Cloud on CENG Lab -- Ryo Ueda

IaC Scanning Tools: Checkov, TFLint, Grype, and pre-commit

Mon, 08 Jun 2026 00:00:00 +0000

Tool Overview #

Tool	Role	What it catches
Checkov	IaC security scanner	Misconfigurations in Terraform, CloudFormation, K8s
TFLint	Terraform linter	Invalid resource types, deprecated syntax, bad practices
Grype	Vulnerability scanner	CVEs in container images, filesystems, SBOMs
pre-commit	Git hook framework	Runs all of the above automatically on every commit

git commit → pre-commit → TFLint + Checkov (local)
 ↓
 CI pipeline → Checkov + TFLint + Grype (full gate)

1. Checkov #

Static analysis tool for IaC security. 1,000+ built-in policies covering AWS, Azure, GCP, and Kubernetes. Maintained by Palo Alto Networks (acquired Bridgecrew) under Apache 2.0.

【Lab】Static Website with Hugo + AWS

Sun, 07 Jun 2026 00:00:00 +0000

Overview #

This lab covers building a personal website from scratch using Hugo as a static site generator, the Congo theme for design, and AWS S3 + CloudFront for hosting and content delivery.

Tech Stack:

Hugo v0.162.0 (snap) on Ubuntu WSL2
Theme: Congo (Tailwind CSS based)
Hosting: AWS S3 + CloudFront
Domain: ofurotime.ca

Phase 1: Environment Setup #

Installing Hugo #

Ubuntu’s apt package manager ships an outdated version of Hugo. To get the latest version, use snap instead:

AWS VPC Basics

Sat, 06 Jun 2026 00:00:00 +0000

What is a VPC? #

A Virtual Private Cloud (VPC) is a logically isolated network within AWS. It gives you full control over IP ranges, subnets, route tables, and gateways.

Key Components #

Subnets #

Public subnet — has a route to an Internet Gateway; hosts resources accessible from the internet
Private subnet — no direct internet route; hosts databases, backend services

Internet Gateway (IGW) #

Attached to a VPC to allow communication between resources in the VPC and the internet.