cgep-labs
Hands-on labs and reference workspaces for the Certified GRC Engineer Practitioner (CGE-P) by the GRC Engineering Club.
What's here
guides/ Lab guides, one markdown file per lab
reference/ Companion Terraform / Rego / shell workspaces, one per lab
The guides are the lab. The reference workspaces are the same code in deployable form so you can run it and see it work, then build your own version in your capstone repo.
Lab inventory
| # | Lab | Cloud |
|---|---|---|
| 2.3 | First Compliant Resource | AWS |
| 2.4 | Terraform Modules for Compliance | GCP |
| 2.5 | IaC as Compliance Evidence | AWS |
| 3.3 | Writing Compliance Policies in Rego | GCP |
| 3.4 | Integrating PaC with Terraform (Conftest) | AWS |
| 4.3 | Building a GRC Evidence Pipeline | AWS + GitHub Actions |
| 4.4 | Evidence Management & Chain of Custody | AWS |
| 5.2 | AWS Security Services Baseline | AWS |
| 5.4 | GCP Security Services Baseline | GCP |
| 6.1 | Introduction to OSCAL | Cloud-agnostic |
| 7.1 | Capstone Brief | AWS |
The labs alternate between AWS and GCP on purpose. The compliance-by-default pattern is cloud-agnostic; doing it in two providers makes that obvious.
How this connects
- The lab guides live here and are mirrored into the lessons on cert.grcengclub.com.
- The capstone wraps the workload in
GRCEngClub/cgep-app-starter, a deliberately non-compliant Patient-Intake API. Several labs reference it. - Every lab produces an artifact that drops directly into your capstone repo. The capstone is assembly, not from-scratch construction.
Running a reference workspace
Each reference/lab-X-Y/ is a self-contained Terraform / Rego / shell workspace. The published guide tells the full story; this directory is the code.
For Terraform-touching labs:
cd reference/lab-2-3
eval "$(aws configure export-credentials --profile <your-sandbox> --format env)"
terraform init
terraform plan -out=tfplan
terraform apply -auto-approve tfplan
# verify with the commands in the guide
terraform destroy -auto-approveFor Rego-only labs (3.3, 3.4):
cd reference/lab-3-3
opa test -v policies/Always tear down at the end of the session. Reference workspaces are not meant to live deployed.
Required tooling
terraform >= 1.6opa >= 0.60conftest >= 0.50(Lab 3.4 onwards)cosign >= 2.0(Lab 4.4)tfsec(Lab 4.3)compliance-trestlePython package (Lab 6.1)awsCLI v2 with a working SSO or access-key profilegcloudCLI for GCP labs
Contributing
PRs welcome for:
- Cloud version drift (a Terraform argument deprecated, a CLI flag renamed).
- Bugs in reference workspaces.
- Clarity edits to lab guides.
Out of scope: scope expansion, alternate framework framings beyond NIST 800-53 / HIPAA / SOC 2 / CMMC L2.
License
MIT.