CGE-P Curriculum

The labs build on each other, so they live in one repo. Infrastructure first, then the evidence that it was compliant, then the policies that refuse it when it is not.

The course is done. Setup and the full layout are in the repository README. Each lab also has a card under Labs. The CGE-P Capstone is where I applied this to a running system.

What is built

Lab	What it adds
2.3	An S3 primitive that is compliant in the same apply that creates it - encryption, versioning, a full public access block, and access logging to a dedicated log bucket.
2.4	The same idea as a reusable GCP module: CMEK on a rotating KMS key, uniform bucket-level access, public access prevention, and a retention floor that fails the plan below 365 days in production.
2.5	A write-once evidence vault on S3 Object Lock, plus a capture script that snapshots the plan, state, commit, and tool versions, hashes each with SHA-256, and returns a signed receipt.
3.3	Three NIST 800-53 controls as OPA policies that read a Terraform plan and deny it before apply, each carrying machine-readable METADATA and its own unit tests.
3.4	AWS variants of those policies, organized by control rather than by cloud, behind a Conftest gate that writes its results as evidence and exits non-zero on a violation.
4.3	The gate wired into GitHub Actions on every pull request - Terraform plan, Conftest, and a Trivy config scan - running on short-lived OIDC credentials instead of static AWS keys.
4.4	Cosign keyless signing of the evidence bundle, plus a verification script, closing the chain of custody from plan to signed evidence.
5.2	An always-on AWS baseline: multi-region CloudTrail with log-file validation, and Security Hub subscribed to the NIST 800-53 and AWS FSBP standards for continuous findings.

I wanted controls that run on their own and leave a record, instead of ones somebody has to remember to check.

Where it goes next

The labs stop at a reusable stack. The CGE-P Capstone takes that stack and wraps Acme Health’s Patient Intake API.