IaC Scanning

IaC scanning literacy — Terraform/CloudFormation static analysis, policy-as-code category — on `$CLOUD_LAB` template stubs.

IaC Scanning• Audio Walkthrough

00:00/03:12

Visual · t31_iac_scanning

IaC scanning = named template finding rows. $CLOUD_LAB. Original Cyberlium.

Misconfigs ship in templates before resources exist — name IaC scanner findings on YOUR lab Terraform stubs.

Infrastructure-as-Code scanning literacy names: static analyzer category (Checkov/tfsec/Snyk IaC literacy stubs), policy-as-code rule ID, failing resource block, severity, fix snippet category, and CI gate category. Analyst runs or reviews scan on `$CLOUD_LAB` instructor Terraform/CloudFormation stub — triages three findings (open SG, public bucket category, overly broad IAM category) — without applying templates to stranger accounts, without committing prod credentials in tfvars, without disabling scan gates in employer CI without RoE. Cyberlium extends Module 3 IAM and Module 4 S3 hygiene into shift-left vocabulary. Refused: unauthorized prod terraform apply, stranger account template deploy, secret paste in IaC. Lab row: IaC scan finding table three rows with fix category.

1. Named IaC scan fields

Rule ID, resource block, severity, fix snippet, CI gate — five literacy anchors.

Shift-left catches misconfig before `$CLOUD_LAB` apply — document gate row.

Command guide

Try these commands — Named IaC scan fields

═══ DOCKER & CONTAINER AUDIT ═══

Check container running state and port bindings

Command — copy this

docker ps --format "table {{.ID}}	{{.Image}}	{{.Status}}	{{.Ports}}" 2>/dev/null || echo "docker ps"

Inspect container for elevated capabilities and root user

Command — copy this

docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || true

Run security vulnerability scan on container image using Trivy

Command — copy this

trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"

═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace

Command — copy this

kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"

Primary tools to practice this lesson: checkov, curl, grep. Reference sites: Checkov (https://www.checkov.io/1.Welcome/Quick%20Start.html); Checkov policies (https://www.checkov.io/3.Custom%20Policies/Custom%20Policies%20Overview.html); Terraform AWS security (https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Common finding categories

Public exposure, overly broad IAM, unencrypted storage — link prior module rows.

Fix snippet at category level — not blind copy to prod without review.

3. Refused

No stranger account apply; no secrets in tfvars; no CI gate disable without RoE.

IaC scan literacy supports secure deploy — not unauthorized infrastructure.

4. What you ship: IaC scan finding table

Three finding rows + fix category + NEVER stranger account apply line.

5. What you record before the next lesson

IaC scan finding table path.

6. Wrong vs right: stranger tenants vs YOUR cloud accounts

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: terraform apply instructor template to stranger AWS account 'to see if scan was right.'
Right: IaC scan finding table from `$CLOUD_LAB` template stub. Next: Tools Lab.

Hands-on Exercise