Cloud › Module 8 › Lesson 3
IaC Scanning
IaC scanning literacy — Terraform/CloudFormation static analysis, policy-as-code category — on `$CLOUD_LAB` template stubs.
Visual · t31_iac_scanning
IaC scanning = named template finding rows. $CLOUD_LAB. Original Cyberlium.
Opening
Misconfigs ship in templates before resources exist — name IaC scanner findings on YOUR lab Terraform stubs.
Infrastructure-as-Code scanning literacy names: static analyzer category (Checkov/tfsec/Snyk IaC literacy stubs), policy-as-code rule ID, failing resource block, severity, fix snippet category, and CI gate category. Analyst runs or reviews scan on `$CLOUD_LAB` instructor Terraform/CloudFormation stub — triages three findings (open SG, public bucket category, overly broad IAM category) — without applying templates to stranger accounts, without committing prod credentials in tfvars, without disabling scan gates in employer CI without RoE. Cyberlium extends Module 3 IAM and Module 4 S3 hygiene into shift-left vocabulary. Refused: unauthorized prod terraform apply, stranger account template deploy, secret paste in IaC. Lab row: IaC scan finding table three rows with fix category.
1. Named IaC scan fields
Rule ID, resource block, severity, fix snippet, CI gate — five literacy anchors.
Shift-left catches misconfig before `$CLOUD_LAB` apply — document gate row.
Command guide
Try these commands — Named IaC scan fields
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Checkov — https://www.checkov.io/1.Welcome/Quick%20Start.html Checkov policies — https://www.checkov.io/3.Custom%20Policies/Custom%20Policies%20Overview.html Terraform AWS security — https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
pipx install checkov sudo apt install curl
macOS:
Command — copy this
pipx install checkov
Windows:
Command — copy this
pip install checkov
Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
cat > "$CLOUD_LAB/tools/iac-sample-violation.tf" <<'EOF'
# Intentional misconfig stub for IaC scan literacy — YOUR lab only
resource "aws_s3_bucket" "lab_bucket" {
bucket = "cyberlium-lab-t31-example"
acl = "public-read" # BAD: should use private + Block Public Access
}
EOFCommand — copy this
if command -v checkov >/dev/null; then checkov -f "$CLOUD_LAB/tools/iac-sample-violation.tf" 2>/dev/null | head -25 || checkov --version else curl -sS https://www.checkov.io/1.Welcome/Quick%20Start.html | head -10 cat > "$CLOUD_LAB/tools/checkov-missing-findings.md" <<'EOF2' # Checkov Not Installed — Markdown Findings Stub - File: tools/iac-sample-violation.tf (intentional public-read acl) - Expected: CKV_AWS_* S3 public access failure - Fix: private ACL + aws_s3_bucket_public_access_block resource - Install: pip install checkov EOF2
Command — copy this
grep CKV "$CLOUD_LAB/tools/checkov-missing-findings.md" fi
Primary tools to practice this lesson: checkov, curl, grep. Reference sites: Checkov (https://www.checkov.io/1.Welcome/Quick%20Start.html); Checkov policies (https://www.checkov.io/3.Custom%20Policies/Custom%20Policies%20Overview.html); Terraform AWS security (https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Common finding categories
Public exposure, overly broad IAM, unencrypted storage — link prior module rows.
Fix snippet at category level — not blind copy to prod without review.
3. Refused
No stranger account apply; no secrets in tfvars; no CI gate disable without RoE.
IaC scan literacy supports secure deploy — not unauthorized infrastructure.
4. What you ship: IaC scan finding table
Three finding rows + fix category + NEVER stranger account apply line.
5. What you record before the next lesson
IaC scan finding table path.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
terraform apply instructor template to stranger AWS account 'to see if scan was right.'
Right
IaC scan finding table from `$CLOUD_LAB` template stub. Next: Tools Lab.
Mission: IaC scan finding table
1) Name five IaC scan fields. 2) Three finding rows on lab template. 3) Fix category per row. 4) Write NEVER stranger account apply line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Policy-as-code — CI gate literacy stub?”
Knowledge Check
APPLY: IaC scanning literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Applying IaC to stranger accounts is lab.
True or False
Knowledge Check
APPLY: IaC finding includes:
Multiple choice