Catching Infrastructure Misconfiguration Before Apply
By Richard Augenti
Scan Terraform for the misconfigurations that become public buckets and open security groups, fix them, and wire the scan into the plan stage where it blocks a merge.
Free to browse. Takes about 45 minutes once you start.
Lab Overview
The reporting stack's Terraform provisions an S3 bucket that allows public access and a security group open to the world on SSH. Neither has been applied yet, which makes this the cheapest moment it will ever be to fix them.
In this lab you scan the Terraform with Checkov, fix both exposures, and gate the pipeline so the next one cannot merge. You also scope the scanner to the checks that matter, because a scanner that reports everything is a scanner nobody reads.
Everything runs locally on the lab machine against Terraform source. Nothing is applied and no cloud account is involved.
What to Expect
- Environment: a single Ubuntu machine you connect to over SSH, with the Terraform workspace in place. Checkov runs as a container. No cluster required.
- Access: SSH credentials are generated for your session and shown in the workspace. They are destroyed when the lab ends.
- Nothing is applied: you work on infrastructure code only. No resources are created and no cloud credentials are used.
- Progress: your work is not saved. If the lab expires or you quit, the machine and everything on it is destroyed.
What are hands-on labs?
A lab is a real environment, not a simulation. You get a live machine with the tooling already installed, a task taken from production work, and root access to take it apart. Nothing is mocked, nothing is multiple choice. It either works or it doesn't.
Real tooling
The same commands you would run at work, on a machine that is already set up for them. No screenshots, no sandboxed toy version.
Break it freely
Everything is disposable. When the clock runs out the environment is destroyed with everything in it, so there is no reason to be careful.
Useful on Monday
Built by engineers who run these systems in production. Skills you can apply to your own stack the same week, not exam preparation.