AI Agent — Infrastructure & Security Engineer
Oracle Cloud Infrastructure — CIS Foundations Benchmark 3.0 — AI-Powered Compliance Platform
---
## Overview
AI Agent is a self-hosted web application that automates **CIS Oracle Cloud Infrastructure Foundations Benchmark 3.0** compliance checks, powered by **OCI Generative AI** for intelligent analysis and **MCP (Model Context Protocol)** for extensible task execution.
The platform runs as pre-built Docker containers — no source code required.
---
## Features
- **AI Chat Agent** with RAG (Retrieval-Augmented Generation) + MCP Tool Use
- **Terraform Agent** for AI-powered IaC generation (plan/apply/destroy)
- **OCI Account Explorer** — 36 resource types, KPI dashboard, start/stop actions
- **OCI CLI Terminal** — web terminal with Tab autocomplete, OCID auto-lookup
- **CIS Compliance Reports** — 48 CIS + 11 OBP checks, PDF/DOCX export
- **Compliance Report** — professional Oracle-format assessment with RAG remediation
- **OCI Services Status** — auto-detect security services + OCI Health (49 regions)
- **Embeddings & Knowledge Base** — CIS PDF chunker, ADB vector store
- **Oracle IAM OIDC** — SSO via Oracle Identity Domains
- **Security** — JWT + TOTP MFA + RBAC (3 roles) + Fernet encryption + WAF
- **i18n** — Portuguese, English, Spanish
---
## Quick Start (Docker Compose)
### Prerequisites
- Docker and Docker Compose
- Access to the OCI Container Registry (OCIR) with pull credentials
### 1. Configure
```bash
cp .env.example .env
```
Edit `.env`:
```env
OCIR_REGION=us-ashburn-1
OCIR_NAMESPACE=your_namespace
APP_SECRET=
```
### 2. Login to OCIR
```bash
docker login ${OCIR_REGION}.ocir.io
```
Username: `/` (or `/oracleidentitycloudservice/`)
Password: Auth Token (generate in OCI Console > Profile > Auth Tokens)
### 3. Run
```bash
docker compose up -d
```
### 4. Access
Open `http://localhost:8080`
The initial admin password is generated automatically and displayed in the backend logs:
```bash
docker compose logs backend | grep "password"
```
> You will be prompted to change the password on first login.
---
## Deploy on OCI (Terraform)
For production deployment on Oracle Cloud Infrastructure with Load Balancer, WAF, and SSL.
### Architecture
```
Internet --> WAF --> Load Balancer (HTTPS 443)
|
Private Subnet
|
Compute Instance (ARM, Free Tier eligible)
+-- Backend container (FastAPI)
+-- Frontend container (nginx)
+-- Block Volume (/data)
```
### Setup
```bash
cd terraform
cp terraform.tfvars.example terraform.tfvars
```
Edit `terraform.tfvars` with your OCI credentials and configuration.
### Deploy
```bash
terraform init
terraform plan
terraform apply
```
### Resources Created
| Resource | Description |
|----------|-------------|
| VCN | Virtual Cloud Network with public/private subnets |
| Compute | VM.Standard.A1.Flex (ARM, Free Tier eligible) |
| Block Volume | 50GB persistent storage for /data |
| Load Balancer | Flexible 10-100 Mbps with SSL |
| WAF | OWASP protection (XSS, SQLi, path traversal) |
| OCIR | 2 private container repositories |
| DNS | Conditional — OCI DNS Zone + A record (when domain configured) |
### Outputs
After `terraform apply`:
```bash
terraform output load_balancer_ip # Public IP
terraform output app_url # https://
terraform output ocir_backend_url # OCIR image URL
```
---
## Configuration Guide
### Step 1 — OCI Credentials
Navigate to **OCI Credentials** and add your tenancy details:
| Field | Description |
|-------|-------------|
| Tenancy Name | Friendly name |
| OCID Tenancy | `ocid1.tenancy.oc1..xxxxx` |
| OCID User | `ocid1.user.oc1..xxxxx` |
| Fingerprint | `aa:bb:cc:dd:...` |
| Region | `us-ashburn-1` |
| Private Key | `.pem` file |
### Step 2 — GenAI Model
Select an OCI credential, choose a model from the catalog, and adjust parameters.
### Step 3 — ADB Vector (Optional)
For RAG-powered chat, configure an Autonomous Database with vector tables.
### Step 4 — MCP Servers (Optional)
Register MCP servers for extended tool use in the Chat Agent.
---
## OCI IAM Policies
```
Allow group to use generative-ai-family in compartment
Allow group to read all-resources in tenancy
Allow group to inspect compartments in tenancy
Allow group to inspect autonomous-databases in compartment
Allow group to read virtual-network-family in compartment
Allow group to read instance-family in compartment
Allow group to read objectstorage-namespaces in tenancy
Allow group to read buckets in compartment
```
---
## Environment Variables
| Variable | Required | Default | Description |
|----------|----------|---------|-------------|
| `OCIR_REGION` | Yes | — | OCI region (e.g., `us-ashburn-1`) |
| `OCIR_NAMESPACE` | Yes | — | OCIR namespace |
| `APP_SECRET` | Yes | — | 64-byte hex key for JWT/encryption |
| `JWT_EXPIRY_HOURS` | No | `12` | Token expiry |
| `PORT` | No | `8080` | Frontend port |
| `CORS_ORIGINS` | No | — | Allowed origins (comma-separated) |
| `TZ` | No | `America/Sao_Paulo` | Timezone |
---
## Troubleshooting
**Cannot pull images from OCIR:**
Verify your `docker login` credentials and that the OCIR repositories exist in your namespace.
**Backend health check fails:**
Check logs: `docker compose logs backend`. Ensure `APP_SECRET` is set.
**ADB connection fails:**
Ensure the wallet ZIP is uploaded and the DSN matches a service in `tnsnames.ora`.
**GenAI returns 401/403:**
Verify the IAM policy for `generative-ai-family` exists for your user/group.
---
## License
MIT
---
Built for Oracle Cloud Infrastructure security compliance