AI Sec: one dashboard for infrastructure security findings

When working with Infrastructure-as-Code (IaC), I often run multiple linters and security scanners together to ensure the codebase is free from vulnerabilities. However, I’ve found that their outputs can be verbose and, at times, lack meaningful context—particularly when trying to prioritize what to fix. This led me to explore how AI could enhance the way I interact with these tools and present insights.

The result is AI Sec, a Python-based tool that aggregates and enhances the outputs of popular IaC security tools and presents them in an easy-to-read dashboard. By leveraging OpenAI-powered insights, AI Sec highlights the most important findings and provides contextual explanations for high-severity issues, making it easier to understand their impact and remediation steps.

Why I Built AI Sec

Navigating Complex Linter Outputs

Running tools like Checkov, TFLint, and TFSec together provides broad coverage for identifying misconfigurations in Terraform, CloudFormation, and Kubernetes manifests. However, I often encountered:

Command-Line Overload: The outputs are lengthy, making prioritization difficult without proper context.
Severity Gaps: Some tools lack default severity scoring, leaving developers to interpret findings manually.
Context Gaps: It’s not always obvious why an issue is critical or how to address it.
Disconnected Workflows: It’s tough to visualize all findings in one place when using multiple tools.

Key Features of AI Sec

Unified Security and Compliance Insights

AI Sec consolidates findings from popular Infrastructure as Code (IaC) security tools, such as Checkov, TFLint, and TFSec. By integrating these tools into a single dashboard, it provides a comprehensive view of potential misconfigurations, policy violations, and security risks.

Filtering and Navigating Issues

The dashboard includes robust filtering options, allowing users to quickly isolate issues based on:

Severity levels (Critical, High, Medium, Low, Info).
Linter type (Checkov, TFLint, TFSec).
Specific file paths or resource types.

AI-Powered Severity Insights

Using an OpenAI API token, AI Sec can:

Categorize issues by severity (e.g., Critical, High, Medium, Low).
Provide contextual explanations for each issue, helping developers understand why it matters.
Cache AI responses to avoid repeated API requests, reducing costs and improving performance.

AI-Derived Severity for Checkov Findings

AI Sec enhances Checkov findings by deriving severity levels (Critical, High, Medium, Low) using OpenAI’s API. This helps provide better prioritization and actionable insights. However, it’s important to note:

The generated severity levels are inferred using AI models (e.g., GPT-4 or GPT-3.5) and may differ from what might be provided under other subscription plans or security benchmarks.
The accuracy and context of the severity assignments depend on the chosen OpenAI model, which may have limitations, particularly when using the free-tier API or lower-tier models. To use this feature, set your OPENAI_API_KEY as an environment variable.

Caching for Cost-Effective Insights

To reduce API costs, AI Sec caches the OpenAI responses locally. This means:

The same issue will not trigger additional API requests if analyzed again.
Cached results are stored in ~/.ai_sec/openai_cache.json.
If needed, users can clear the cache by deleting ~/.ai_sec/openai_cache.json.

This significantly reduces repeated charges and improves performance for subsequent runs.

CI/CD Integration

AI Sec provides a GitHub Action for seamless CI/CD integration. It:

Runs AI Sec during pull requests.
Summarizes results directly in the GitHub workflow.
Optionally publishes a static HTML report to GitHub Pages.

How It Works

Installation

AI Sec is available as a Python package and Docker image:

PyPI:
```
pip install ai-sec
```
Docker:
```
docker pull darrendev80/ai_sec:latest
```

Running Locally

Run AI Sec on a directory containing your Terraform or Kubernetes configurations:

ai-sec --infra-dir ./path/to/code --config-path ./config.yaml

This generates a report in both JSON and HTML formats, ready for review.

GitHub Action

Add AI Sec to your CI/CD pipeline by including the following in your GitHub workflow:

name: Run AI Sec
on: pull_request
jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Run AI Sec Linter
        uses: darrendev80/ai-sec-action@v3
        with:
          infra_dir: "./code"
          config_path: "./config.yaml"
          openai_api_token: ${{ secrets.OPENAI_API_TOKEN }}