wellingtoong/cloud-security-analyzer

By wellingtoong

•Updated 8 months ago

AI-powered security analyzer for Terraform with automated report generation.

Image

Security

Machine learning & AI

Developer tools

961

Overview Tags

wellingtoong/cloud-security-analyzer repository overview

⁠Cloud Security Analyzer

Docker Image Size

⁠🛡️ AI-Powered Terraform Security Analysis

A powerful, containerized tool for analyzing Terraform Plan JSON files to identify security vulnerabilities and generate actionable recommendations. Built for DevSecOps workflows, it leverages Google Gemini AI to provide intelligent insights into cloud infrastructure configurations.

⁠🎯 Why Use Cloud Security Analyzer?

✅ Prevent Breaches Before Deployment — Identify misconfigurations in IaC before they reach production
✅ AI-Enhanced Detection — Goes beyond rule-based checks with contextual AI analysis
✅ Executive-Ready Reports — Beautiful HTML dashboards + structured JSON for automation
✅ CI/CD Native — Seamless GitHub Actions, GitLab CI, Azure DevOps integration
✅ AWS Optimized — Deep AWS security best practices (Azure & GCP roadmap)
✅ No Installation Hassle — Ship securely with Docker — one command to analyze

⁠📊 What It Detects

Exposed databases & unencrypted storage
Overly permissive security groups
IAM misconfigurations
Public S3 bucket exposure
Missing encryption & logging
Networking vulnerabilities
And much more⁠

⁠🚀 Quick Start

⁠Basic Usage

docker run --rm \
  -e GEMINI_API_KEY="your-api-key" \
  -v "$(pwd):/app" \
  wellingtoong/cloud-security-analyzer:latest \
  /path/to/tfplan.json

⁠With Environment Metadata

docker run --rm \
  -e GEMINI_API_KEY="your-api-key" \
  -e BRANCH_NAME="feature/new-vpc" \
  -e ENVIRONMENT="staging" \
  -e RUN_TIMESTAMP="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
  -v "$(pwd):/app" \
  -v "$(pwd)/reports_output:/app/reports_output" \
  wellingtoong/cloud-security-analyzer:latest \
  terraform/plans/tfplan.json

⁠Output Files

The container generates two files in the reports_output/ directory:

terraform_security_report.json — Structured data for CI/CD pipelines & automation
terraform_security_report.html — Interactive Tailwind CSS dashboard for stakeholders

⁠📋 Prerequisites

Google Gemini API Key — Get it here⁠

Terraform Plan JSON — Generate with:

terraform plan -out=tfplan.binary
terraform show -json tfplan.binary > tfplan.json

Docker — v20.10+

⁠🔄 CI/CD Integration

⁠GitHub Actions

- name: Generate Terraform Plan
  run: |
    terraform init
    terraform plan -out=tfplan.binary
    terraform show -json tfplan.binary > plan.json

- name: Run Security Analysis
  env:
    GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
  run: |
    docker run --rm \
      -e GEMINI_API_KEY=$GEMINI_API_KEY \
      -e BRANCH_NAME=${{ github.ref_name }} \
      -e ENVIRONMENT=staging \
      -v "$(pwd):/app" \
      wellingtoong/cloud-security-analyzer:latest \
      plan.json

- name: Upload Report
  uses: actions/upload-artifact@v4
  with:
    name: security-report
    path: reports_output/

⁠GitLab CI

analyze_terraform:
  image: wellingtoong/cloud-security-analyzer:latest
  script:
    - terraform init
    - terraform plan -out=tfplan.binary
    - terraform show -json tfplan.binary > plan.json
    - python src/main.py plan.json
  artifacts:
    paths:
      - reports_output/
    expire_in: 30 days
  environment:
    name: staging

⁠Azure DevOps

- task: Docker@2
  inputs:
    command: run
    arguments: |
      --rm \
      -e GEMINI_API_KEY=$(GEMINI_API_KEY) \
      -e BRANCH_NAME=$(Build.SourceBranchName) \
      -e ENVIRONMENT=staging \
      -v $(System.DefaultWorkingDirectory):/app \
      wellingtoong/cloud-security-analyzer:latest \
      plan.json

⁠📊 Example Report Output

⁠JSON Structure

{
  "metadata": {
    "branch": "feature/new-vpc",
    "timestamp": "2025-02-21T10:30:45Z",
    "terraform_version": "1.6.0",
    "environment": "staging"
  },
  "summary": {
    "total_vulnerabilities": 5,
    "critical": 1,
    "high": 2,
    "medium": 2,
    "low": 0
  },
  "vulnerabilities": [
    {
      "id": "vpc-001",
      "severity": "CRITICAL",
      "title": "S3 Bucket Public Access",
      "description": "...",
      "recommendation": "..."
    }
  ]
}

⁠HTML Dashboard

Executive summary with severity breakdown
Interactive vulnerability cards
Code snippets with remediation steps
AWS documentation references
Metadata tracking (branch, timestamp, environment)

⁠🐳 Image Tags

Tag	Python	Notes
`latest`	3.12	Recommended for production
`1.0.1`	3.12	Latest stable release
`1.0.0`	3.12	Development build

Image Size: ~200MB (slim)

⁠🛠️ Environment Variables

Variable	Required	Default	Description
`GEMINI_API_KEY`	✅ Yes	—	Google Gemini API key
`GEMINI_MODEL`	❌ No	`gemini-2.0-flash`	AI model to use
`BRANCH_NAME`	❌ No	`main`	Git branch for metadata
`ENVIRONMENT`	❌ No	`unknown`	Deployment environment
`RUN_TIMESTAMP`	❌ No	Current UTC	Execution timestamp (ISO 8601)

⁠📚 Full Documentation

For comprehensive documentation, usage examples, and architecture details, visit the GitHub Repository⁠.

⁠🤝 Support & Contributing

Issues: GitHub Issues⁠
Discussions: GitHub Discussions⁠
Contributing: See CONTRIBUTING.md⁠

⁠📄 License

MIT License — See LICENSE⁠

Made with ❤️ for DevSecOps engineers | Star us on GitHub⁠

Tag summary

Recent tags

Content type

Image

Digest

sha256:c55790c3a…

Size

180.4 MB

Last updated

8 months ago

docker pull wellingtoong/cloud-security-analyzer