Lion Cipher Lab
Automate cloud guardrails with Cloud Custodian
- Cloud Security
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Posture scanners like ScoutSuite and Prowler answer a vital question -- what is misconfigured right now? -- but they answer it once, and only when someone remembers to run them. The moment the scan finishes, drift begins: someone opens a security group to the whole internet, launches an unencrypted volume, or ships a bucket without the required tag, and nobody knows until the next scan. Cloud Custodian closes that gap. It lets you write a misconfiguration as a small, reusable YAML policy -- 'find every security group open to 0.0.0.0/0 on port 22' -- validate it, and run it. On its own that is…
What you'll learn
- the difference between FINDING misconfigurations (a point-in-time posture scan) and ENFORCING against them continuously with policy as code
- the anatomy of a Cloud Custodian policy: name, resource, filters (the query), actions (what to do), and execution mode
- writing a YAML policy that matches a real class of misconfiguration -- e.g. security groups open to 0.0.0.0/0 on port 22
- validating a policy offline with `custodian validate` before it ever touches your account
- running a policy in DRY-RUN so resources are matched but NOTHING is changed, then reading the resources.json output it writes
- reading (but treating with respect) an action block that would remediate, and understanding how to gate it behind dryrun + a sandbox + notifications
- the safe workflow every practitioner uses: filter -> dryrun -> review -> then (and only then) act
- when policy-as-code guardrails beat manual audits, and how custodian complements AWS Config, SCPs and OPA/Conftest
Steps in this lab
- Read this first: everything you RUN here is read-only
- Why policy-as-code beats a point-in-time scan
- Set up a READ-ONLY AWS credential
- Install Cloud Custodian in a Python virtual environment
- Understand the anatomy of a policy
- Write a policy: security groups open to the world on SSH
- Validate the policy OFFLINE before it touches your account
- Run it in DRY-RUN and read resources.json
- READ an action block (do NOT run this) -- how remediation works
- Clean up: delete the access key
- Do it better: continuous, notifying, sandbox-staged guardrails