AI Platform Engineer
Infrastructure risks routed to owners before execution.
Detect reliability, security, cost, and deployment risks. Explain impact, recommend safe fixes, and require approval before any change runs.
Scan completeRun #1 found 5 infrastructure risks across 5 signal sources for CloudOps Demo Workspace.
5 waiting for approvalRisk Inbox
Investigation queue
Decision Trace
Terraform drift detected in security group
A production security group was changed outside Terraform and now allows SSH from a wider CIDR range.
HighNeeds ApprovalCloud Platform
Servicenetworking
SignalTerraform
Confidence92%
Executionpull request
Raw evidencePreserved from source
- Terraform plan shows ingress drift
- Port 22 changed from office CIDR to 0.0.0.0/0
- Resource managed by networking module
This risk predates Decision Trace generation. Re-import the source finding to generate a trace.
Human approval boundaryNo infrastructure change runs from this trace.
Restore the managed security group rule through Terraform and add drift detection to CI.
Owners
Routing map
Cloud Platformnetworking
- Risks
- 1
- Urgent
- 1
- Waiting
- 1
- Done
- 0
Data Platformworker-ingestion
- Risks
- 1
- Urgent
- 1
- Waiting
- 1
- Done
- 0
Security Ownercustomer-assets
- Risks
- 1
- Urgent
- 1
- Waiting
- 1
- Done
- 0
Platform Teampayments-api
- Risks
- 1
- Urgent
- 1
- Waiting
- 1
- Done
- 0
FinOps Owneranalytics-cluster
- Risks
- 1
- Urgent
- 0
- Waiting
- 1
- Done
- 0
Approval Queue
Safe execution gate
Approved remediations will appear here before execution.
Execution Log
Approved changes
Executed remediations will appear here with safety checks and command evidence.
Audit Log
Decision history
5 infrastructure risks restored for review.
5 infrastructure risks restored for review.
8 workflow runs reviewed for AZ1600/cloudops-command-center. 1 failed runs generated risks for owner approval.
6 workflow runs reviewed for AZ1600/cloudops-command-center. 0 failed runs generated risks for owner approval.
5 infrastructure risks restored for review.
pull request remediation approved for Cloud Platform. Execution is queued behind the safety gate.
5 infrastructure risks detected and routed to owners.
Service Catalog
Owned platform assets
Degradedproduction
1 active riskspayments-api
- Owner
- Platform Team
- Runtime
- FastAPI on ECS
- Last change
- Deployment failed 18 minutes ago
GitHubAWS
Criticalproduction
1 active riskscustomer-assets
- Owner
- Security Owner
- Runtime
- S3 + CloudFront
- Last change
- Bucket policy changed today
AWSTerraform
Criticalproduction
1 active risksworker-ingestion
- Owner
- Data Platform
- Runtime
- Kubernetes deployment
- Last change
- Image rollout 42 minutes ago
KubernetesMonitoring
Watchproduction
1 active risksanalytics-cluster
- Owner
- FinOps Owner
- Runtime
- EC2 + EBS
- Last change
- Volume audit 2 days ago
AWS
Degradedshared
1 active risksnetworking
- Owner
- Cloud Platform
- Runtime
- Terraform module
- Last change
- Manual security group edit detected
TerraformAWS
Integrations
Infrastructure signal sources
Connected1 signals
Live fetch availableGitHub Actions
- workflow runs
- deployment failures
- release history
Fetch workflow runs by repository and route failed deployments to owners.
Mock2 signals
4 minutes agoAWS
- S3 posture
- cost findings
- resource inventory
Add read-only IAM role for CloudWatch, Cost Explorer, and IAM Access Analyzer.
Mock1 signals
5 minutes agoKubernetes
- pod health
- restart counts
- readiness failures
Connect cluster service account with read-only workload access.
Mock1 signals
8 minutes agoTerraform
- drift signals
- plan output
- module ownership
Import Terraform plan JSON from CI before apply.
Not connected0 signals
Not syncedPrometheus / Monitoring
- alerts
- SLO burn rate
- latency anomalies
Connect alert webhook after the core remediation flow is stable.
GitHub Actions
Live workflow failure detection
Terraform Import
Plan JSON risk detection
Runbooks
Controlled remediation procedures
securitypull request
Security OwnerPublic S3 Access Remediation
Applies to customer-assets and is currently linked to an active risk.
Safety checks
- Confirm the bucket is not intentionally hosting public website assets.
- Verify customer uploads can be served through signed URLs.
- Run Terraform plan before changing the bucket policy.
Rollback plan
- Revert the bucket policy pull request.
- Restore the last known-good access policy from version control.
- Re-run object access tests for customer downloads.
reliabilityworkflow
Data PlatformKubernetes CrashLoopBackOff Response
Applies to worker-ingestion and is currently linked to an active risk.
Safety checks
- Read previous container logs before restarting pods.
- Check image tag against the last healthy release.
- Confirm queue backlog can tolerate a canary restart.
Rollback plan
- Roll deployment back to the previous image tag.
- Scale workers to the last stable replica count.
- Requeue failed jobs after readiness checks pass.
deploymentworkflow
Platform TeamFailed Production Deployment Recovery
Applies to payments-api and is currently linked to an active risk.
Safety checks
- Review failed migration logs and database lock metrics.
- Confirm production is still serving the previous healthy release.
- Require owner approval before rerunning deployment.
Rollback plan
- Keep traffic on the previous deployment.
- Disable the failing migration step until patched.
- Open an incident note with the failed run and owner.
securitypull request
Cloud PlatformTerraform Drift Correction
Applies to networking and is currently linked to an active risk.
Safety checks
- Confirm whether the out-of-band change had emergency approval.
- Generate a Terraform plan scoped to the drifted resource.
- Validate the restored CIDR does not block approved access.
Rollback plan
- Revert the remediation pull request.
- Reapply the previous approved security group rule.
- Attach the rollback decision to the audit log.
costsimulated
FinOps OwnerUnused Cloud Resource Cleanup
Applies to analytics-cluster and is currently linked to an active risk.
Safety checks
- Confirm unattached volumes have no read or write activity.
- Create a final snapshot before deletion.
- Notify the service owner before cleanup approval.
Rollback plan
- Restore the deleted volume from snapshot.
- Reattach the restored volume to the approved instance.
- Update the cost exception list if the volume is intentionally retained.