The Fine Print

from crewai import Agent, Task, Crew
from langchain_openai import ChatOpenAI
llm = ChatOpenAI(model="gpt-4-turbo", temperature=0)
config_agent = Agent(
    role='Terraform State Analyst',
    goal='Analyze Terraform code to map resource dependencies and variable usage.',
    backstory='You understand exactly how variables cascade through HCL modules.',
    verbose=True,
    llm=llm
)
sec_architect = Agent(
    role='Cloud Security Architect',
    goal='Identify security misconfigurations in cloud resources and dictate the required fix.',
    backstory='Strict enforcer of CIS benchmarks for cloud infrastructure.',
    verbose=True,
    llm=llm
)
iac_developer = Agent(
    role='IaC Remediation Developer',
    goal='Rewrite the vulnerable Terraform HCL code to implement the security fix using existing variables.',
    backstory='Expert DevOps engineer who writes clean, reusable Terraform code.',
    verbose=True,
    llm=llm
)
terraform_code = """
resource "aws_security_group" "db_sg" {
  name        = "database-sg"
  description = "Allow inbound traffic"
  
  ingress {
    from_port   = 3306
    to_port     = 3306
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"] # VULNERABILITY
  }
}
variable "vpc_cidr" { default = "10.0.0.0/16" }
"""
analyze_task = Task(
    description=f'Analyze the variables and structure of this Terraform code: {terraform_code}',
    expected_output='A map of resources and available variables.',
    agent=config_agent
)
sec_task = Task(
    description='Identify the security flaw in the Terraform code and dictate how it should be restricted.',
    expected_output='Security finding and remediation logic.',
    agent=sec_architect,
    context=[analyze_task]
)
fix_task = Task(
    description='Rewrite the aws_security_group resource. Replace the hardcoded 0.0.0.0/0 with a reference to the existing vpc_cidr variable.',
    expected_output='The final, secure Terraform HCL code block.',
    agent=iac_developer,
    context=[sec_task]
)
iac_swarm = Crew(
    agents=[config_agent, sec_architect, iac_developer],
    tasks=[analyze_task, sec_task, fix_task]
)
if __name__ == "__main__":
    print("Initiating IaC Remediation Swarm...")
    secure_tf = iac_swarm.kickoff()
    print("\n--- Remediated Terraform Code ---\n")
    print(secure_tf)