feat(lab6): Checkov + KICS scans + custom policy - #13

Goal

Submit Lab 6: IaC security scanning with Checkov (Terraform), KICS (Ansible + Pulumi), and a custom Checkov policy for RDS IAM database authentication.

Changes

• Added submissions/lab6.md with:
  • Task 1: Checkov scan results (127 checks, 78 failed) with top-5 rule frequency table and module-leverage analysis on wildcard IAM policies
  • Task 2: KICS scan results for Ansible (4 findings) and Pulumi YAML (6 findings) with Checkov-vs-KICS tool comparison
  • Bonus: Custom Checkov policy CKV2_CUSTOM_1 requiring iam_database_authentication_enabled = true on aws_db_instance resources, verified against 2 failing resources in database.tf
• Added labs/lab6/policies/my-custom-policy.yaml — the custom Checkov policy file

Testing

• Checkov 3.3.2 run against labs/lab6/vulnerable-iac/terraform/ with JSON output
• KICS (Checkmarx) run via Docker against Ansible playbook and Pulumi YAML files
• Custom policy validated with checkov --external-checks-dir and confirmed firing on both aws_db_instance.unencrypted_db and aws_db_instance.weak_db

Artifacts

• submissions/lab6.md — Lab 6 submission report
• labs/lab6/policies/my-custom-policy.yaml — Custom Checkov policy (bonus)

Lab Task Checklist

• Task 1 — Checkov on Terraform + Pulumi with top-5 rules and module-leverage analysis
• Task 2 — KICS on Ansible with Checkov-vs-KICS comparison
• Bonus — Custom Checkov policy demonstrably firing on the vulnerable sample

Checklist

• Title is clear (feat(labN): <topic>)
• No secrets/large temp files committed
• submissions/labN.md exists

Personal Notes

N/A