terrasecure

TerraSecure is an intelligent, shift-left security scanner designed to prevent cloud misconfigurations and find vulnerabilities in Terraform and HCL Infrastructure as Code (IaC) across AWS, Azure, and Google Cloud. It aims to address the high cost of cloud data breaches, many of which stem from IaC misconfigurations, by offering a more effective approach than traditional rule-based scanners that often produce numerous false positives. The tool integrates directly into developer workflows as a GitHub Action, Docker container, or CLI tool, surfacing security issues with actionable context. It operates with three layers of intelligence: 1. **Rule Engine**: Features 122 hardened security patterns, with 50 for AWS, 50 for Azure, and 22 for GCP (v1 coverage for GCP). It routes each parsed resource to its specific cloud provider's rule engine. 2. **ML Model**: An XGBoost classifier with 50 engineered features, trained on real-world AWS breach patterns (e.g., Capital One, Uber, Tesla). This model provides a risk score for AWS resources, achieving 98.11% accuracy on a 53-sample test set (with a 5-fold cross-validation mean of 62.26% on a 265-sample training corpus). 3. **AI Analysis**: Utilizes AWS Bedrock (Claude 3 Haiku) to explain the impact, attack paths, and detailed remediation code for detected issues. It includes a response cache for cost savings and offers intelligent fallback to expert templates if Bedrock is unavailable. TerraSecure differentiates itself from tools like Checkov and Trivy by offering ML-powered detection, AI-generated business impact context, real breach examples, attack scenarios, ML risk scores, and resource-specific code fixes. It is recommended for use alongside other scanners for complementary coverage. **Key Features and Integrations:** * **CI/CD Integration**: Seamlessly integrates into GitHub Actions, Docker, and local CLI for build-time scanning. * **Multi-Cloud Coverage**: Provides extensive security patterns for AWS (50), Azure (50), and Google Cloud (22, v1). * **Detailed Findings**: Each finding includes an explanation, business impact, attack scenario, and detailed fix, all enhanced by AI. * **Output Formats**: Supports Text, JSON, and SARIF 2.1.0, enabling integration with GitHub Security tab for code scanning alerts. * **Performance**: Offers fast inference speed (<100ms/resource) and a lightweight ML model (195 KB). TerraSecure's architecture ensures that resources from different cloud providers within the same Terraform configuration are scanned correctly by their respective rule sets, with findings cloud-tagged in all output formats. The ML pipeline is trained on real-world breach data, focusing on critical security features like encryption, network exposure, IAM permissiveness, and logging configurations.