Free AWS lab with LocalStack

# Three pip packages, one command. What each one gives you:
#   localstack       - the CLI that starts and stops the mock-cloud container
#   awscli-local     - installs `awslocal`, an `aws` wrapper pre-pointed at LocalStack
#   terraform-local  - installs `tflocal`, the same idea for Terraform
python3 -m pip install --user localstack awscli-local terraform-local   # --user = no sudo; installs into your home dir

# Confirm both tools are on your PATH before continuing
localstack --version    # prints the CLI version; the Docker image itself is pulled later, on first start
awslocal --version      # prints the underlying aws-cli version that awslocal wraps

localstack start -d          # start the mock cloud; -d = detached, so it runs in the background and frees your shell
localstack status services   # print a table of every emulated service (s3, iam, lambda, ...) and whether each is 'available'

# LocalStack never checks credentials, but the AWS CLI refuses to run without *some* value set.
# These three exports satisfy that requirement; the literal string "test" is the community convention.
export AWS_ACCESS_KEY_ID=test          # any non-empty value works
export AWS_SECRET_ACCESS_KEY=test      # never a real secret - this is a throwaway mock
export AWS_DEFAULT_REGION=us-east-1    # a region still has to be set; the CLI builds its endpoints from it

# Your first API call. Real AWS returns your 12-digit account id here; LocalStack
# always returns the canned 000000000000 - that is your proof you are hitting the mock.
awslocal sts get-caller-identity

awslocal s3 mb s3://lab-bucket               # mb = "make bucket"
echo "top secret" > secret.txt               # create a throwaway local file to upload
awslocal s3 cp secret.txt s3://lab-bucket/   # cp = copy the local file up into the bucket
awslocal s3 ls s3://lab-bucket/              # ls = list the bucket's contents; you should see secret.txt

mkdir -p ~/localstack-lab && cd ~/localstack-lab   # -p = no error if it exists; && = only cd in if mkdir succeeded

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"   # pull the official AWS provider from the Terraform registry
      version = "~> 5.0"          # any 5.x release, never 6.0 - pins the API surface so upgrades don't surprise you
    }
  }
}

provider "aws" {
  region     = "us-east-1"
  access_key = "test"             # dummy creds again - LocalStack ignores them, but the provider wants values
  secret_key = "test"
  # The three "skip" flags below turn off the provider's start-up calls to the *real*
  # AWS STS and metadata endpoints. Without them, Terraform tries to reach AWS to
  # validate the fake credentials and hangs. They also make this file safe if you ever
  # run plain `terraform` out of habit instead of `tflocal`.
  skip_credentials_validation = true   # don't verify the access key against real STS
  skip_metadata_api_check     = true   # don't probe the EC2 instance-metadata endpoint
  skip_requesting_account_id  = true   # don't call sts:GetCallerIdentity to learn the account id
}

tflocal init    # download the AWS provider plugin into .terraform/ (run once per project, or after changing versions)
tflocal plan    # dry run: print exactly what Terraform *would* create, without touching anything yet

# 1) A bucket that is public to the world - the classic data-leak setup.
resource "aws_s3_bucket" "public_data" {
  bucket = "customer-exports-lab"        # the bucket's globally-unique name
}

# By default AWS blocks all public access. Flipping every guard to false is what
# actually *lets* the public bucket policy below take effect - this block is the
# real misconfiguration, not the policy on its own.
resource "aws_s3_bucket_public_access_block" "public_data" {
  bucket                  = aws_s3_bucket.public_data.id   # reference the bucket declared above
  block_public_acls       = false   # allow public ACLs to be set
  block_public_policy     = false   # allow a public bucket *policy* (the one defined next)
  ignore_public_acls      = false   # honor public ACLs instead of silently ignoring them
  restrict_public_buckets = false   # don't restrict anonymous / cross-account access
}

# The bucket policy that grants the entire internet read access to every object.
resource "aws_s3_bucket_policy" "public_data" {
  bucket = aws_s3_bucket.public_data.id
  policy = jsonencode({                 # jsonencode turns this HCL map into the JSON AWS expects
    Version = "2012-10-17",
    Statement = [{
      Sid       = "PublicRead",
      Effect    = "Allow",
      Principal = "*",                  # "*" = anyone, no credentials required  <- the dangerous part
      Action    = "s3:GetObject",       # the one action allowed: download (GET) an object
      Resource  = "${aws_s3_bucket.public_data.arn}/*"   # /* = every object in the bucket
    }]
  })
}

# 2) An IAM user with an inline admin policy and a long-lived access key.
resource "aws_iam_user" "app" {
  name = "legacy-app-user"
}

resource "aws_iam_user_policy" "app_admin" {
  name   = "app-admin"
  user   = aws_iam_user.app.name        # attach this inline policy directly to the user above
  policy = jsonencode({
    Version   = "2012-10-17",
    # Action "*" on Resource "*" = permission to do anything to everything: full admin.
    Statement = [{ Effect = "Allow", Action = "*", Resource = "*" }]
  })
}

# A static access key for that user. Real keys like this, committed to a git repo,
# are the single most common root cause of cloud breaches.
resource "aws_iam_access_key" "app" {
  user = aws_iam_user.app.name
}

tflocal apply -auto-approve   # actually create the resources; -auto-approve skips the interactive "yes" prompt

# Stage a fake "loot" file in the public bucket...
echo "aws_secret_access_key=AKIAFAKE..." > creds.txt      # a decoy secret, not a real key
awslocal s3 cp creds.txt s3://customer-exports-lab/
# ...then fetch it over plain HTTP with NO credentials. The request succeeding is the whole point:
# a public bucket policy means the object is reachable by anyone on the internet.
curl http://localhost:4566/customer-exports-lab/creds.txt

# Now walk the IAM enumeration an attacker runs right after finding the leaked key:
awslocal iam list-users                                             # who exists in this account?
awslocal iam list-access-keys --user-name legacy-app-user          # what keys does this user have?
awslocal iam list-user-policies --user-name legacy-app-user        # what inline policies are attached to it?
awslocal iam get-user-policy --user-name legacy-app-user --policy-name app-admin   # read the policy - it's full admin

# Checkov - a policy-as-code scanner that reads Terraform statically (no deploy, no cloud, no cost)
python3 -m pip install --user checkov
checkov -d .        # -d = scan every .tf file in this directory; prints a PASS/FAIL line per check

# Trivy in config mode does the same job and also covers Dockerfiles, Kubernetes manifests, and more
#   install it first: brew install trivy   (or see aquasecurity.github.io/trivy)
trivy config .      # scan the current directory's infrastructure-as-code for the same misconfigurations

tflocal destroy -auto-approve   # delete everything Terraform created; -auto-approve skips the confirmation prompt
localstack stop                 # stop the container - community-edition state lives in RAM, so this wipes it clean