| --- |
| title: Cloud Security Auditor |
| emoji: 🛡️ |
| colorFrom: blue |
| colorTo: indigo |
| sdk: docker |
| app_port: 7860 |
| pinned: false |
| license: apache-2.0 |
| --- |
| |
| # 🛡️ CloudSecurityAuditor OpenEnv (v0.2.0) |
|
|
| **CloudSecurityAuditor** is a high-fidelity, standardized AI agent environment designed to simulate real-world cloud security audit scenarios. Built upon the **OpenEnv** specification, it provides a safe, reproducible sandbox where autonomous agents can practice identifying, analyzing, and remediating critical security vulnerabilities in a mock cloud infrastructure. |
|
|
| This environment is specifically engineered for benchmarking LLM-based security agents, offering a structured API and deterministic evaluation metrics. |
|
|
| ## 🌟 Key Features |
|
|
| - **Standardized API**: Fully compliant with the `openenv-core` specification, featuring Gymnasium-style `step()`, `reset()`, and `state()` methods. |
| - **Realistic Cloud Mocking**: Simulates S3 bucket configurations, EC2 security groups, and IAM audit logs with high precision. |
| - **Multi-Tiered Evaluation**: |
| - **Easy (Audit)**: Focuses on information gathering and resource tagging. |
| - **Medium (Remediation)**: Requires active patching and configuration changes. |
| - **Hard (Forensics)**: Demands log analysis and pattern matching to identify rogue actors. |
| - **Typed Observations**: Robust Pydantic-based action and observation models ensure reliable agent-environment interactions. |
| - **Automated Grading**: Scalar reward functions (0.0 to 1.0) provide immediate, granular feedback on agent performance. |
|
|
| ## 🛠 Action & Observation Space |
|
|
| ### Actions |
| - `list`: Inventory resources (`s3`, `ec2`). |
| - `describe`: Deep-dive into resource metadata. |
| - `modify`: Apply security patches and rule updates. |
| - `logs`: Extract forensic evidence from authentication logs. |
| - `submit`: Finalize the task with a structured answer. |
|
|
| ### Observations |
| - `resources`: Comprehensive resource records. |
| - `details`: Metadata for specific entities. |
| - `logs`: Event-based log entries. |
| - `status`: Execution status and helper messages. |
|
|
| ## 📊 Available Tasks |
|
|
| | ID | Name | Objective | Difficulty | |
| |:---|:---|:---|:---| |
| | `easy` | **S3 Public Audit** | Identify public 'prod' buckets. | Auditing | |
| | `medium` | **EC2 Security Patch** | Remediate open RDP ports (3389). | Remediation | |
| | `hard` | **IAM Log Forensic** | Trace 'DeleteStorage' actions in logs. | Forensics | |
|
|
| ## 🚀 Quick Start (Hugging Face) |
|
|
| If you are running this in a **Hugging Face Space**: |
|
|
| 1. **Examine the API**: The environment is hosted as a FastAPI server. Use the `/ui` endpoint for a visual dashboard. |
| 2. **Inference (LLM Agent)**: Set `API_BASE_URL` and `API_KEY` (e.g., from LiteLLM proxy) then run `python inference.py`. |
| 3. **Evaluate**: The AI agent creates standardized logs for automated evaluation. |
|
|
| ## 🐳 Local Deployment |
|
|
| ```bash |
| # Clone and Install |
| pip install -r requirements.txt |
| |
| # Run Server (Default port 7860) |
| python -m server.app |
| |
| # Run Baseline (Rule-based) |
| python scripts/baseline_inference.py |
| |
| # Run LLM Agent (Using API_BASE_URL and API_KEY) |
| export API_BASE_URL="https://api.openai.com/v1" |
| export API_KEY="your-key" |
| python inference.py |
| ``` |
|
|
| --- |
| Built with ❤️ for the AI Security community. |
|
|
