Aegis: AI-Powered Autonomous Security Scanner for GKE

North Star Metric: Autonomous 11-Microservice Security Analysis

Aegis autonomously discovers, analyzes, and secures 11 microservices in the Online Boutique application, generating AI-powered security summaries in 30-60 seconds with zero manual intervention.

The Challenge: Microservices Security at Scale

Modern microservices architectures present unique security challenges:

Service Discovery: 11+ microservices with complex inter-service communication
Vulnerability Detection: HTTP security headers, information disclosure, configuration issues
gRPC Analysis: Service definition parsing and security configuration auditing
Context-Aware Reporting: Translating technical findings into actionable business insights

Traditional security scanners treat each service in isolation. Aegis understands the entire microservices topology and provides holistic security assessments.

System Architecture

Technology Stack

Backend: FastAPI + LangGraph Agent Logic

The core security scanner is built on FastAPI with LangGraph orchestrating autonomous agent workflows:

Service Discovery: Automatically maps all 11 microservices and their communication patterns
Vulnerability Detection: Analyzes HTTP security headers, information disclosure, configuration issues
gRPC Analysis: Parses service definitions and audits security configurations
Agent Orchestration: LangGraph manages the multi-step security assessment workflow

Frontend: Next.js Professional Dashboard

A dark-themed security tool interface designed for enterprise use:

Severity-Based Color Coding: Critical, High, Medium, Low findings
Real-Time Status Updates: Live scanning progress and status
AI Summary Generation: One-click intelligent security summaries
Responsive Design: Works across all screen sizes

Cloud Platform: Google Cloud Run + GKE

Serverless Deployment: Auto-scaling Cloud Run services
GKE Integration: Scans microservices deployed on GKE
Firestore: Stores scan results for historical analysis
Vertex AI: Google Gemini API for AI-powered analysis
Artifact Registry: Container image storage

Security Scanning Capabilities

Microservice Discovery

Automatically discovers all 11 Online Boutique microservices
Maps service communication patterns
Identifies gRPC service definitions
Builds complete application topology

Vulnerability Detection

HTTP Security Headers:

Content-Security-Policy (CSP)
HTTP Strict Transport Security (HSTS)
X-Frame-Options
X-Content-Type-Options
And more...

Information Disclosure:

Server information leaks
Debug endpoints exposure
Error message information leakage

Configuration Issues:

Insecure HTTP connections
Exposed admin endpoints
Service security misconfigurations

Service Security:

gRPC service security configurations
Authentication/authorization gaps
Network security policies

AI-Powered Analysis

The Google Gemini integration provides:

Holistic Analysis: Analyzes all findings together, not in isolation
Business Impact Assessment: Explains security risks in business terms
Prioritized Remediation: Offers actionable, prioritized fix recommendations
Plain English Explanations: Translates technical concepts clearly

Key Innovations

1. Autonomous Agent Architecture

Unlike traditional scanners that require manual configuration, Aegis uses LangGraph to orchestrate autonomous workflows:

# Simplified agent workflow
def security_scan_workflow(target_url: str):
    # Step 1: Discover services
    services = discover_microservices(target_url)
    
    # Step 2: Scan each service
    findings = []
    for service in services:
        findings.extend(scan_service(service))
    
    # Step 3: Store results
    store_findings(findings)
    
    # Step 4: Generate AI summary
    summary = generate_ai_summary(findings)
    
    return findings, summary

2. gRPC Service Analysis

Aegis uniquely analyzes gRPC services, which many scanners ignore:

Parses .proto service definitions
Identifies exposed RPC methods
Audits authentication/authorization
Maps service dependencies

3. Context-Aware AI Summaries

Instead of raw vulnerability lists, Gemini generates:

Executive Summary: High-level security posture
Risk Assessment: Business impact of findings
Remediation Roadmap: Prioritized action items
Technical Deep-Dive: Detailed explanations for developers

Performance Metrics

Scan Time: 30-60 seconds for complete 11-microservice analysis
Concurrent Scans: Supports multiple simultaneous scans
Auto-Scaling: Automatically scales based on demand
Real-Time Updates: Live status updates during scanning

Deployment Architecture

Cloud Run (Recommended)

Serverless: Pay-per-use pricing
Auto-Scaling: Handles traffic spikes automatically
Easy Deployment: Simple container deployment
Managed Infrastructure: No Kubernetes management needed

GKE (Alternative)

Full Kubernetes Control: Custom resource allocation
Advanced Networking: Custom networking options
Enterprise Features: For organizations requiring Kubernetes

API Endpoints

Backend API

POST /api/scan/start - Start new security scan
GET /api/scan/results/{scan_id} - Get scan results
POST /api/scan/summary/{scan_id} - Generate AI summary
GET /health - Health check

Example Usage

# Start a scan
curl -X POST http://backend-url/api/scan/start \
  -H "Content-Type: application/json" \
  -d '{"target_url": "http://online-boutique-ip"}'

# Get results
curl http://backend-url/api/scan/results/scan-id

# Generate AI summary
curl -X POST http://backend-url/api/scan/summary/scan-id

UI/UX Features

Professional Dark Theme

Security tool aesthetic with dark mode
Severity-based color coding (Critical, High, Medium, Low)
Smooth animations and transitions
Responsive design for all devices

Interactive Components

Real-Time Scan Status: Live updates during scanning
Expandable Vulnerability Details: Click to expand findings
AI Summary Generation: One-click intelligent summaries
Professional Vulnerability Cards: Enterprise-grade presentation

Hackathon Submission Highlights

Built for the GKE Turns 10 Hackathon, Aegis demonstrates:

Innovation: AI-powered autonomous security scanning
Technical Excellence: Clean architecture, proper GKE usage
Impact: Real security value for microservices applications
Presentation: Professional UI and comprehensive documentation

Key Differentiators

gRPC Service Discovery: Automatically analyzes complex microservice architectures
AI-Powered Insights: Generates human-readable security assessments
Professional UI: Enterprise-grade security tool interface
Cloud-Native Design: Leverages Google Cloud services effectively

Lessons Learned

1. Agent Orchestration Complexity

LangGraph provides powerful orchestration, but managing state across multiple agent steps requires careful design. The key is breaking down the security scan into discrete, composable steps.

2. gRPC Analysis Challenges

Parsing and analyzing gRPC services is more complex than HTTP. Service definitions need to be extracted, parsed, and analyzed for security configurations.

3. AI Summary Quality

Prompt engineering for Gemini is crucial. The model needs clear context about what constitutes a "good" security summary—balancing technical detail with business impact.

4. Real-Time UI Updates

WebSocket or Server-Sent Events (SSE) would improve the real-time experience, but polling works well for the hackathon scope.

Future Enhancements

Continuous Monitoring: Scheduled scans with alerting
Remediation Automation: Auto-fix capabilities for common issues
Multi-Cloud Support: Extend beyond GKE to other platforms
Compliance Reporting: Generate compliance reports (SOC2, ISO27001)
Integration: CI/CD pipeline integration for shift-left security

Impact

Aegis demonstrates that AI-powered autonomous security scanning is not just possible, but practical for microservices applications. By combining LangGraph agent orchestration with Google Gemini's reasoning capabilities, we've built a security tool that understands context, provides actionable insights, and scales automatically.

The project showcases how modern AI can augment security operations, making comprehensive security assessments accessible to teams without dedicated security expertise.