🛡️ Automated Cloud Infrastructure Security Remediation using GenAI

📖 Project Overview

This project demonstrates a Zero-Touch DevSecOps Pipeline that automatically detects security vulnerabilities in Infrastructure-as-Code (Terraform) and remediates them using Generative AI (Google Gemini).

The pipeline deploys a Python Flask application on AWS EC2, ensuring that the infrastructure adheres to strict security standards (CIS Benchmarks) by fixing open firewalls, unencrypted volumes, and insecure metadata services before deployment.

🏗️ Architecture

The architecture follows a "Secure-by-Design" approach:

1. Developer pushes code to GitHub.
2. Jenkins triggers a CI/CD pipeline running inside a Docker container.
3. Trivy scans the Terraform code for vulnerabilities (Compliance Check).
4. AI Agent (Gemini) analyzes the security report and rewrites the Terraform code to fix issues automatically.
5. Terraform provisions the secure infrastructure on AWS.
6. User Data Script bootstraps the Flask application from the DevSecops-Ai/app directory.

☁️ Cloud Provider & Tools

• Cloud Provider: AWS (Region: ap-south-1)
• Infrastructure as Code: Terraform
• CI/CD Orchestrator: Jenkins (Dockerized)
• Security Scanner: Trivy (Aqua Security)
• AI/LLM: Google Gemini 2.5 Flash (via API)
• Application: Python Flask
• OS/Environment: Amazon Linux 2023

---

📊 Before & After Security Report

❌ Initial State (Vulnerable)

The initial deployment contained critical security flaws:

• SSH (Port 22) and App (Port 5000) were open to the entire internet (0.0.0.0/0).
• EBS Volumes were unencrypted.
• IMDSv1 was enabled (vulnerable to SSRF attacks).

(Screenshot: Jenkins Build #36 showing Trivy failure)

✅ Final State (Secured)

After the AI remediation process, the infrastructure was hardened:

• Firewall: Ingress restricted to specific IPv4 (Developer) and IPv6 (Mobile Hotspot) addresses using Dual-Stack rules.
• Encryption: Root volume encryption enabled (encrypted = true).
• Identity: IMDSv2 enforced (http_tokens = "required").

(Screenshot: Jenkins Build #37 showing passed scan and successful deployment)

---

🤖 GenAI Usage Log (Mandatory)

This project utilized Google Gemini to interpret security findings and generate compliant HCL code.

1. The Exact AI Prompt Used

To handle edge cases like Dual-Stack Networking (IPv4/IPv6) and Subfolder Deployment, the following engineered prompt was used:

Analyze this Trivy Security Report for Terraform: {trivy_report}.
CURRENT TERRAFORM CODE: {tf_code}

INSTRUCTIONS & REQUIREMENTS:
1. You are a DevSecOps Engineer. Provide the FULL corrected HCL code.
2. ENFORCE SECURITY PRINCIPLES:
   - Restrict Ingress ports (22, 5000) using TWO separate parameters:
     a) Use "cidr_blocks" for IPv4: ["REPLACE_WITH_YOUR_IP/32", "13.233.177.0/29"].
     b) Use "ipv6_cidr_blocks" for IPv6: ["REPLACE_WITH_YOUR_IPV6/128"].
   - CRITICAL: Never put an IPv6 address inside the "cidr_blocks" list.
   - Maintain 'encrypted = true' for all root_block_device volumes.
   - Maintain 'http_tokens = required' in metadata_options for IMDSv2.
3. PRESERVE AUTOMATION:
   - Keep the 'user_data' block exactly as it is in the CURRENT code.
4. EGRESS EXCEPTION:
   - Keep "0.0.0.0/0" egress for dependency installation (documented via .trivyignore).

OUTPUT:
- RETURN ONLY THE RAW HCL CODE. 
- DO NOT use markdown backticks or conversational text.

2. Summary of Identified Risks

Severity	Vulnerability ID	Description
CRITICAL	AVD-AWS-0107	Security Group allows ingress from 0.0.0.0/0 to Port 22 (SSH).
HIGH	AVD-AWS-0028	EC2 Root Volume is not encrypted (Data-at-Rest risk).
MEDIUM	AVD-AWS-0129	IMDSv2 is not enforced (Session tokens optional).

3. How AI Recommendations Improved Security

• Dual-Stack Ingress Policy: The AI correctly split the ingress rules into cidr_blocks (IPv4) and ipv6_cidr_blocks (IPv6), resolving a Terraform syntax error that occurred when mixing protocols.
• Zero-Trust Networking: It replaced the wildcard 0.0.0.0/0 with specific developer IPs, reducing the attack surface by 100%.
• Automated Hardening: It enabled AES-256 encryption on disk volumes without requiring manual configuration changes.

---

🚀 Deployment Verification

The application was successfully deployed to the public cloud.

Public Endpoint: http://13.203.220.237:5000 (Note: IP is dynamic and changes on new builds)

---

📂 Repository Structure

• /app: Contains the Python Flask source code (app.py, requirements.txt).
• /terraform: Contains the finalized, secure main.tf files.
• Jenkinsfile: The declarative pipeline script defining the CI/CD stages.
• remediate.py: Python script that bridges Trivy results with the Gemini API.
• .trivyignore: Configuration file to whitelist acceptable risks (e.g., Egress traffic).

---

🎥 Video Demonstration

A 5-minute screen recording demonstrating the full pipeline execution, vulnerability scanning, AI remediation, and final access verification.

▶️ Watch the Project Demo Here

Author: Parth Shethia Semester End Project: DevSecOps & Cloud Security