Pull Request

Goal

Add the Lab 6 submission and verified IaC security scan results for Terraform, Ansible, Pulumi, and a custom Checkov policy.

Changes

• Added submissions/lab6.md with findings tables, comparison notes, and module-leverage analysis.
• Added a custom Checkov policy at labs/lab6/policies/my-custom-policy.yaml.
• Captured fresh scan artifacts under labs/lab6/results/checkov-terraform/results_cli.txt, labs/lab6/results/kics-ansible/results.json, labs/lab6/results/kics-pulumi/results.json, and labs/lab6/results/checkov-custom/results_json.json.

Testing

• Ran Checkov against the Terraform sample: 49 passed, 78 failed, 0 skipped.
• Ran KICS against the Ansible sample: 10 findings total (9 HIGH, 1 LOW).
• Ran KICS against the Pulumi sample: 6 findings total (1 CRITICAL, 2 HIGH, 1 MEDIUM, 2 INFO).
• Ran Checkov with the custom policy: CKV2_CUSTOM_1 fired for two S3 buckets.

Artifacts & Screenshots

• Submission: submissions/lab6.md

• Terraform Checkov: labs/lab6/results/checkov-terraform/results_cli.txt

• Ansible KICS: labs/lab6/results/kics-ansible/results.json

• Pulumi KICS: labs/lab6/results/kics-pulumi/results.json

• Custom policy Checkov: labs/lab6/results/checkov-custom/results_json.json

• Title uses feat(labN): style

• No secrets/large temp files committed

• submissions/labN.md present

• Task 1 — Checkov on Terraform + Pulumi with top-5 rules and module-leverage analysis

• Task 2 — KICS on Ansible with Checkov-vs-KICS comparison

• Bonus — Custom Checkov policy demonstrably firing on the vulnerable sample