Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Take a containerized app deployed via Infrastructure as Code (your own) and harden it. Requirements: rewrite the Dockerfile for a MINIMAL base (distroless/slim), a NON-ROOT user, and scan the image (Trivy/Grype) in CI, failing on critical CVEs; add IaC SCANNING (Checkov/tfsec) to the Terraform/Kubernetes manifests and FIX the misconfigurations it flags (e.g. a security group open to 0.0.0.0/0, a public bucket, missing encryption at rest); apply LEAST PRIVILEGE (Kubernetes RBAC or cloud IAM) and, on Kubernetes, a default-deny network policy; and keep secrets out of images/manifests (a secrets manager, or an encrypted Kubernetes Secret). Document the threat each hardening step mitigates.
Minimal, non-root image scanned in CI (fail on critical CVEs); no secrets baked into the image.
Checkov/tfsec scanning with the flagged misconfigurations actually fixed (not suppressed).
RBAC/IAM least privilege (plus a default-deny network policy on K8s); the threats mitigated are documented.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# Harden a container and IaC deployment ## Goal Take a containerized app deployed via Infrastructure as Code (your own) and harden it. Requirements: rewrite the Dockerfile for a MINIMAL base (distroless/slim), a NON-ROOT user, and scan the image (Trivy/Grype) in CI, failing on critical CVEs; add IaC SCANNING (Checkov/tfsec) to the Terraform/Kubernetes manifests and FIX the misconfigurations it flags (e.g. a security group open to 0.0.0.0/0, a public bucket, missing encryption at rest); apply LEAST PRIVILEGE (Kubernetes RBAC or cloud IAM) and, on Kubernetes, a default-deny network policy; and keep secrets out of images/manifests (a secrets manager, or an encrypted Kubernetes Secret). Document the threat each hardening step mitigates. ## Acceptance criteria - [ ] Container hardening: Minimal, non-root image scanned in CI (fail on critical CVEs); no secrets baked into the image. - [ ] IaC security: Checkov/tfsec scanning with the flagged misconfigurations actually fixed (not suppressed). - [ ] Least privilege: RBAC/IAM least privilege (plus a default-deny network policy on K8s); the threats mitigated are documented. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.