Disclaimer! When using our solution to review your IaC and application code with any external or internal AI platform, we strongly recommend paying particular attention to your responsibility for securing confidential data. We do not store confidential data and cannot guarantee that the information you provide when using such platforms will remain confidential. Furthermore, we are not responsible for interactions between our solution and any platform, and all potential risks are solely the user's. Always ensure that all the code and data you share do not contain any confidential or sensitive information. Disclosed data should be de-identified or otherwise prepared in compliance with all data protection requirements. Be informed and clearly understand that you only share data that can be safely disclosed. By confirming the use of our solution, you agree to take full responsibility for any potential risks associated with revealing your data.
The BrainTF is AI-powered tool for automatically finding and fixing linting, validation, and security analysis errors in Terraform code. It ensures rigorous validation, testing, and security of the code before applying it to a real environment.
The process includes the following stages:
- Create PR/MR (Pull Request / Merge Request): A developer creates a PR/MR request, depending on the VCS, to make changes to the infrastructure code.
- Push Changes to PR/MR: After creating the PR/MR, code changes are pushed to the repository (e.g., GitHub or GitLab).
- Start Pipeline: The pipeline is automatically triggered upon committing changes to the PR/MR.
- Format Stage (Terraform fmt): The code is automatically checked for formatting according to Terraform standards.
- Lint Stage (TFLint): The Terraform code is checked for style and syntax issues using TFLint.
- Validate Stage (Terraform validate): The Terraform code is validated for correctness.
- Checkov Stage: Security vulnerabilities and potential issues in the code are analyzed using Checkov.
- TFsec Stage: Additional security analysis is performed using TFsec.
- Trivy Stage: Containers and dependencies are scanned for vulnerabilities using Trivy. This stage will be added in the next release!
- Plan Stage (Terraform plan): A plan of changes to be applied to the infrastructure is created.
- Apply Stage (Terraform apply): The changes are applied to the infrastructure.
The project represents an automated process for code verification and correction using a CI/CD pipeline, AWS Lambda functions, S3 storage, and an AI platform. The main goal is to automate code review and fix errors using AI, integrating these changes into the main repository branch.
- Checks whether the AI-based handler (AI Handler) is enabled. If enabled, the process of analyzing and fixing errors using AI begins. If disabled, the fixes are performed manually.
- Analysis logs (e.g.,
tflint_analysis.log,terraform_validate.log, etc.) are stored in S3 storage with an identifier, MR_NUMBER (Merge Request number).
- The AI platform is used to analyze errors and generate suggestions for fixing them. AI processes requests and returns the corrected code.
- The Lambda function initiates the process of analyzing errors in Terraform (or other tools), sending requests to the AI platform and saving the results.
- Corrected files (e.g.,
fixed_file_1.tf,fixed_file_x.tf) are stored in S3 storage in the/artifacts/directory with the identifier MR_NUMBER.
- DynamoDB is used to store request history (Get/Put requests). This allows tracking of changes and results from the AI processing.
- The Lambda function processes comments from the Pull Request. After analysis, AI adds comments with suggestions for corrections or automatically fixes the code.
- A Pull Request to the main branch is the starting point of the process. AI analyzes the comments, and the user can accept or reject the suggested code fixes.
- Code formatting check. If errors are found, the process stops. The further checks will not proceed until the entire code is manually formatted locally with
terraform -fmt -recursiveand re-pushed.
- Code analysis using a linter (
TFLint). If errors are found, the process stops. Further stages will not proceed until the user fixes the errors manually or approves the AI-corrected files.
- Validation of Terraform configurations. If errors are found, the process stops. Further stages will not proceed until the user fixes the errors manually or approves the AI-corrected files.
- Code analysis using Checkov (infrastructure security analysis). If errors are found, the process stops. Further stages will not proceed until the user fixes the errors manually or approves the AI-corrected files.
- Security analysis of Terraform code using
tfsec. If errors are found, the process stops. Further stages will not proceed until the user fixes the errors manually or approves the AI-corrected files.
- Vulnerability scanning using
trivy. If errors are found, the process stops. Further stages will not proceed until the user fixes the errors manually or approves the AI-corrected files. This stage will be added in the next release!
- Terraform plan generation. At this stage, Terraform verifies the infrastructure's deployability and creates a file with a list of objects to be deployed/modified/deleted for transfer to the next stage, where they will be deployed. This stage will not begin until the user manually fixes errors or approves files fixed by the AI in all previous stages. Currently, only the first directory specified in the 'WORK_DIRS' variable is processed! This limitation may be revised in future releases!
- Applying changes to the infrastructure. This stage is only triggered after all previous checks are successfully passed. Currently, only the first directory specified in the 'WORK_DIRS' variable is processed! This limitation may be revised in future releases!
This Bot supports next structured comment commands to trigger automation:
- "bot approve" or "bot approve all" - triggers the approval of committing all files fixed by AI bot.
- "bot approve <path/to/file1> [<path/to/file2> ...]" - triggers the approval of committing a specific file or files fixed by AI bot.
- "bot list" - lists files correted by AI and ready to commit.
- "bot prompt " - sends custom prompt to AI.
- "help" - shows this help information in the MR/PR notes.