Project · Advanced · about 20 hours
A cloud security posture review with fixes as code
Scan infrastructure code and a sandbox account against CIS benchmarks, prioritise findings, fix them in Terraform and add checks to CI so they cannot come back.
Skills:Security compliance and data protection, Identity and access management, Security fundamentals, Infrastructure as code
Part of: Cloud and Network Engineer
Data and licences
- Prowler (open-source cloud security tool) ↗Apache License 2.0
Brief
Security compliance appeared in over half of the Cloud and Network Engineer postings we read. Auditors ask for evidence against frameworks such as the CIS benchmarks; engineers must fix issues without breaking things. Deploy a deliberately weak setup and fix it. Cost warning: this project uses paid cloud resources. Set a budget alert before you start, stay in the free tier where you can, and destroy everything at the end of each session.
What to build
Deploy a sandbox environment with Terraform that includes common mistakes: a public bucket, an open SSH security group, unencrypted volumes, no logging, an admin CI user
Scan the code with Checkov or tfsec and the account with Prowler or a similar tool, and map findings to CIS controls
Prioritise by risk and fix the top ten in Terraform
Rescan and record before and after results
Add the IaC scan to CI with the fixed rules set to fail the build
Deliverables
Repository with
infra/,scans/before,scans/after,.github/workflows/andREPORT.md
How it is graded
Reviewers reintroduce one fixed problem in a pull request and check that CI fails, then read the report as an auditor would.
Stretch
Add organisation-level guard rails (for example service control policies) that make the worst mistakes impossible.
Deliverables
- Scan results from an IaC scanner and an account scanner mapped to CIS controls
- A prioritised findings list with risk and effort
- Terraform changes that fix the top findings, with before and after scans
- CI policy checks that block the fixed problems from returning
How a reviewer grades it
| Criterion | Weight | What good looks like |
|---|---|---|
| Findings are correctly mapped to controls and prioritised by risk | 25% | |
| Fixes are made in code and verified by rescanning | 30% | |
| CI prevents regressions | 25% | |
| Report is useful to both engineers and auditors | 20% |