CloudShield — Multi-Cloud IaC Compliance Scanner

A continuous security and compliance scanner for Terraform infrastructure configurations, validating IAM permissions, VPC layouts, and encryption flags.

TypeScriptNode.jsTerraformPostgreSQLGitHub ActionsDocker

The Technical & Operational Challenge

Development teams deploying fast often introduce inadvertent security misconfigurations, such as public S3 buckets or open SSH ingress rules.

The Architectural Solution

Created an automated CLI and GitHub Action runner that parses Terraform HCL ASTs against CIS AWS/GCP benchmarks and flags policy violations before pull requests are merged.

Key Architectural Components

Golang/TypeScript AST parser for Terraform configuration files

Rule evaluation engine checking over 120 CIS Benchmark rules

GitHub Actions integration with automated PR annotations and blocking checks

Centralized PostgreSQL reporting repository for historical drift tracking

Technical Outcomes & Findings

Detected 100% of non-compliant ingress rules and unencrypted volume definitions in test suites
Integrated seamlessly into standard Git pull request review workflows
Reduced manual cloud security review cycle time from days to minutes

MP AI Labs — Let's Talk

Discuss a similar system for your business

Our engineering leads will provide architecture feedback and a structured development roadmap.

Initiate Project Architecture Session

NDA Protected & 100% IP Ownership

Transparent Bi-Weekly Updates

Fixed Scope or Flexible Engagement

Loading System State...