feat(lab6): Checkov + KICS scans + custom YAML policy

[alileeeek]

Goal

Lab 6 submission: IaC scanned with Checkov (Terraform) and KICS (Ansible + Pulumi), triage report completed, and a custom Checkov policy written and verified.

Changes

• Added submissions/lab6.md with full triage report (Checkov + KICS findings, module-leverage analysis, Checkov-vs-KICS comparison).
• Added labs/lab6/policies/my-custom-policy.yaml — custom Checkov policy (CKV2_CUSTOM_1) enforcing RDS deletion protection.

Testing

• Checkov scan on Terraform completed: 129 checks (49 passed, 82 failed across terraform + secrets frameworks).
• KICS scan on Ansible completed: 10 findings (9 HIGH, 1 LOW).
• KICS scan on Pulumi completed: 6 findings (1 CRITICAL, 2 HIGH, 1 MEDIUM, 2 INFO).
• Custom policy CKV2_CUSTOM_1 fired on both RDS instances (unencrypted_db, weak_db) in database.tf.

Artifacts & Screenshots

• See submissions/lab6.md for the full report with severity tables, top-5 rules, module-leverage analysis, and business justification for the custom policy.
• Scanner outputs are excluded per lab spec (regeneratable).

---

Checklist

• Title is clear (feat(lab6): Checkov + KICS scans + custom YAML policy style)
• No secrets/large temp files committed (labs/lab6/results/ excluded via .gitignore)
• Submission file at submissions/lab6.md exists
• Custom policy file at labs/lab6/policies/my-custom-policy.yaml exists

---

Task Checklist

• Task 1 done — Checkov on Terraform with top-5 rules + module-leverage analysis
• Task 2 done — KICS on Ansible + Pulumi with Checkov-vs-KICS comparison
• Bonus done — Custom Checkov YAML policy (CKV2_CUSTOM_1) demonstrably firing on 2 RDS instances