Feature/lab6

[ellilin]

Goal

Complete Lab 6 - Infrastructure-as-Code Security: Scanning & Policy Enforcement by performing comprehensive security analysis of vulnerable IaC code using multiple scanning tools (tfsec, Checkov, Terrascan, KICS) and creating comparative analysis with remediation guidance.

Changes

• Added labs/submission6.md with comprehensive IaC security analysis
• Added labs/lab6/analysis/ directory containing all scan results:
  • tfsec results: 45 findings (9 CRITICAL, 17 HIGH, 11 MEDIUM, 8 LOW)
  • Checkov results: 78 failed checks
  • Terrascan results: 22 violated policies (14 HIGH, 8 MEDIUM)
  • KICS Pulumi results: 6 findings (1 CRITICAL, 2 HIGH, 1 MEDIUM)
  • KICS Ansible results: 10 findings (9 HIGH, 1 LOW)
• Created tool comparison matrix evaluating 9 criteria across 5 scanners
• Documented top 5 critical security findings with remediation code examples
• Provided CI/CD integration strategy with quality gates

Testing

• Verified all scan reports were generated successfully using Docker containers
• Confirmed analysis files contain accurate counts and findings
• Validated submission6.md structure follows lab requirements
• Confirmed all 161 security findings are documented across three IaC frameworks

Artifacts & Screenshots

Scan Results Generated:

labs/lab6/analysis/
├── tfsec-results.json (48K)
├── tfsec-report.txt (113K)
├── checkov-terraform-results.json (606K)
├── checkov-terraform-report.txt (25K)
├── terrascan-results.json (11K)
├── terrascan-report.txt (7K)
├── kics-pulumi-results.json (7.4K)
├── kics-pulumi-report.html (53K)
├── kics-ansible-results.json (6.9K)
├── kics-ansible-report.html (53K)
└── tool-comparison.txt

Key Findings Summary:

Tool	Framework	Findings	Critical	High	Medium	Low
tfsec	Terraform	45	9	17	11	8
Checkov	Terraform	78	-	-	-	-
Terrascan	Terraform	22	0	14	8	0
KICS	Pulumi	6	1	2	1	2
KICS	Ansible	10	0	9	0	1
TOTAL	-	161	10	42	20	11

---

Checklist

• Clear title following conventional commits (e.g., feat:, fix:, docs:)
• Documentation updated if needed
• No secrets or large temporary files included (all credential examples masked with <SECRET-MASKED-EXAMPLE>)