Lion Cipher Lab
Scan Infrastructure-as-Code for misconfigurations with Checkov
- Cloud Security
- Beginner
- ~30 min
- Free · no account required
Why it matters
Infrastructure-as-Code (IaC) means you describe your cloud — servers, networks, storage, firewall rules — as text files (here, Terraform) and let a tool build it. That is powerful, but it also means a single careless line can create a real, internet-exposed resource: a storage bucket open to the public, or a security group that lets the whole internet (0.0.0.0/0) reach an admin port. Finding that mistake AFTER deployment means it was live and scannable by attackers for however long it took you to notice. Scanning the code first — 'shift left,' catching the problem at the cheapest, safest…
What you'll learn
- what Infrastructure-as-Code is
- why shift-left / scanning before deploy matters
- installing and running Checkov
- reading a static-analysis finding (check id, severity, guideline)
- fixing an insecure Terraform resource and re-scanning to confirm
Steps in this lab
- The idea: catch it in the code, not in production
- What Checkov is
- Install Checkov
- Write a tiny Terraform file with a deliberate mistake
- Scan the folder
- Read the finding
- Fix the code and re-scan
- Why scanning first is a habit worth keeping