Lab 06 solution

[ph1larmon1a]

Goal

Perform a comprehensive security analysis of vulnerable Infrastructure-as-Code (IaC) using multiple scanning tools to identify and compare misconfigurations, evaluate tool effectiveness, and develop remediation insights.

Changes

• Added labs/submission6.md, documenting:

  • Terraform Scanning: Results from tfsec, Checkov, and Terrascan, including comparative metrics and insights.
  • Pulumi Scanning: Results from KICS, covering Pulumi-specific security checks and severity analysis.
  • Ansible Scanning: Results from KICS, identifying high-severity misconfigurations and best-practice violations.
  • Comprehensive Tool Comparison: Evaluation matrix (speed, accuracy, false positives, CI/CD integration).
  • Security Domain Analysis: Mapping of findings to key categories (Encryption, IAM, Network, Secrets, Compliance).
  • Critical Findings: At least five major vulnerabilities analyzed with code-based remediation examples.
  • Tool Selection & CI/CD Strategy: Recommendations for multi-stage pipelines and tool usage in DevSecOps.

• Generated and analyzed security reports in labs/lab6/analysis/:

  • tfsec-results.json, checkov-terraform-results.json, terrascan-results.json
  • kics-pulumi-results.json, kics-ansible-results.json
  • Comparison summaries: terraform-comparison.txt, pulumi-analysis.txt, ansible-analysis.txt, tool-comparison.txt

Testing

1. Reproduced Scans:

   • Executed all Docker commands as per lab instructions for tfsec, Checkov, Terrascan, and KICS.
   • Verified successful report generation under labs/lab6/analysis/.

2. Validated Output:

   • Used jq to confirm JSON structures and count findings.
   • Manually reviewed readable .txt reports for alignment with summary counts.

3. Analysis Verification:

   • Cross-referenced tool outputs to ensure category consistency.
   • Compared reported findings between tools to confirm differences in detection depth and coverage.

4. Deliverable Confirmation:

   • Confirmed all expected artifacts exist and labs/submission6.md comprehensively documents results and insights.

Artifacts & Screenshots

• Terraform reports
  labs/lab6/analysis/tfsec-results.json
labs/lab6/analysis/tfsec-report.txt
labs/lab6/analysis/checkov-terraform-results.json
labs/lab6/analysis/checkov-terraform-report.txt
labs/lab6/analysis/terrascan-results.json
labs/lab6/analysis/terrascan-report.txt

• Pulumi reports (KICS)
  labs/lab6/analysis/kics-pulumi-results.json
labs/lab6/analysis/kics-pulumi-report.html
labs/lab6/analysis/kics-pulumi-report.txt

• Ansible reports (KICS)
  labs/lab6/analysis/kics-ansible-results.json
labs/lab6/analysis/kics-ansible-report.html
labs/lab6/analysis/kics-ansible-report.txt

• Summary rollups
  labs/lab6/analysis/terraform-comparison.txt
labs/lab6/analysis/pulumi-analysis.txt
labs/lab6/analysis/ansible-analysis.txt

---

Checklist

• PR has a clear and descriptive title
• Documentation updated if needed
• No secrets or large temporary files committed
• Task 1 done — Terraform & Pulumi scanning with multiple tools
• Task 2 done — Ansible security analysis
• Task 3 done — Comparative tool analysis and security insights