You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A powerful, AI-driven tool for analyzing Terraform Plan JSON files to identify security vulnerabilities and generate actionable recommendations. Built for DevSecOps workflows, it leverages Google Gemini AI to provide intelligent insights into cloud infrastructure configurations, ensuring compliance with best practices like CIS Benchmarks.
29
28
@@ -46,44 +45,33 @@ This tool is particularly valuable for teams deploying to AWS (with roadmap supp
46
45
47
46
## 🎯 Why Cloud Security Analyzer?
48
47
49
-
-🛡️ Prevent security misconfigurations before deployment
50
-
-🤖 AI-enhanced contextual risk detection
51
-
-📊 Executive-ready HTML and JSON reports
52
-
-🔄 CI/CD native integration
53
-
-☁️ Built for AWS (Azure & GCP roadmap)
54
-
-🧱 Designed for scalable DevSecOps environments
48
+
- Prevent security misconfigurations before deployment
49
+
- AI-enhanced contextual risk detection
50
+
- Executive-ready HTML and JSON reports
51
+
- CI/CD native integration
52
+
- Built for AWS (Azure & GCP roadmap)
53
+
- Designed for scalable DevSecOps environments
55
54
56
55
57
-
## 📘 Overview
58
-
59
-
Infrastructure as Code (IaC) tools like Terraform enable rapid deployment of cloud resources, but misconfigurations can introduce critical security risks. Cloud Security Analyzer addresses this by:
60
-
61
-
- 🔍 **Static Analysis**: Scanning Terraform plans for vulnerabilities without executing changes.
62
-
- 🤖 **AI-Powered Insights**: Using advanced AI to detect nuanced issues beyond rule-based checks.
63
-
- 📊 **Comprehensive Reporting**: Generating structured JSON outputs and visually appealing HTML reports with severity scores, risk assessments, and remediation steps.
64
-
- 🔄 **CI/CD Integration**: Seamlessly integrating into pipelines for automated security reviews.
65
-
66
-
This tool is particularly valuable for teams deploying to AWS (with roadmap support for Azure and GCP), helping prevent breaches from exposed databases, overly permissive security groups, unencrypted storage, and more.
67
-
68
56
## ⚙️ How It Works
69
57
70
-
1.📥 **Input**: Provide a Terraform Plan JSON file (generated via `terraform plan -out=tfplan.binary && terraform show -json tfplan.binary > plan.json`).
71
-
2.🧠 **Analysis**: The tool sends the plan to Google Gemini AI, guided by a specialized prompt template, to identify vulnerabilities, assign severities (CRITICAL, HIGH, MEDIUM, LOW), and suggest fixes.
72
-
3.📤 **Output**:
73
-
-🧾 **JSON Report**: Structured data for programmatic consumption or further processing.
74
-
-🖥️ **HTML Report**: Interactive, Tailwind CSS-styled dashboard with executive summaries, vulnerability cards, code recommendations, and references to AWS documentation.
75
-
4.🏷️ **Metadata Enrichment**: Automatically captures execution context like branch, timestamp, Terraform version, and environment for traceability.
58
+
1.**Input**: Provide a Terraform Plan JSON file (generated via `terraform plan -out=tfplan.binary && terraform show -json tfplan.binary > plan.json`).
59
+
2.**Analysis**: The tool sends the plan to Google Gemini AI, guided by a specialized prompt template, to identify vulnerabilities, assign severities (CRITICAL, HIGH, MEDIUM, LOW), and suggest fixes.
60
+
3.**Output**:
61
+
-**JSON Report**: Structured data for programmatic consumption or further processing.
62
+
-**HTML Report**: Interactive, Tailwind CSS-styled dashboard with executive summaries, vulnerability cards, code recommendations, and references to AWS documentation.
63
+
4.**Metadata Enrichment**: Automatically captures execution context like branch, timestamp, Terraform version, and environment for traceability.
76
64
77
65
The process is fast, typically completing in seconds, and supports both local execution and containerized runs.
78
66
79
67
## 🏗️ Architecture
80
68
81
69
The project follows a modular Python architecture for maintainability and extensibility:
82
70
83
-
-🧠 **`core/`**: Core logic, including the `TerraformAnalyzer` class that interfaces with Google Gemini AI for analysis.
84
-
-📂 **`data/`**: Data handling modules for loading Terraform plans and prompts.
85
-
-📝 **`reports/`**: Report generation, featuring Jinja2 templates for HTML rendering and utility functions for severity classification and formatting.
86
-
-🖥️ **`cli/`**: Command-line interface for user interaction, path resolution, and orchestration.
71
+
-**`core/`**: Core logic, including the `TerraformAnalyzer` class that interfaces with Google Gemini AI for analysis.
72
+
-**`data/`**: Data handling modules for loading Terraform plans and prompts.
73
+
-**`reports/`**: Report generation, featuring Jinja2 templates for HTML rendering and utility functions for severity classification and formatting.
74
+
-**`cli/`**: Command-line interface for user interaction, path resolution, and orchestration.
87
75
88
76
Key dependencies include `google-generativeai` for AI integration, `jinja2` for templating, and standard libraries for JSON handling. The design emphasizes separation of concerns, making it easy to extend for multi-cloud support or alternative AI models.
0 commit comments