Lab — Capstone

Execute capstone on `$CLOUD_LAB` — checklist, lab path, evidence pack sealed; zero stranger access.

Lab — Capstone• Audio Walkthrough

00:00/03:02

Visual · t31_capstone_lab

Capstone: checklist × $CLOUD_LAB literacy evidence. Original Cyberlium.

Close the Cloud Security literacy loop — containers hardened, K8s segmented, findings shipped, RoE signed — without stranger tenant scans or escape PoCs.

Walk Topic 31 checklist on YOUR `$CLOUD_LAB`: verify RoE, lab path current, Docker and K8s labs complete, tools and findings packs indexed, scan for escape PoCs and stranger tenant refs (must be zero). Update index with capstone UTC completion. Integrity paragraph: YOUR accounts discipline and escape defense literacy key insight from YOUR path. No stranger tenant scan, no escape PoC cookbooks, no prod cloud/kube apply without RoE, no prod credential paste. Optional mentor review — three clarity questions. Tear down kind cluster after if brief requires.

1. Execute checklist

Check each row; link artifact or N/A; confirm zero refused techniques in any file.

Scan sealed pack for escape PoCs and stranger ARNs — remove before handoff.

Command guide

Try these commands — Execute checklist

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Cloud Security capstone — https://owasp.org/www-project-cloud-security/ NIST cloud — https://csrc.nist.gov/publications/detail/sp/800-144/final AWS security — https://docs.aws.amazon.com/security/ Checkov — https://www.checkov.io/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

pipx install awscli  # or official AWS CLI v2
sudo apt install python3

macOS:

Command — copy this

brew install awscli
brew install python3

Windows: Install AWS CLI v2 from Amazon Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
grep NEVER "$CLOUD_LAB/notes/no-stranger-tenants.txt"
grep -E 'HARD BAN|NEVER' "$CLOUD_LAB/containers/escape-named-defenses.txt" "$CLOUD_LAB/findings/responsible-cloud-practices.txt"
echo '=== Capstone: shared resp → IAM → S3/Trail → Azure → docker → K8s → tools → findings ==='

YOUR ACCOUNT — final identity check

Command — copy this

aws sts get-caller-identity 2>/dev/null || echo 'YOUR AWS account optional for capstone'
az account show --query name -o tsv 2>/dev/null || echo 'YOUR Azure subscription optional for capstone'
grep '\[ \]' "$CLOUD_LAB/notes/capstone-checklist.txt" | head -5
grep -E 'Role|NetworkPolicy' "$CLOUD_LAB/k8s/rbac-stub.yaml" "$CLOUD_LAB/k8s/networkpolicy-stub.yaml"
python3 - <<'PY'
import os
lab = os.environ.get('CLOUD_LAB', os.path.expanduser('~/cyberlium-lab/t31-cloud'))
path = os.path.join(lab, 'notes', 'capstone-summary.txt')
open(path, 'w').write('
'.join([
  'Cloud Security Capstone',
  'scope: YOUR $HOME/cyberlium-lab/t31-cloud/ + YOUR cloud accounts',
  'aws: IAM least privilege + S3 hygiene + CloudTrail checklist',
  'azure: Entra hygiene + Defender/Sentinel literacy',
  'containers: docker hygiene + trivy (or stub) + escape defenses named',
  'k8s: RBAC + NetworkPolicy yaml stubs on YOUR cluster',
  'tools: CSPM/CWPP literacy + checkov IaC scan (or stub)',
  'findings: writeups + remediation priority + responsible practices',
  'never: stranger S3 dumps / prowler stranger orgs / escape PoCs / unauthorized priv-esc',
]))
print(f'Wrote {path}')
PY

Command — copy this

grep -E 'scope|never|k8s' "$CLOUD_LAB/notes/capstone-summary.txt"

═══ WINDOWS ═══

Capstone on YOUR lab Windows VM only

Command — copy this

Get-Content $HOME/cyberlium-lab/t31-cloud/notes/no-stranger-tenants.txt | Select-String NEVER
Get-Content $HOME/cyberlium-lab/t31-cloud/notes/capstone-summary.txt | Select-String never
aws sts get-caller-identity 2>$null

Primary tools to practice this lesson: grep, aws, python3. Reference sites: Cloud Security capstone (https://owasp.org/www-project-cloud-security/); NIST cloud (https://csrc.nist.gov/publications/detail/sp/800-144/final); AWS security (https://docs.aws.amazon.com/security/); Checkov (https://www.checkov.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Integrity paragraph

RoE + YOUR accounts + escape defense literacy key → professional handoff idea from YOUR lab path.

Name what breaks if you skip scope or scan stranger tenants — ethics tie-in.

3. Shutdown

Notes secured chmod 600; index signed complete UTC.

Ready for Topic 32 AI Security on separate authorized track.

4. What you ship: capstone evidence pack complete

Checked checklist + sealed literacy pack + integrity paragraph + zero refused scan.

5. What you record before the next lesson

Capstone pack path. $CLOUD_LAB quiet.

6. Wrong vs right: stranger tenants vs YOUR cloud accounts

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Capstone includes container escape PoC walkthrough as bonus exhibit.
Right: Capstone complete on $CLOUD_LAB with full teardown. Next: topic quiz.

Hands-on Exercise