Module 27: Capstone Project: Cloudsmiths End-to-End

Capstone · Time: ~1h 15 min · Deliverable-based, no 10-question exam (the final exam follows)

Scenario: final brief

You've onboarded Cloudsmiths' clouds (Modules 11-12), set schedules and integrations (13-17), tuned mute rules (16), configured RBAC (18), brought IaC (19), Attack Paths (20), and Lighthouse + custom compliance (21) into the program, and built an AI-driven detect/remediate/report loop with Claude Code (22-26). Now you have to prove it works end-to-end for the executive team.

You'll deliver four artifacts that together represent a complete cloud security program. Build them from what you already produced during the week (the Module 06 and 13 scans, the Module 16 mute rules, the Module 24 PR, the Module 25 dashboard): the capstone session is for assembling and proving, not for running new scans.

---

Deliverables

1. Cloudsmiths Posture & Compliance Report (capstone/report.md + report.docx) · ~25 min

A 6–10 page report containing:

• Executive summary (≤ 1 page).
• Inventory of providers and what each scans.
• Findings overview by provider and severity.
• Compliance scores for CIS, ISO 27001, PCI-DSS, SOC 2 (and your custom compliance).
• Top 5 Attack Paths with business-language risk statements.
• Mean time to remediate (sample if data is thin).
• Roadmap: 30/60/90 day improvements.

You may use Lighthouse AI to draft sections, but cite every figure with a Prowler MCP tool call.

2. Mute Rules YAML (capstone/mutelist.yaml) · ~15 min

Your Advanced Mutelist, with at least 8 entries, each with owner, rationale, compensating control, and expiration. Use wildcards/tags where appropriate.

3. Remediation PR (capstone/remediation-pr.md describing the change set) · ~25 min

Pick at least 3 distinct findings. For each, propose a fix:

• 1 via AWS CLI snippet (with explanation of blast radius).
• 1 via Terraform/IaC change (paste the diff).
• 1 via tuning a Prowler check (severity override or custom check or custom compliance).

Show the before/after Prowler scan output proving the finding flipped to PASS.

4. Executive dashboard (capstone/dashboard.html or capstone/dashboard.md) · ~10 min

A single-screen artifact that the CISO can open every morning, built per Module 25. Include: critical/high counts, weekly delta, top 3 paths, compliance score gauges, last-scan ages, top muted findings.

---