feat(lab6): Checkov + KICS comparison across Terraform/Ansible/Pulumi + custom policy

[Meliman1000-7]

Goal

Compare IaC security scanning tools (Checkov, KICS) across three IaC formats — Terraform, Ansible, Pulumi — analyze severity/rule-frequency breakdowns, evaluate tool-selection tradeoffs, and write a custom Checkov policy to catch an organization-specific misconfiguration.

Changes

• labs/lab6/policies/my-custom-policy.yaml — custom Checkov graph check (CKV2_CUSTOM_1) enforcing iam_database_authentication_enabled = true on aws_db_instance resources
• submissions/lab6.md — full writeup: Task 1 (Checkov on Terraform + Pulumi), Task 2 (KICS on Ansible + Pulumi, tool comparison), Bonus (custom policy)

Testing

Task 1 — Checkov on Terraform

checkov -d labs/lab6/vulnerable-iac/terraform --output cli --output json --output-file-path labs/lab6/results/checkov-terraform/

49 passed, 78 failed, 0 skipped

jq '[.[0].results.failed_checks[].check_id] | group_by(.) | map({rule: .[0], count: length}) | sort_by(-.count) | .[:5]' labs/lab6/results/checkov-terraform/results_json.json

top rule: CKV_AWS_289 / CKV_AWS_355 (IAM wildcard actions/resources), 4 hits each

Task 1 — Checkov on Pulumi (only secrets framework fires; no native Pulumi support)

checkov -d labs/lab6/vulnerable-iac/pulumi --output cli --output json --output-file-path labs/lab6/results/checkov-pulumi/

1 failed (hardcoded apiKey, CKV_SECRET_6)

Task 2 — KICS on Ansible

docker run --rm -v "$(pwd)/labs/lab6:/path" checkmarx/kics:latest scan -p /path/vulnerable-iac/ansible/ -o /path/results/kics-ansible/ --report-formats json,sarif

CRITICAL:0 HIGH:9 MEDIUM:0 LOW:1 INFO:0 TOTAL:10

Task 2 — KICS on Pulumi

docker run --rm -v "$(pwd)/labs/lab6:/path" checkmarx/kics:latest scan -p /path/vulnerable-iac/pulumi/ -o /path/results/kics-pulumi/ --report-formats json,sarif

CRITICAL:1 HIGH:2 MEDIUM:1 LOW:0 INFO:2 TOTAL:6

Bonus — custom Checkov policy

checkov -d labs/lab6/vulnerable-iac/terraform --external-checks-dir labs/lab6/policies --output cli --output json --output-file-path labs/lab6/results/checkov-custom/

jq '.[0].results.failed_checks[] | select(.check_id | startswith("CKV2_CUSTOM_"))' labs/lab6/results/checkov-custom/results_json.json

2 FAILED, severity HIGH: aws_db_instance.unencrypted_db, aws_db_instance.weak_db

Artifacts & Screenshots

• submissions/lab6.md
• labs/lab6/policies/my-custom-policy.yaml

Checklist

• Title is clear (feat(lab6): style)
• No secrets or large temp files committed
• Submission file at submissions/lab6.md exists