Cloud › Module 8 › Lesson 4
Lab — Tools
Cloud-native tools lab on `$CLOUD_LAB` — CSPM table, CWPP triage, IaC scan findings bundled.
Visual · t31_tools_lab
Lab: CSPM CWPP IaC pack on YOUR $CLOUD_LAB. Original Cyberlium.
Opening
Ship cloud-native tool literacy artifacts from YOUR lab stubs — CSPM, CWPP, IaC — zero stranger tenant scans or escape PoCs.
On YOUR `$CLOUD_LAB` per brief: (1) scope proof — YOUR sandbox or instructor stub labeled; (2) CSPM finding table three rows Module 8-1; (3) CWPP alert triage two rows Module 8-2; (4) IaC scan finding table three rows Module 8-3; (5) tool comparison stub (CSPM vs CWPP vs IaC layer); (6) integrity — `$CLOUD_LAB` only, no stranger tenant scan, no escape PoC, no unauthorized prod apply; (7) chmod 600 pack. Cross-link container and K8s modules — workload alerts reference lab namespace.
1. Lab deliverables
CSPM + CWPP + IaC tables cross-indexed with layer comparison stub.
Each finding cites lab resource ID — not fabricated prod ARN.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Checkov — https://www.checkov.io/ Trivy — https://aquasecurity.github.io/trivy/ OWASP cloud — https://owasp.org/www-project-cloud-security/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
pipx install checkov
Install from https://aquasecurity.github.io/trivy/
macOS:
Command — copy this
pipx install checkov brew install trivy
Windows:
Command — copy this
pip install checkov
Download Trivy releases / use WSL
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
cat > "$CLOUD_LAB/tools/tools-lab-summary.md" <<'EOF'
# Cloud-Native Tools Lab — YOUR assets
## CSPM (YOUR account)
- Security Hub / Defender recommendations reviewed
## IaC scan
- checkov on tools/iac-sample-violation.tf OR markdown stub if missing
## Image scan
- trivy on YOUR docker image OR markdown stub if missing
## Refusals
- No prowler on stranger orgs; no escape PoC; no stranger S3 dumps
EOFCommand — copy this
command -v checkov >/dev/null && echo 'checkov: installed' || echo 'checkov: use markdown stub' command -v trivy >/dev/null && echo 'trivy: installed' || echo 'trivy: use markdown stub' grep -E 'Refusals|YOUR assets|CSPM' "$CLOUD_LAB/tools/tools-lab-summary.md"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t31-cloud/tools/cspm-named-literacy.txt | Select-String NEVER checkov --version 2>$null; trivy --version 2>$null
Primary tools to practice this lesson: checkov, trivy, grep. Reference sites: Checkov (https://www.checkov.io/); Trivy (https://aquasecurity.github.io/trivy/); OWASP cloud (https://owasp.org/www-project-cloud-security/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Disposition documented per finding — no silent ignore of critical.public.
Zero escape PoC or stranger tenant references in pack.
3. Integrity
Stranger scan or prod apply without RoE = zero credit.
Mentor pack chmod 600.
4. What you ship: cloud-native tools lab pack
CSPM + CWPP + IaC + comparison + integrity — chmod 600.
5. What you record before the next lesson
Tools lab pack path.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Tools lab includes stranger AWS org scan export as primary evidence.
Right
Tools lab pack on `$CLOUD_LAB` stubs. Next: quiz.
Mission: tools lab
1) Scope and account stub proof. 2) CSPM CWPP IaC tables. 3) Tool layer comparison stub. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Layer comparison — minimum rows?”
Knowledge Check
APPLY: Tools lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Stranger cloud scan belongs in tools lab.
True or False
Knowledge Check
APPLY: CSPM vs CWPP vs IaC:
Multiple choice