Skip to content

Commit 3e563e2

Browse files
AAH20AAH20
committed
Build multi-cloud infrastructure control loop
0 parents  commit 3e563e2

43 files changed

Lines changed: 1134 additions & 0 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/ci.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
name: ci
2+
on: [push, pull_request]
3+
permissions:
4+
contents: read
5+
jobs:
6+
test:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- uses: actions/checkout@v4
10+
- uses: actions/setup-python@v5
11+
with:
12+
python-version: "3.12"
13+
- run: python -m pip install -e .
14+
- run: bash scripts/validate.sh

‎.gitignore‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
.venv/
2+
__pycache__/
3+
*.pyc
4+
.pytest_cache/
5+
dist/
6+
build/
7+
*.egg-info/
8+
generated/
9+
.env

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2026 Ahmed Hassan
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# Multi-Cloud Infrastructure Control Loop
2+
3+
A deterministic remediation compiler for Azure, AWS, Google Cloud, Kubernetes and Infrastructure as Code. It transforms normalized findings into cost-aware, blast-radius-scored, review-gated change proposals—and verifies whether the deployed state actually satisfied the intended control.
4+
5+
> The product is not “AI fixes cloud security.” It is an auditable decision envelope that tells an engineer what change is proposed, what it may cost, what it may break, what must be tested, and what evidence will prove the outcome.
6+
7+
## Five executable workflows
8+
9+
| Workflow | Proposed change | Required proof |
10+
|---|---|---|
11+
| Azure Storage public access | Private access and Private DNS design | Approved connectivity tests and post-change policy result |
12+
| AWS S3 public exposure | Account/bucket public-access controls | Intended-public-content review and Security Hub recollection |
13+
| GCP public bucket | Public Access Prevention and IAM review | Consumer-path validation and SCC recollection |
14+
| Kubernetes privileged workload | Security context and admission policy | Workload tests and admission/runtime evidence |
15+
| Cloud logging disabled | Provider-native log pipeline | Ingestion test, retention check and measured cost |
16+
17+
```mermaid
18+
flowchart LR
19+
A[Azure / AWS / GCP bridges] --> U[Unified observation contract]
20+
B[Kubernetes / Checkov / OPA] --> U
21+
U --> M[Rule and context match]
22+
M --> R[Blast-radius model]
23+
M --> C[Cost assumptions]
24+
R --> P[Review-gated change proposal]
25+
C --> P
26+
P --> T[Test and rollout plan]
27+
T --> H[Human approval]
28+
H --> D[External deployment pipeline]
29+
D --> V[Post-change observation]
30+
V --> E[Verification receipt]
31+
E --> O[CISO Assistant / OSCAL / SARIF]
32+
```
33+
34+
## Run locally
35+
36+
Python 3.11+ with no runtime dependencies:
37+
38+
```bash
39+
python3 -m venv .venv
40+
source .venv/bin/activate
41+
python -m pip install -e .
42+
43+
control-loop compile \
44+
--input examples/azure-storage-public.json \
45+
--rules config/rules.json \
46+
--output generated/azure-storage-public
47+
48+
control-loop verify \
49+
--proposal generated/azure-storage-public/proposal.json \
50+
--post-change examples/azure-storage-remediated.json \
51+
--output generated/azure-storage-public/verification.json
52+
```
53+
54+
Run all workflows and tests:
55+
56+
```bash
57+
bash scripts/validate.sh
58+
```
59+
60+
## Outputs
61+
62+
Each compilation produces:
63+
64+
- `proposal.json` — machine-readable decision envelope
65+
- `proposal.md` — architecture-review summary
66+
- `remediation/README.md` — provider-specific implementation scaffold
67+
- `verification-contract.json` — exact expected post-change invariant
68+
69+
The compiler never applies infrastructure changes, opens pull requests, or calls cloud APIs. Those integrations are explicit roadmap items and must preserve the same approval boundary.
70+
71+
Checked-in [`evidence/reference`](evidence/reference) artifacts are generated from synthetic fixtures. They prove deterministic behavior, not production deployment or financial results.
72+
73+
## Transparent economics
74+
75+
Cost outputs are scenarios derived from version-controlled assumptions, not cloud quotes. Every proposal includes low, expected and high monthly deltas; engineering effort assumptions; confidence; and conditions requiring live pricing validation. See [unit economics](docs/UNIT-ECONOMICS.md).
76+
77+
## Ecosystem
78+
79+
The input contract is compatible with normalized observations emitted by:
80+
81+
- [CISO Assistant Azure Compliance Automation](https://github.com/AAH20/ciso-assistant-azure-compliance-automation)
82+
- [CISO Assistant AWS Compliance Automation](https://github.com/AAH20/ciso-assistant-aws-compliance-automation)
83+
- [CISO Assistant GCP Compliance Automation](https://github.com/AAH20/ciso-assistant-gcp-compliance-automation)
84+
85+
See [architecture](docs/ARCHITECTURE.md), [safety model](SECURITY.md), and [production roadmap](docs/PRODUCTION-ROADMAP.md).
86+
87+
Need the control loop adapted to a landing zone, platform engineering workflow, regulated workload or managed CloudOps service? [Request an A2Z SOC architecture engagement](https://a2zsoc.com/contact?topic=multicloud-infrastructure-control-loop&utm_source=github&utm_medium=repository).

‎SECURITY.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Security Policy
2+
3+
The compiler is offline and performs no cloud or repository mutation. Do not submit credentials, Terraform state, secret values, personal data or unredacted topology exports in issues.
4+
5+
Generated proposals are advisory. Engineers must validate identities, networking, data paths, availability requirements, costs and rollback before using an external deployment pipeline.
6+
7+
Report vulnerabilities privately through the repository owner's GitHub security advisory channel.

‎config/rules.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.0",
3+
"rules": [
4+
{
5+
"id": "azure-storage-public-access",
6+
"provider": "azure",
7+
"control_ref": "azure.storage.public_access",
8+
"title": "Move Azure Storage to an approved private-access path",
9+
"iac_targets": ["terraform", "opentofu", "bicep"],
10+
"monthly_cost_usd": {"low": 7.3, "expected": 18.0, "high": 73.0},
11+
"base_risk": 4,
12+
"change": "Add a Private Endpoint and private DNS association, then disable public network access after consumer-path validation.",
13+
"tests": ["Resolve the storage FQDN from every approved network", "Test application read/write paths", "Confirm public path denial", "Recollect Azure Policy state"]
14+
},
15+
{
16+
"id": "aws-s3-public-access",
17+
"provider": "aws",
18+
"control_ref": "aws.s3.public_access",
19+
"title": "Restrict unintended S3 public access",
20+
"iac_targets": ["terraform", "opentofu", "cloudformation"],
21+
"monthly_cost_usd": {"low": 0.0, "expected": 0.0, "high": 5.0},
22+
"base_risk": 3,
23+
"change": "Enable account/bucket public-access controls only after identifying intended public distribution and replacing it with an approved delivery path where required.",
24+
"tests": ["Inventory bucket policies and ACLs", "Validate CDN/application consumers", "Confirm intended principals retain access", "Recollect Security Hub state"]
25+
},
26+
{
27+
"id": "gcp-storage-public-access",
28+
"provider": "gcp",
29+
"control_ref": "gcp.storage.public_access_prevention",
30+
"title": "Enforce approved Cloud Storage access",
31+
"iac_targets": ["terraform", "opentofu", "config-connector"],
32+
"monthly_cost_usd": {"low": 0.0, "expected": 0.0, "high": 5.0},
33+
"base_risk": 3,
34+
"change": "Enable Public Access Prevention and remove broad IAM members after validating intended public delivery and service identities.",
35+
"tests": ["Inventory allUsers and allAuthenticatedUsers bindings", "Validate application identities", "Confirm intended public delivery replacement", "Recollect SCC state"]
36+
},
37+
{
38+
"id": "kubernetes-privileged-workload",
39+
"provider": "kubernetes",
40+
"control_ref": "kubernetes.workload.privileged",
41+
"title": "Remove unnecessary privileged execution",
42+
"iac_targets": ["kubernetes", "helm", "kustomize", "opa"],
43+
"monthly_cost_usd": {"low": 0.0, "expected": 0.0, "high": 20.0},
44+
"base_risk": 5,
45+
"change": "Set a least-privilege security context and admission policy while preserving explicitly justified system workloads.",
46+
"tests": ["Run workload functional and startup tests", "Validate required device and filesystem access", "Exercise admission policy in audit mode", "Collect runtime and admission evidence"]
47+
},
48+
{
49+
"id": "cloud-logging-disabled",
50+
"provider": "multicloud",
51+
"control_ref": "cloud.logging.enabled",
52+
"title": "Enable a bounded provider-native audit-log pipeline",
53+
"iac_targets": ["terraform", "opentofu", "bicep", "cloudformation"],
54+
"monthly_cost_usd": {"low": 5.0, "expected": 45.0, "high": 500.0},
55+
"base_risk": 2,
56+
"change": "Enable required management and data-plane logs with explicit scope, filters, retention, routing and cost alerts.",
57+
"tests": ["Generate and locate a canary event", "Verify retention and encryption", "Test alert routing", "Measure seven-day ingestion before approving the forecast"]
58+
}
59+
]
60+
}

‎docs/ARCHITECTURE.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Architecture
2+
3+
The project is an orchestration and decision layer, not a scanner or deployment engine. Provider bridges and policy tools observe state. This compiler consumes normalized findings and produces a bounded change proposal. Existing CI/CD systems remain responsible for plans, approvals, deployment and rollback.
4+
5+
## Invariants
6+
7+
- No cloud credentials are required or accepted by the compiler.
8+
- A proposal cannot be generated from a satisfied or unknown finding.
9+
- Exactly one version-controlled rule must match.
10+
- Every proposal is unapproved and mutation-disabled.
11+
- High-blast-radius proposals require at least two reviewers.
12+
- Verification requires the same provider, control and scope, a newer observation, satisfied status and a post-change digest.
13+
- Cost data always carries its model, confidence and live-validation requirements.
14+
15+
## Extension model
16+
17+
Provider collectors normalize evidence upstream. Rules supply architecture intent, IaC targets, bounded cost assumptions and tests. Export adapters can translate the proposal and verification receipt to CISO Assistant, OSCAL, SARIF, Jira, ServiceNow or Backstage without changing the core decision model.

‎docs/PRODUCTION-ROADMAP.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Production Roadmap
2+
3+
## Implemented
4+
5+
- Five provider and platform workflows
6+
- Deterministic rule selection
7+
- Transparent blast-radius and cost scenarios
8+
- Review-gated proposal bundles
9+
- Post-change verification receipts
10+
- Offline tests and synthetic reference artifacts
11+
12+
## Next
13+
14+
1. Publish a JSON Schema and compatibility test kit for bridge inputs.
15+
2. Add adapters consuming the three published CISO Assistant cloud bridges.
16+
3. Add Terraform/OpenTofu plan parsing and Infracost validation.
17+
4. Add Kubernetes server-side dry-run and OPA policy simulation.
18+
5. Add provider pricing adapters with timestamped source receipts.
19+
6. Add GitHub App installation and draft-PR generation behind explicit authorization.
20+
7. Export proposals and receipts to OSCAL, SARIF and CISO Assistant.
21+
8. Add Backstage templates, OpenTelemetry and SLO dashboards.
22+
9. Run controlled live-cloud labs and publish independently reproducible measurements.
23+
24+
Production readiness requires authenticated integration tests, threat modeling, tenant isolation, rollback exercises, versioned schemas and supported-provider matrices.

‎docs/UNIT-ECONOMICS.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Unit Economics
2+
3+
Version 0.1.0 calculates only incremental cloud-cost scenarios. It makes no ROI claim.
4+
5+
Each rule stores low, expected and high monthly assumptions. Logging estimates scale with the supplied monthly-event volume; other fixtures use fixed illustrative deltas. Results are deliberately marked low-confidence until validated against:
6+
7+
- provider pricing APIs or calculators;
8+
- deployment region and service tier;
9+
- measured request, traffic, storage and ingestion volumes;
10+
- discounts, reservations and contractual commitments;
11+
- operational labor, migration and rollback costs.
12+
13+
A production business case should separately record incident-loss assumptions, engineering hours, audit effort, change failure rate and opportunity cost. Savings must be reported as measured, modeled or hypothetical—not blended together.

‎evidence/reference/aws-s3-public/proposal.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"approval": {
3+
"minimum_reviewers": 1,
4+
"required": true,
5+
"state": "unapproved"
6+
},
7+
"blast_radius": {
8+
"dependency_count": 1,
9+
"factors": {
10+
"base": 3,
11+
"data_path": 2,
12+
"dependencies": 0,
13+
"shared_scope": 0
14+
},
15+
"level": "medium",
16+
"score": 5
17+
},
18+
"control_ref": "aws.s3.public_access",
19+
"cost": {
20+
"confidence": "low",
21+
"currency": "USD",
22+
"model": "fixture assumption, not a provider quote",
23+
"monthly_delta": {
24+
"expected": 0.0,
25+
"high": 5.0,
26+
"low": 0.0
27+
},
28+
"validation_required": [
29+
"Live provider pricing",
30+
"Region and tier",
31+
"Measured traffic or ingestion",
32+
"Existing commitments and discounts"
33+
]
34+
},
35+
"iac_targets": [
36+
"terraform",
37+
"opentofu",
38+
"cloudformation"
39+
],
40+
"input_digest": "2f7c51872d30ded74f7e2679558b3540b68107b5ca98ff8ab4a882aa2a1bead0",
41+
"mutation": {
42+
"allowed_by_compiler": false,
43+
"performed": false
44+
},
45+
"observed_at": "2026-09-05T10:00:00Z",
46+
"proposal_id": "clp-5a6e9b6fbbe45db4d1b4",
47+
"proposed_change": "Enable account/bucket public-access controls only after identifying intended public distribution and replacing it with an approved delivery path where required.",
48+
"provider": "aws",
49+
"rule_id": "aws-s3-public-access",
50+
"schema_version": "1.0",
51+
"scope": "arn:aws:s3:::synthetic-public-bucket",
52+
"tests": [
53+
"Inventory bucket policies and ACLs",
54+
"Validate CDN/application consumers",
55+
"Confirm intended principals retain access",
56+
"Recollect Security Hub state"
57+
],
58+
"title": "Restrict unintended S3 public access"
59+
}

0 commit comments

Comments
 (0)