Cloud › Module 10 › Lesson 3
Evidence Pack
Bundle Topic 31 literacy evidence from `$CLOUD_LAB` — IAM, Docker, K8s, tools, findings; no stranger access.
Visual · t31_evidence_pack
Evidence pack = mentor handoff from $CLOUD_LAB literacy. Original Cyberlium.
Opening
One indexed pack beats scattered cloud notes — and never includes escape PoCs or stranger tenant scan exports.
Assemble evidence pack: `$CLOUD_LAB` RoE, lab setup proof, shared responsibility and IAM labs if brief assigned, Docker lab, K8s lab, tools lab, findings lab, integrity statement (YOUR accounts only, local Docker/kind YOUR cluster, escape = named risk + defense not PoC, no stranger tenant scan, limitations documented). Directory chmod 600 — index.md lists contents UTC redactions. Mentor copy: report + diagrams + scan stubs, not escape scripts. Gap paragraph for Topic 32 AI Security — separate authorized track. Scan folder for escape PoC steps, stranger ARN paste, prod credentials — zero tolerance.
1. Pack contents
Minimum: RoE, Docker, K8s, tools, findings, integrity index.
Optional: IAM/Azure module labs — no refused technique files.
Command guide
Try these commands — Pack contents
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Evidence handling — https://csrc.nist.gov/publications/detail/sp/800-144/final AWS audit — https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html Azure audit — https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/platform-logs-overview
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
python3 - <<'PY'
import os
lab = os.environ.get('CLOUD_LAB', os.path.expanduser('~/cyberlium-lab/t31-cloud'))
path = os.path.join(lab, 'notes', 'capstone-evidence-index.txt')
open(path, 'w').write('
'.join([
'CAPSTONE EVIDENCE INDEX — YOUR accounts only',
'Ethics: roe.txt, no-stranger-tenants.txt, responsible-cloud-practices.txt',
'AWS: iam-least-privilege-checklist, s3-hygiene, cloudtrail-checklist, iam-lab-findings',
'Azure: entra-id-hygiene, azure-lab-findings, defender/sentinel literacy',
'Containers: docker-hygiene, docker-lab-findings, escape-named-defenses',
'K8s: rbac-stub.yaml, networkpolicy-stub.yaml, secrets-hygiene-checklist',
'Tools: cspm/cwpp literacy, checkov/trivy output or markdown stubs',
'Findings: finding-writeup-template, remediation-priority, findings-lab-index',
'Refusals: no stranger S3 dumps, no prowler on stranger orgs, no escape PoCs',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'AWS:|Refusals|K8s:' "$CLOUD_LAB/notes/capstone-evidence-index.txt"
Primary tools to practice this lesson: grep, python3. Reference sites: Evidence handling (https://csrc.nist.gov/publications/detail/sp/800-144/final); AWS audit (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html); Azure audit (https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/platform-logs-overview). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Index fields
Artifact name, module lesson, path, UTC date, description, redactions applied.
Checklist row ↔ index row accountability.
3. Integrity
$CLOUD_LAB only, YOUR accounts discipline, no stranger access, share-safe export.
Scan before seal — remove accidental prod paste or escape PoC scripts.
4. What you ship: Cloud Security evidence pack
Bundled deliverables + index + integrity — chmod 600, report not escape PoCs default.
5. What you record before the next lesson
Evidence pack path.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Evidence pack includes container escape PoC script and stranger org scan export.
Right
Evidence pack assembled. Next: Capstone Lab.
Mission: assemble evidence pack
1) Bundle Docker K8s tools findings index. 2) Integrity statements. 3) Confirm zero refused technique files. 4) Gap note for Topic 32 AI Security.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum index rows for capstone?”
Knowledge Check
APPLY: Evidence pack includes:
Multiple choice
Knowledge Check
APPLY: True or False: Escape PoC scripts OK in pack.
True or False
Knowledge Check
APPLY: Integrity line states:
Multiple choice