feat(lab6): Checkov + KICS scans + custom policy

[Philip-78]

Goal

Scan vulnerable Terraform with Checkov, scan Ansible and Pulumi with KICS, write a custom Checkov policy.

Changes

• submissions/lab6.md — Checkov Terraform findings, KICS Ansible + Pulumi findings, tool comparison, custom policy
• labs/lab6/policies/my-custom-policy.yaml — custom Checkov policy (CKV2_CUSTOM_1)

Testing

• Checkov Terraform: 80 failed / 49 passed across S3, IAM, RDS, DynamoDB, security groups
• KICS Ansible: 10 findings (9 HIGH hardcoded secrets, 1 LOW unpinned package)
• KICS Pulumi: 6 findings (1 CRITICAL publicly accessible RDS, 2 HIGH, 1 MEDIUM, 2 INFO)
• Custom policy CKV2_CUSTOM_1 fires on aws_s3_bucket.public_data (missing lifecycle config)

Artifacts & Screenshots

• submissions/lab6.md — full analysis
• labs/lab6/policies/my-custom-policy.yaml — custom policy

---

• Task 1 — Checkov on Terraform + top-5 rules + module-leverage analysis
• Task 2 — KICS on Ansible + Pulumi + Checkov-vs-KICS comparison
• Bonus — Custom Checkov policy demonstrably firing on vulnerable resource