feat(lab6): Checkov, KICS scans and custom policy

[Wilikson173]

Goal

Scan the vulnerable Terraform, Pulumi, and Ansible IaC with Checkov and KICS, and add a custom Checkov policy enforcing a minimum RDS backup retention period.

Changes

• submissions/lab6.md — findings tables (Checkov on Terraform, KICS on Pulumi + Ansible), module-leverage analysis, Checkov-vs-KICS comparison, and bonus custom policy writeup
• labs/lab6/policies/my-custom-policy.yaml — custom Checkov policy CKV_CUSTOM_2 requiring aws_db_instance.backup_retention_period > 6

Testing

checkov -d labs/lab6/vulnerable-iac/terraform

--output cli --output json

--output-file-path labs/lab6/results/checkov-terraform/
docker run --rm -v "$(pwd)/labs/lab6:/path" checkmarx/kics:latest

scan -p /path/vulnerable-iac/pulumi/ -o /path/results/kics-pulumi/

--report-formats json,sarif
docker run --rm -v "$(pwd)/labs/lab6:/path" checkmarx/kics:latest

scan -p /path/vulnerable-iac/ansible/ -o /path/results/kics-ansible/

--report-formats json,sarif
checkov -d labs/lab6/vulnerable-iac/terraform

--external-checks-dir labs/lab6/policies

--output cli --output json

--output-file-path labs/lab6/results/checkov-custom/
jq '.[] | select(.check_type=="terraform") | .results.failed_checks[] | select(.check_id=="CKV_CUSTOM_2")'

labs/lab6/results/checkov-custom/results_json.json
-> CKV_CUSTOM_2 fired FAILED on 2 resources: aws_db_instance.unencrypted_db, aws_db_instance.weak_db

Artifacts & Screenshots

• submissions/lab6.md

---

Checklist

• [+] Title follows feat(lab6): <topic> style
• [+] No secrets or large temp files committed
• [+] Submission file exists at submissions/lab6.md