
  "Migrated existing <resource type> as-is." for import/migration PRs; otherwise ask.

## Steps

1. **Find the PR** for the current branch (or use the number provided):

   ```bash
   gh pr view --json number,url,title
   ```

2. **Read the Checkov comments** and extract every failing finding — its check ID, the
   resource address (`<type>.<name>`), and the file/line:

   ```bash
   gh pr view <PR> --json comments \
     --jq '.comments[] | select(.body | test("Checkov check FAILED")) | .body'
   ```

   Build the full list of `(check_id, resource_address, file)` tuples. Note that the AI
   review comment also mentions resources — only count entries under a
   "Checkov check FAILED: <ID>" heading. Cross-check the resource list with:

   ```bash
   gh pr view <PR> --json comments --jq '.comments[].body' \
     | grep -oE 'aws_[a-z_]+\.[a-z0-9_]+' | sort -u
   ```

   (Adjust the resource-type prefix as needed; `[a-z0-9_]+` matters — names often
   contain digits.)

3. **For each flagged resource**, open its `.tf` file and add a skip comment as the
   first line inside the resource block:

   ```hcl
   resource "aws_sqs_queue" "example" {
     #checkov:skip=CKV2_AWS_73: <check description>. <justification>.
     name = "example"
     ...
   }
   ```

   * One skip line per check ID. If a resource fails multiple checks, add multiple
     skip lines.
   * Keep the check's human-readable description after the ID, then the justification —
     e.g. `#checkov:skip=CKV_AWS_135: Ensure that EC2 is EBS optimized. Migrated existing instance as-is.`
   * Only touch resources that are actually flagged. Do **not** add skips to resources
     that already pass (verify against the finding list, not by guessing).

4. **Format and verify**:

   ```bash
   terraform fmt
   ```

   Confirm the count of skip lines matches the number of distinct flagged resources
   (`grep -c 'checkov:skip=<ID>' <file>`).

5. **Report** the list of resources suppressed, the justification used, and remind the
   user to commit/push to re-trigger Checkov. Do not commit or push unless asked.

## Notes

* `#checkov:skip=<ID>: <reason>` is line-level (within a resource block). The colon and
  a non-empty reason are required — a bare ID is ignored by Checkov.
* Match the skip placement to the surrounding file's style (the convention here is the
  first line inside the resource block).
* For module-wrapped resources where the finding is inside the module, the skip belongs
  in the module source, not the calling configuration — flag this to the user instead.