README.md

metadata

title: Secure IaC
emoji: 🚀
colorFrom: yellow
colorTo: blue
sdk: docker
app_port: 8501
tags:
  - streamlit
pinned: false
short_description: Security analysis tool for Infrastructure as Code (IaC)
license: mit

IaC_code_generator

A comprehensive security analysis tool for Infrastructure as Code (IaC) files. This application analyzes Terraform, CloudFormation, and Kubernetes configurations to identify security vulnerabilities and provides AI-powered remediation suggestions.

🛡️ Features

• Multi-Platform Support: Analyze Terraform, AWS CloudFormation, and Kubernetes configurations
• Comprehensive Security Rules: Built-in security rules covering critical vulnerabilities
• AI-Powered Remediation: Get automated code fixes using Google Gemini AI
• Interactive Visualizations: Security metrics and vulnerability distribution charts
• Multiple Export Formats: JSON, CSV, and Markdown reports
• Real-time Analysis: Upload files or paste code for immediate analysis

🚀 Getting Started

Prerequisites

• Python 3.8 or higher
• Google Gemini API key (for AI remediation features)

Installation

1. Clone the repository:

git git clone https://huggingface.co/spaces/Waseem-k/SecureIaC
cd SecureIaC

2. Install dependencies:

pip install -r requirements.txt

3. Configure API keys:
   • Copy app_config.properties.example to app_config.properties
   • Add your Google Gemini API key:

GEMINI_API_KEY=your_api_key_here

Running the Application

streamlit run main.py

The application will be available at http://localhost:8501

📁 Project Structure

iac-security-analyzer/
├── main.py                    # Main application entry point
├── src/
│   ├── __init__.py
│   ├── analyzer.py            # Core security analyzer
│   ├── models.py              # Data models
│   ├── security_rules.py      # Security rules configuration
│   ├── visualization.py       # Chart generation
│   ├── report_generator.py    # Report generation
│   ├── ai_remediation.py      # AI-powered fixes
│   └── config.py              # Configuration management
├── requirements.txt           # Python dependencies
├── app_config.properties      # Configuration file
└── README.md                  # This file

🔍 Supported Platforms

Terraform

• Public S3 bucket configurations
• Unencrypted EBS volumes
• Open security groups
• Unencrypted RDS instances
• IAM policies with wildcard actions

AWS CloudFormation

• Public S3 bucket access
• Open security groups
• Missing encryption configurations

Kubernetes

• Containers running as root
• Privileged containers
• Missing resource limits
• Security context issues

📊 Security Analysis

The tool analyzes your IaC files and categorizes findings by:

• Severity: Critical, High, Medium, Low
• Category: Data Protection, Network Security, Container Security, etc.
• CVSS Score: Common Vulnerability Scoring System ratings
• CWE Classification: Common Weakness Enumeration mapping

🤖 AI-Powered Remediation

Using Google Gemini AI, the tool can:

• Generate secure code fixes
• Explain security improvements
• Maintain code functionality while improving security posture
• Provide detailed remediation guidance

📈 Visualizations

• Severity Distribution: Pie chart showing vulnerability breakdown
• Category Analysis: Bar chart of security categories
• CVSS Score Distribution: Histogram of vulnerability scores
• Timeline View: Vulnerabilities by code location

📤 Export Options

• JSON Report: Comprehensive machine-readable format
• CSV Export: Spreadsheet-compatible vulnerability data
• Markdown Report: Human-readable security analysis
• Remediation Checklist: Actionable task list

🛠️ Configuration

Configure the application using app_config.properties:

# API Keys
GEMINI_API_KEY=your_gemini_api_key_here

# Application Settings
MAX_FILE_SIZE_MB=10
ENABLE_ADVANCED_RULES=false
DEFAULT_IAC_TYPE=terraform

🔧 Development

Adding New Security Rules

1. Define rules in src/security_rules.py
2. Implement analysis logic in src/analyzer.py
3. Add tests for new functionality

Extending Platform Support

1. Add platform rules to security_rules.py
2. Update file type detection in main.py
3. Add platform-specific analysis methods

🚨 Security Rules Reference

Terraform Rules

• TF001: Public S3 Bucket
• TF002: Unencrypted EBS Volume
• TF003: Open Security Group
• TF004: Unencrypted RDS Instance
• TF005: IAM Policy with Wildcards

CloudFormation Rules

• CF001: Public S3 Bucket Access
• CF002: Open Security Group

Kubernetes Rules

• K8S001: Container Running as Root
• K8S002: Privileged Container
• K8S003: Missing Resource Limits

📝 License

This project is licensed under the MIT License - see the LICENSE file for details.

🙏 Acknowledgments

• Built with Streamlit
• Powered by Google Gemini AI
• Visualizations by Plotly