Cloud › Module 10 › Lesson 4
Lab — Capstone
Execute capstone on `$CLOUD_LAB` — checklist, lab path, evidence pack sealed; zero stranger access.
Visual · t31_capstone_lab
Capstone: checklist × $CLOUD_LAB literacy evidence. Original Cyberlium.
Opening
Close the Cloud Security literacy loop — containers hardened, K8s segmented, findings shipped, RoE signed — without stranger tenant scans or escape PoCs.
Walk Topic 31 checklist on YOUR `$CLOUD_LAB`: verify RoE, lab path current, Docker and K8s labs complete, tools and findings packs indexed, scan for escape PoCs and stranger tenant refs (must be zero). Update index with capstone UTC completion. Integrity paragraph: YOUR accounts discipline and escape defense literacy key insight from YOUR path. No stranger tenant scan, no escape PoC cookbooks, no prod cloud/kube apply without RoE, no prod credential paste. Optional mentor review — three clarity questions. Tear down kind cluster after if brief requires.
1. Execute checklist
Check each row; link artifact or N/A; confirm zero refused techniques in any file.
Scan sealed pack for escape PoCs and stranger ARNs — remove before handoff.
Command guide
Try these commands — Execute checklist
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Cloud Security capstone — https://owasp.org/www-project-cloud-security/ NIST cloud — https://csrc.nist.gov/publications/detail/sp/800-144/final AWS security — https://docs.aws.amazon.com/security/ Checkov — https://www.checkov.io/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
pipx install awscli # or official AWS CLI v2 sudo apt install python3
macOS:
Command — copy this
brew install awscli brew install python3
Windows: Install AWS CLI v2 from Amazon Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
grep NEVER "$CLOUD_LAB/notes/no-stranger-tenants.txt"
grep -E 'HARD BAN|NEVER' "$CLOUD_LAB/containers/escape-named-defenses.txt" "$CLOUD_LAB/findings/responsible-cloud-practices.txt"
echo '=== Capstone: shared resp → IAM → S3/Trail → Azure → docker → K8s → tools → findings ==='YOUR ACCOUNT — final identity check
Command — copy this
aws sts get-caller-identity 2>/dev/null || echo 'YOUR AWS account optional for capstone'
az account show --query name -o tsv 2>/dev/null || echo 'YOUR Azure subscription optional for capstone'
grep '\[ \]' "$CLOUD_LAB/notes/capstone-checklist.txt" | head -5
grep -E 'Role|NetworkPolicy' "$CLOUD_LAB/k8s/rbac-stub.yaml" "$CLOUD_LAB/k8s/networkpolicy-stub.yaml"
python3 - <<'PY'
import os
lab = os.environ.get('CLOUD_LAB', os.path.expanduser('~/cyberlium-lab/t31-cloud'))
path = os.path.join(lab, 'notes', 'capstone-summary.txt')
open(path, 'w').write('
'.join([
'Cloud Security Capstone',
'scope: YOUR $HOME/cyberlium-lab/t31-cloud/ + YOUR cloud accounts',
'aws: IAM least privilege + S3 hygiene + CloudTrail checklist',
'azure: Entra hygiene + Defender/Sentinel literacy',
'containers: docker hygiene + trivy (or stub) + escape defenses named',
'k8s: RBAC + NetworkPolicy yaml stubs on YOUR cluster',
'tools: CSPM/CWPP literacy + checkov IaC scan (or stub)',
'findings: writeups + remediation priority + responsible practices',
'never: stranger S3 dumps / prowler stranger orgs / escape PoCs / unauthorized priv-esc',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'scope|never|k8s' "$CLOUD_LAB/notes/capstone-summary.txt"
═══ WINDOWS ═══
Capstone on YOUR lab Windows VM only
Command — copy this
Get-Content $HOME/cyberlium-lab/t31-cloud/notes/no-stranger-tenants.txt | Select-String NEVER Get-Content $HOME/cyberlium-lab/t31-cloud/notes/capstone-summary.txt | Select-String never aws sts get-caller-identity 2>$null
Primary tools to practice this lesson: grep, aws, python3. Reference sites: Cloud Security capstone (https://owasp.org/www-project-cloud-security/); NIST cloud (https://csrc.nist.gov/publications/detail/sp/800-144/final); AWS security (https://docs.aws.amazon.com/security/); Checkov (https://www.checkov.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Integrity paragraph
RoE + YOUR accounts + escape defense literacy key → professional handoff idea from YOUR lab path.
Name what breaks if you skip scope or scan stranger tenants — ethics tie-in.
3. Shutdown
Notes secured chmod 600; index signed complete UTC.
Ready for Topic 32 AI Security on separate authorized track.
4. What you ship: capstone evidence pack complete
Checked checklist + sealed literacy pack + integrity paragraph + zero refused scan.
5. What you record before the next lesson
Capstone pack path. $CLOUD_LAB quiet.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Capstone includes container escape PoC walkthrough as bonus exhibit.
Right
Capstone complete on $CLOUD_LAB with full teardown. Next: topic quiz.
Mission: Topic 31 capstone
1) Walk checklist with evidence links. 2) Integrity paragraph from your path. 3) Seal pack — zero refused files. 4) Sign index UTC complete.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum N/A documentation?”
Knowledge Check
APPLY: Capstone target:
Multiple choice
Knowledge Check
APPLY: True or False: Escape PoC cookbooks earn capstone credit.
True or False
Knowledge Check
APPLY: Capstone teardown includes:
Multiple choice