Cloud › Module 8 › Lesson 3
IaC Scanning
IaC scanning literacy — Terraform/CloudFormation static analysis, policy-as-code category — on `$CLOUD_LAB` template stubs.
Visual · t31_iac_scanning
IaC scanning = named template finding rows. $CLOUD_LAB. Original Cyberlium.
Opening
Misconfigs ship in templates before resources exist — name IaC scanner findings on YOUR lab Terraform stubs.
Infrastructure-as-Code scanning literacy names: static analyzer category (Checkov/tfsec/Snyk IaC literacy stubs), policy-as-code rule ID, failing resource block, severity, fix snippet category, and CI gate category. Analyst runs or reviews scan on `$CLOUD_LAB` instructor Terraform/CloudFormation stub — triages three findings (open SG, public bucket category, overly broad IAM category) — without applying templates to stranger accounts, without committing prod credentials in tfvars, without disabling scan gates in employer CI without RoE. Cyberlium extends Module 3 IAM and Module 4 S3 hygiene into shift-left vocabulary. Refused: unauthorized prod terraform apply, stranger account template deploy, secret paste in IaC. Lab row: IaC scan finding table three rows with fix category.
1. Named IaC scan fields
Rule ID, resource block, severity, fix snippet, CI gate — five literacy anchors.
Shift-left catches misconfig before `$CLOUD_LAB` apply — document gate row.
Command guide
Try these commands — Named IaC scan fields
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: checkov, curl, grep. Reference sites: Checkov (https://www.checkov.io/1.Welcome/Quick%20Start.html); Checkov policies (https://www.checkov.io/3.Custom%20Policies/Custom%20Policies%20Overview.html); Terraform AWS security (https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Common finding categories
Public exposure, overly broad IAM, unencrypted storage — link prior module rows.
Fix snippet at category level — not blind copy to prod without review.
3. Refused
No stranger account apply; no secrets in tfvars; no CI gate disable without RoE.
IaC scan literacy supports secure deploy — not unauthorized infrastructure.
4. What you ship: IaC scan finding table
Three finding rows + fix category + NEVER stranger account apply line.
5. What you record before the next lesson
IaC scan finding table path.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
terraform apply instructor template to stranger AWS account 'to see if scan was right.'
Right
IaC scan finding table from `$CLOUD_LAB` template stub. Next: Tools Lab.
Mission: IaC scan finding table
1) Name five IaC scan fields. 2) Three finding rows on lab template. 3) Fix category per row. 4) Write NEVER stranger account apply line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Policy-as-code — CI gate literacy stub?”
Knowledge Check
APPLY: IaC scanning literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Applying IaC to stranger accounts is lab.
True or False
Knowledge Check
APPLY: IaC finding includes:
Multiple choice