feat(lab6): IaC security — Checkov + KICS + custom policy

[Basinkse21]

Goal

Scan vulnerable Terraform/Pulumi/Ansible with Checkov and KICS, and write a custom Checkov policy.

Changes

• submissions/lab6.md — Checkov + KICS findings tables, module-leverage analysis, tool comparison
• labs/lab6/policies/my-custom-policy.yaml — custom Checkov policy (RDS storage encryption)

Testing

• Checkov on Terraform: 80 failed across 16 resources; top rules = IAM wildcard (CKV_AWS_288/289/290/355)
• Checkov on Pulumi: 1 (no native Pulumi framework) — contrast with KICS
• KICS on Ansible: 10 findings (9 HIGH); KICS on Pulumi: 6 (1 CRITICAL public RDS)
• Custom policy CKV2_CUSTOM_1 fires on aws_db_instance.unencrypted_db

---

Checklist

• Task 1 — Checkov on Terraform + Pulumi with top-5 rules and module-leverage analysis
• Task 2 — KICS on Ansible with Checkov-vs-KICS comparison
• Bonus — Custom Checkov policy demonstrably firing