A-Team-Security-Infra-Agent-Engineer/distribution/README.md

AI Agent — Infrastructure & Security Engineer

Oracle Cloud Infrastructure — CIS Foundations Benchmark 3.0 — AI-Powered Compliance Platform

---

Overview

AI Agent is a self-hosted web application that automates CIS Oracle Cloud Infrastructure Foundations Benchmark 3.0 compliance checks, powered by OCI Generative AI for intelligent analysis and MCP (Model Context Protocol) for extensible task execution.

The platform runs as pre-built Docker containers — no source code required.

---

Features

• AI Chat Agent with RAG (Retrieval-Augmented Generation) + MCP Tool Use
• Terraform Agent for AI-powered IaC generation (plan/apply/destroy)
• OCI Account Explorer — 36 resource types, KPI dashboard, start/stop actions
• OCI CLI Terminal — web terminal with Tab autocomplete, OCID auto-lookup
• CIS Compliance Reports — 48 CIS + 11 OBP checks, PDF/DOCX export
• Compliance Report — professional Oracle-format assessment with RAG remediation
• OCI Services Status — auto-detect security services + OCI Health (49 regions)
• Embeddings & Knowledge Base — CIS PDF chunker, ADB vector store
• Oracle IAM OIDC — SSO via Oracle Identity Domains
• Security — JWT + TOTP MFA + RBAC (3 roles) + Fernet encryption + WAF
• i18n — Portuguese, English, Spanish

---

Quick Start (Docker Compose)

Prerequisites

• Docker and Docker Compose
• Access to the OCI Container Registry (OCIR) with pull credentials

1. Configure

cp .env.example .env

Edit .env:

OCIR_REGION=us-ashburn-1
OCIR_NAMESPACE=your_namespace
APP_SECRET=<generate with: openssl rand -hex 64>

2. Login to OCIR

docker login ${OCIR_REGION}.ocir.io

Username: <namespace>/<username> (or <namespace>/oracleidentitycloudservice/<email>) Password: Auth Token (generate in OCI Console > Profile > Auth Tokens)

3. Run

docker compose up -d

4. Access

Open http://localhost:8080

The initial admin password is generated automatically and displayed in the backend logs:

docker compose logs backend | grep "password"

You will be prompted to change the password on first login.

---

Deploy on OCI (Terraform)

For production deployment on Oracle Cloud Infrastructure with Load Balancer, WAF, and SSL.

Architecture

Internet --> WAF --> Load Balancer (HTTPS 443)
                          |
                     Private Subnet
                          |
                   Compute Instance (ARM, Free Tier eligible)
                     +-- Backend container (FastAPI)
                     +-- Frontend container (nginx)
                     +-- Block Volume (/data)

Setup

cd terraform
cp terraform.tfvars.example terraform.tfvars

Edit terraform.tfvars with your OCI credentials and configuration.

Deploy

terraform init
terraform plan
terraform apply

Resources Created

Resource	Description
VCN	Virtual Cloud Network with public/private subnets
Compute	VM.Standard.A1.Flex (ARM, Free Tier eligible)
Block Volume	50GB persistent storage for /data
Load Balancer	Flexible 10-100 Mbps with SSL
WAF	OWASP protection (XSS, SQLi, path traversal)
OCIR	2 private container repositories
DNS	Conditional — OCI DNS Zone + A record (when domain configured)

Outputs

After terraform apply:

terraform output load_balancer_ip    # Public IP
terraform output app_url             # https://<IP>
terraform output ocir_backend_url    # OCIR image URL

---

Configuration Guide

Step 1 — OCI Credentials

Navigate to OCI Credentials and add your tenancy details:

Field	Description
Tenancy Name	Friendly name
OCID Tenancy	ocid1.tenancy.oc1..xxxxx
OCID User	ocid1.user.oc1..xxxxx
Fingerprint	aa:bb:cc:dd:...
Region	us-ashburn-1
Private Key	.pem file

Step 2 — GenAI Model

Select an OCI credential, choose a model from the catalog, and adjust parameters.

Step 3 — ADB Vector (Optional)

For RAG-powered chat, configure an Autonomous Database with vector tables.

Step 4 — MCP Servers (Optional)

Register MCP servers for extended tool use in the Chat Agent.

---

OCI IAM Policies

Allow group <group-name> to use generative-ai-family in compartment <compartment-name>
Allow group <group-name> to read all-resources in tenancy
Allow group <group-name> to inspect compartments in tenancy
Allow group <group-name> to inspect autonomous-databases in compartment <compartment-name>
Allow group <group-name> to read virtual-network-family in compartment <compartment-name>
Allow group <group-name> to read instance-family in compartment <compartment-name>
Allow group <group-name> to read objectstorage-namespaces in tenancy
Allow group <group-name> to read buckets in compartment <compartment-name>

---

Environment Variables

Variable	Required	Default	Description
OCIR_REGION	Yes	—	OCI region (e.g., us-ashburn-1)
OCIR_NAMESPACE	Yes	—	OCIR namespace
APP_SECRET	Yes	—	64-byte hex key for JWT/encryption
JWT_EXPIRY_HOURS	No	12	Token expiry
PORT	No	8080	Frontend port
CORS_ORIGINS	No	—	Allowed origins (comma-separated)
TZ	No	America/Sao_Paulo	Timezone

---

Troubleshooting

Cannot pull images from OCIR: Verify your docker login credentials and that the OCIR repositories exist in your namespace.

Backend health check fails: Check logs: docker compose logs backend. Ensure APP_SECRET is set.

ADB connection fails: Ensure the wallet ZIP is uploaded and the DSN matches a service in tnsnames.ora.

GenAI returns 401/403: Verify the IAM policy for generative-ai-family exists for your user/group.

---

License

MIT

---

_{Built for Oracle Cloud Infrastructure security compliance}