AI-Powered Cloud Security Scanner

An intelligent cloud security scanner for AWS, Azure, and GCP that uses AI to detect misconfigurations, assess risks, and provide remediation recommendations.

🚀 Features

Multi-Cloud Support

Provider	Services Scanned	Security Checks
AWS	S3, IAM, EC2, CloudTrail, GuardDuty	Public buckets, MFA, security groups, logging
Azure	Storage, NSG, Resources	Public access, open rules, encryption
GCP	Storage Buckets, IAM	Public buckets, permissions

AI-Powered Capabilities

• ✅ Risk Scoring - ML-based vulnerability prioritization (0-100)
• ✅ Intelligent Assessment - Context-aware security analysis
• ✅ Predictive Analytics - Threat forecasting based on patterns
• ✅ Automated Remediation - Actionable recommendations
• ✅ Compliance Mapping - CIS, NIST, GDPR alignment

📋 Requirements

• Python 3.8 or higher
• Cloud provider credentials (AWS/Azure/GCP)
• Optional: scikit-learn for AI features

🔧 Installation

# Clone the repository
git clone https://github.com/joshuaguda281-stack/cloud-scanner.git
cd cloud-scanner

# Install dependencies
pip install -r requirements.txt

# For AWS only
pip install boto3

# For Azure only
pip install azure-identity azure-mgmt-resource

# For GCP only
pip install google-cloud-storage

💻 Usage
AWS Security Scan

# Configure AWS credentials
export AWS_ACCESS_KEY_ID="your-access-key"
export AWS_SECRET_ACCESS_KEY="your-secret-key"
export AWS_DEFAULT_REGION="us-east-1"

# Run scan
python3 cloud_scanner.py --provider aws

# Save report
python3 cloud_scanner.py --provider aws --report aws_report.json


Azure Security Scan

# Configure Azure credentials
export AZURE_SUBSCRIPTION_ID="your-subscription-id"
az login  # or use service principal

# Run scan
python3 cloud_scanner.py --provider azure



GCP Security Scan

# Configure GCP credentials
export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account-key.json"

# Run scan
python3 cloud_scanner.py --provider gcp



📊 Sample Output
======================================================================
AI-POWERED CLOUD SECURITY SCANNER
Provider: AWS
AI Analysis: ENABLED
======================================================================

[*] Scanning AWS resources...
  [*] Checking S3 buckets...
    [+] my-secure-bucket: OK
    [!] my-public-bucket: public_acl, no_encryption
  [*] Checking IAM users...
    [!] 3 users without MFA
    [!] admin-user: Old access key (120 days)
  [*] Checking security groups...
    [!] 2 open security group rules

======================================================================
AI-POWERED CLOUD SECURITY REPORT - AWS
======================================================================
Overall Security Score: 72/100
Risk Level: MEDIUM
Total Findings: 8

Findings by Severity:
  CRITICAL: 1
  HIGH: 3
  MEDIUM: 4

AI Security Predictions:
  • HIGH RISK: Public buckets detected - potential data exposure
  • HIGH RISK: Multiple accounts without MFA - credential compromise risk
  • MEDIUM RISK: Open security groups - external attack surface exposed

Recommendations:
  → Review and secure all public buckets immediately
  → Enable MFA for all user accounts
  → Review and restrict security group rules

======================================================================



📁 Report Format

{
    "timestamp": "2024-01-15T14:30:00",
    "provider": "AWS",
    "overall_score": 72,
    "risk_level": "MEDIUM",
    "findings": [
        {
            "resource": "s3://my-public-bucket",
            "issues": ["public_acl", "no_encryption"],
            "risk_score": 40,
            "ai_assessment": {
                "verdict": "CRITICAL",
                "confidence": 85,
                "recommendation": "Remove public access and enable encryption"
            }
        }
    ],
    "ai_predictions": [
        "HIGH RISK: Public buckets detected",
        "HIGH RISK: Multiple accounts without MFA"
    ]
}




🤖 AI Models
Risk Scoring (Random Forest)
Input: Security findings, resource types, configurations

Output: Risk score (0-100) and severity classification

Predictive Analytics
Input: Historical patterns, issue correlations

Output: Threat predictions and risk forecasts

🔧 Environment Variables
Provider	Variable	Description
AWS	AWS_ACCESS_KEY_ID	IAM access key
AWS	AWS_SECRET_ACCESS_KEY	IAM secret key
AWS	AWS_DEFAULT_REGION	Region (default: us-east-1)
Azure	AZURE_SUBSCRIPTION_ID	Subscription ID
GCP	GOOGLE_APPLICATION_CREDENTIALS	Service account key path
🎯 Use Cases
Security Audits - Regular compliance checks

DevSecOps - CI/CD security integration

Incident Response - Rapid misconfiguration detection

Compliance - CIS/NIST/GDPR monitoring

🔧 Troubleshooting
Issue	Solution
No module named boto3	pip install boto3
Unable to locate credentials	Configure AWS CLI or environment variables
Azure authentication failed	Run az login or check service principal
GCP permission denied	Verify service account has appropriate roles
📝 License
MIT License - See LICENSE file for details.

👤 Author
Joshua Guda

GitHub: @joshuaguda281-stack

LinkedIn: www.linkedin.com/in/
joshua-guda-356879322

🙏 Acknowledgments
AWS Security Hub

Azure Security Center

GCP Security Command Center

Scikit-learn for ML capabilities

⭐ Support
If this scanner helps secure your cloud infrastructure, please star the repository!