Lion Cipher Lab
Scan Terraform for misconfigurations with Checkov
- Cloud Security
- Beginner
- ~45 min
- Free · no account required
Why it matters
Modern cloud is built from text. Instead of clicking around a web console, teams describe their servers, storage, networks, and firewall rules in files -- INFRASTRUCTURE-AS-CODE -- and a tool like Terraform reads those files and builds the real thing. That is powerful, but it has a sharp edge: a single careless line can create a real, internet-exposed resource. A storage bucket set to 'public', a firewall rule opened to the whole internet, an unencrypted database -- each is just one setting in a file, and once that file is deployed the mistake is live and reachable by anyone. These are called…
What you'll learn
- understanding what Infrastructure-as-Code (IaC) and Terraform are, from zero
- understanding what a 'misconfiguration' is and why an insecure setting in code becomes a real, live exposure once deployed
- understanding what static analysis and 'policy-as-code' mean, and what 'shift-left' security is
- installing Python 3 and pip (the tools Checkov needs) on Windows, macOS, or Linux
- installing Checkov, the free open-source IaC scanner, with a single pip command
- writing a tiny sample Terraform file that contains a deliberate misconfiguration (a public S3 bucket)
- running your first Checkov scan and making a real table of PASSED and FAILED findings appear
- reading a Checkov finding: the check id, PASSED/FAILED, the resource, the file and line number, and the guide link
- fixing the Terraform (making the bucket private and adding a public-access block) and re-scanning to confirm the finding clears
- doing all of this locally, with no cloud account, no credentials, and no spend -- because static analysis only reads the file text
Steps in this lab
- What this lab is, and why scanning your own file is completely safe
- The words you need first: IaC, Terraform, misconfiguration, static analysis, policy-as-code, shift-left
- Install Python and pip (the tools Checkov needs)
- Install Checkov with one pip command
- Write a tiny Terraform file with a DELIBERATE misconfiguration
- Run your first scan and make a table of findings appear
- Read a finding: check id, PASSED/FAILED, the resource, and the file:line
- Fix the Terraform: make the bucket private and block public access
- Re-scan and confirm the finding cleared
- Why this one skill makes you a defender, and where it goes next