Cloud › Module 10 › Lesson 1
Checklist
Topic 31 capstone checklist — cloud mindset, shared responsibility, IAM, data logging, Azure, containers, K8s, tools, findings on `$CLOUD_LAB`.
Visual · t31_capstone_checklist
Checklist consolidates Cloud Security literacy pillars. $CLOUD_LAB only. Original Cyberlium.
Opening
Capstone proves Cloud Security literacy on YOUR authorized `$CLOUD_LAB` work — not stranger tenant scans or escape PoC cookbooks.
Assemble checklist covering Modules 1–9: cloud mindset and YOUR accounts, shared responsibility, AWS IAM, data/logging, Azure literacy, Docker hygiene and escape defenses, K8s RBAC/network/secrets, CSPM/CWPP/IaC tools, findings and responsible cloud. Use on capstone walk of YOUR `$CLOUD_LAB` — never stranger tenant scan, never escape PoC cookbooks, never prod kube/cloud apply without RoE, never prod credential paste. Each row links artifact or honest N/A. Notes chmod 600 under $HOME/cyberlium-lab/t31-cloud/. Integrity rows: `$CLOUD_LAB` only, local Docker/kind YOUR cluster, RoE stated, escape = named risk + defense not PoC, limitations documented.
1. Scope and ethics
$CLOUD_LAB named with RoE reference. NEVER stranger tenant scan, NEVER escape PoC cookbooks, NEVER prod apply without ticket, NEVER prod credential paste.
Container escape = named risk + defense literacy on lab notes — not breakout execution.
Command guide
Try these commands — Scope and ethics
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: grep, python3. Reference sites: Cloud capstone (https://owasp.org/www-project-cloud-security/); NIST SP 800-144 (https://csrc.nist.gov/publications/detail/sp/800-144/final); AWS Well-Architected (https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/welcome.html); Azure security (https://learn.microsoft.com/en-us/azure/security/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Literacy pillars
Shared responsibility, IAM, logging, Azure, Docker, K8s, CSPM/CWPP/IaC, findings — linked rows.
Cross-link Topic 30 SOC L2/L3 as separate track — unauthorized paths refused.
3. Teardown
Notes secured chmod 600, report pack ready, kind cluster torn down optional per brief.
Archive retention note for mentor handoff.
4. What you ship: Topic 31 capstone checklist
One-page Cloud Security literacy capstone checklist for $CLOUD_LAB.
5. What you record before the next lesson
Checklist file path.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Checklist includes row 'container escape PoC for capstone bonus.'
Right
Checklist written. Next: Lab Path.
Mission: write capstone checklist
1) Ethics/scope section. 2) Modules 1–9 pillar rows. 3) Teardown and handoff section.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Top five capstone artifacts?”
Knowledge Check
APPLY: Checklist includes:
Multiple choice
Knowledge Check
APPLY: True or False: Escape PoC cookbooks required for capstone.
True or False
Knowledge Check
APPLY: Teardown includes:
Multiple choice