steampipe check

Powerpipe is now the recommended way to run dashboards and benchmarks! Mods still work as normal in Steampipe for now, but they are deprecated and will be removed in a future release:

• Steampipe Unbundled →
• Powerpipe for Steampipe users →

Execute one or more Steampipe benchmarks and controls.

You may specify one or more benchmarks or controls to run, or run steampipe check all to run all controls in the workspace.

Usage

Run benchmarks/controls:

steampipe check [item,item,...] [flags]

List available benchmarks:

steampipe check list

Flags:

Output Formats

Examples

Run all controls:

steampipe check all

List the benchmarks available to run in the current mod context:

steampipe check list

Run the cis_v130 benchmark:

steampipe check benchmark.cis_v130

Run a benchmark and save a snapshot:

steampipe check --snapshot benchmark.cis_v130

Run a benchmark and share a snapshot:

steampipe check --share benchmark.cis_v130

Only show "failed" items (alarm, error)

steampipe check all --output=brief

Run all controls and pass variable values on the command line:

steampipe check all --var='mandatory_tags=["Owner","Application","Environment"]' --var='sensitive_tags=["password","key"]'

Run all controls and pass a .spvars file that contains variable values to use

steampipe check all --var-file='tags.spvars'

Run the controls that have tags cis_level=1 and cis=true:

steampipe check all --tag cis_level=1 --tag cis=true

Preview the controls that would run in the cis_v130 benchmark with the cis_level=1 tag filter:

steampipe check benchmark.cis_v130 --tag cis_level=1 --dry-run

Run controls with the a benchmark=pci tag that are either high or critical severity:

steampipe check all --where "severity in ('critical', 'high') and tags ->> 'pci' = 'true'"

Run the cis_v130 benchmark with light mode output:

steampipe check benchmark.cis_v130 --theme=light

Run the cis_v130_1_4 and cis_v130_2_1_1 controls:

steampipe check control.cis_v130_1_4 control.cis_v130_2_1_1

Run the foundational_security benchmark, but suppress items:

steampipe check benchmark.foundational_security --where "tags ->> 'foundational_security_item_id' !=  all(ARRAY['cloudformation_1','s3_11'])"

Use plain text and no progress (typical for CI or batch jobs)

steampipe check all --theme=plain --progress=false

Export to html (with default file name)

steampipe check all --export=html

Export to csv with default file name and json as output.json

steampipe check all --export=csv --export=output.json

Export to markdown and json with default file names, asff as output.asff.json, nunit3 as output.nunit3.xml

steampipe check all --export=md --export=json --export=output.asff.json --export=output.nunit3.xml

Send json output to stdout and pipe to jq

steampipe check all --output=json | jq