feat(lab6): Checkov + KICS scans + custom policy

[Maflock]

Goal

Scan vulnerable Terraform + Pulumi with Checkov, scan vulnerable Ansible with KICS, then (bonus) write a custom Checkov policy for a project-specific rule.

Changes

• Added submissions/lab6.md
• Added labs/lab6/policies/my-custom-policy.yaml

Testing

checkov -d labs/lab6/vulnerable-iac/terraform --output json \
  --output-file-path labs/lab6/results/checkov-terraform/
# Result: 80 failed / 49 passed across 18 resources

docker run --rm -v "$(pwd)/labs/lab6":/path checkmarx/kics:v2.1.3 \
  scan -p /path/vulnerable-iac/ansible/ -o /path/results/kics-ansible/ --report-formats json
# Result: 10 findings - 9 HIGH, 1 LOW

docker run --rm -v "$(pwd)/labs/lab6":/path checkmarx/kics:v2.1.3 \
  scan -p /path/vulnerable-iac/pulumi/ -o /path/results/kics-pulumi/ --report-formats json
# Result: 6 findings (1 CRITICAL, 2 HIGH, 1 MEDIUM, 2 INFO)

checkov -d labs/lab6/vulnerable-iac/terraform --external-checks-dir labs/lab6/policies \
  --check CKV2_CUSTOM_1 --output json --output-file-path labs/lab6/results/checkov-custom/
# Result: custom policy fires on 2 RDS instances

---

Artifacts & Screenshots

• submissions/lab6.md
• labs/lab6/policies/my-custom-policy.yaml

Checklist

• Title is clear (feat(lab6): Checkov + KICS scans + custom policy)
• No secrets/large temp files committed
• submissions/lab6.md exists
• Task 1 — Checkov on Terraform + Pulumi with top-5 rules and module-leverage analysis
• Task 2 — KICS on Ansible with Checkov-vs-KICS comparison
• Bonus — Custom Checkov policy demonstrably firing on the vulnerable sample