DevSecOps › Module 6 › Lesson 4
Lab — IaC
IaC security lab on `$DEVSEC_LAB` — threat card, hygiene checklist, Checkov scan card bundled.
Visual · t36_iac_lab
Lab: IaC security pack on YOUR $DEVSEC_LAB. Original Cyberlium.
Opening
Ship IaC security artifacts from YOUR lab stub — threats, hygiene, Checkov — zero stranger org scans or pipeline sabotage recipes.
On YOUR `$DEVSEC_LAB` per brief: (1) scope proof — lab repo path and Terraform stub labeled; (2) IaC threat card Module 6-1; (3) Terraform hygiene checklist Module 6-2; (4) Checkov scan card Module 6-3; (5) remediation stub (three findings with fix literacy); (6) integrity — `$DEVSEC_LAB` only, no stranger org IaC, no pipeline sabotage, no prod apply without ticket; (7) chmod 600 pack. Cross-link Modules 3–5 pipeline work — professional IaC literacy, not offensive CI abuse.
1. Lab deliverables
Threat card + hygiene + Checkov cross-indexed to one lab stub.
Remediation cites honest fix literacy — not fabricated pass.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions Gitleaks — https://gitleaks.io/ Bridgecrew Checkov — https://www.checkov.io/ Aqua Trivy — https://aquasecurity.github.io/trivy/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
cat > "$DEVSEC_LAB/notes/ci-lab-summary.md" <<'EOF'
# CI Security Lab Summary — YOUR lab
- security.yml: gitleaks + checkov + trivy stub jobs
- ci-pipeline-wiring.md: stage order + gate policy
- github-actions-security.txt: SHA pinning + OIDC literacy
## Refusals
- Stub only — no scanning stranger org workflows or repos
EOFCommand — copy this
grep -E 'security.yml|Refusals|gitleaks' "$DEVSEC_LAB/notes/ci-lab-summary.md" wc -l "$DEVSEC_REPO/.github/workflows/security.yml" grep -E 'runs-on|permissions' "$DEVSEC_REPO/.github/workflows/security.yml"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t36-devsec/sample-repo/.github/workflows/security.yml | Select-String gitleaks Get-Content $HOME/cyberlium-lab/t36-devsec/notes/ci-pipeline-wiring.md | Select-String FAIL
Primary tools to practice this lesson: grep, python3. Reference sites: GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); Gitleaks (https://gitleaks.io/); Bridgecrew Checkov (https://www.checkov.io/); Aqua Trivy (https://aquasecurity.github.io/trivy/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Each row cites lab stub source — not generic IaC blog advice.
Zero stranger org or prod references in pack.
3. Teardown
Cleanup verified; notes chmod 600; lab stub archived per brief.
Archive stub optional per brief.
4. What you ship: IaC lab pack
Threat card + hygiene + Checkov + remediation + integrity — chmod 600.
5. What you record before the next lesson
IaC lab pack path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
IaC lab includes pipeline sabotage recipe as bonus deliverable.
Right
IaC lab pack on `$DEVSEC_LAB` stub. Next: quiz.
Mission: IaC lab
1) Scope and lab stub proof. 2) Threat card and hygiene checklist. 3) Checkov scan card and remediation stub. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum remediation rows if Checkov clean?”
Knowledge Check
APPLY: IaC lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Pipeline sabotage earns IaC lab credit.
True or False
Knowledge Check
APPLY: IaC lab pack should:
Multiple choice