Automate Tfsec with AgenticOps — auto-remediate findings under policy

The operational work this removes

• Thousands of Tfsec findings pile up faster than the security team can triage them, so criticals sit next to noise and MTTR climbs
• Every finding is manually mapped to an owner, a fix, and a Jira ticket — the same misconfiguration keeps reappearing because nothing closes the loop
• Auditors ask for SOC 2 / CIS / PCI evidence and there is no tamper-evident record of who remediated what, when, and who approved it
• Over-permissive IAM roles and public exposure are flagged but never right-sized, because engineers fear breaking prod by tightening them blindly
• Remediation scripts run with standing admin credentials, so the fix is riskier than the finding — the opposite of what security wants
• Nobody trusts auto-remediation because there is no dry-run, no blast-radius check, and no rollback if the fix regresses

From signal to verified action

CloudThinker's Frontier Investigation Agents investigate the signal, find the why and propose the fix, or run the safe action your policy allows. Your engineers approve, and the agents verify the outcome.

1. Detect

   Detect the Tfsec signal

   Tfsec runs on a continuous schedule and its findings stream into CloudThinker normalized to a common schema (resource, severity, control ID, framework mapping — CIS, SOC 2, PCI DSS). Duplicate and already-accepted findings are suppressed so engineers see only what actually changed since the last scan.

2. Analyze

   Analyze the root cause

   For each finding, the agent pulls surrounding context — the resource's config, IAM reachability, network path, data classification, and recent CloudTrail activity — to score real exploitability, not just raw severity. It clusters related findings to one root cause (e.g. a permissive SCP fanning out to 40 findings) and drafts a fix plan with an explicit blast-radius assessment.

3. Remediate

   Remediate under policy

   The agent proposes a concrete change — a least-privilege IAM policy, a bucket policy tightening, a patched image tag, a security-group rule removal — executed in a sandbox with brokered, time-boxed credentials (never standing admin). Graduated autonomy governs action: L1 recommends, L2 opens a PR/ticket, L3 auto-applies low-risk reversible fixes, L4 handles pre-approved runbooks end-to-end. Anything above the team's policy threshold pauses for an engineer on the loop to approve.

4. Verify

   Verify and record

   After applying, the agent re-runs the relevant Tfsec check to confirm the finding clears, validates no dependent service regressed, and — on failure — rolls back automatically. Every step (input, decision, credential grant, diff, approver) is written to a tamper-evident audit trail that doubles as continuous compliance evidence.

Evidence and proposed action

$ cloudthinker remediate --source Tfsec --finding SEC-4471

Detect   Tfsec · SEC-4471 · CRITICAL · CIS 1.16 / SOC2 CC6.1
         IAM role "ci-deploy" has AdministratorAccess (standing)
         Root-caused 12 related findings to this one policy

Analyze  Reachability: assumable by 3 CI principals
         Used actions (90d CloudTrail): 41 of 8,000+ granted
         Exploitability: HIGH (broad blast radius, no MFA gate)
         Blast radius: 3 pipelines · rollback: policy-version pin

Remediate  Plan: replace AdministratorAccess with generated
           least-privilege policy scoped to 41 observed actions
           Autonomy: L2 (change exceeds auto-apply threshold)
           Credentials: brokered, 15-min TTL, sandbox dry-run OK
           -> Awaiting approval from engineer on the loop

Verify   [after approval] re-scan SEC-4471 ....... CLEARED
         12 linked findings ..................... CLEARED
         CI smoke test (3 pipelines) ............ PASS
         Audit: signed, mapped to SOC2 CC6.1 evidence

What the agent understands

tfsec Terraform security scanning. Covers static analysis of Terraform code, custom rule creation, CI integration, severity filtering, module scanning, and remediation guidance. Use when scanning Terraform configurations for security issues, creating custom security rules, or integrating security...

Related automations

More automations in the same category.