Blueprint: Cloud Firewall Guardian

Protecting Cloud Infrastructure APIs from Autonomous Misconfiguration

Agents managing infrastructure via AWS, GCP, or Azure APIs are highly efficient but pose a risk of catastrophic misconfiguration. An agent might accidentally delete a production security group or open an SSH port to the entire internet (0.0.0.0/0).

This blueprint demonstrates how to gate Cloud API Tool Calls using resource-level permissions.

Architecture

1. Master Policy Definition

{
  "name": "cloud-api-safety-policy",
  "priority": 9000,
  "rules": [
    {
      "id": "deny-destructive-cloud-ops",
      "effect": "deny",
      "principals": ["*"],
      "actions": ["cloud:delete_firewall", "cloud:terminate_instance"],
      "resources": ["arn:aws:ec2:*:*:instance/prod-*"]
    },
    {
      "id": "block-wide-firewalls",
      "effect": "deny",
      "principals": ["*"],
      "actions": ["cloud:authorize_ingress"],
      "resources": ["*"],
      "conditions": {
        "cidr": "0.0.0.0/0"
      }
    }
  ]
}

2. Implementation

Python Prototype

import os
from openai import OpenAI

client = OpenAI(
    api_key="ignored",
    base_url="http://cz-gateway:8001/v1",
    default_headers={"X-ControlZero-User-Group": "platform-ops"}
)

def is_policy_denial(content: str | None) -> bool:
    text = content or ""
    denial_signals = ("denied", "policy denial", "blocked")
    return "[Control Zero]" in text and any(signal in text.lower() for signal in denial_signals)

def manage_security_group(action: str, cidr: str):
    try:
        response = client.chat.completions.create(
            model="gpt-5.4",
            messages=[{"role": "user", "content": f"Perform {action} for {cidr}"}],
            tools=[{
                "type": "function",
                "function": {
                    "name": f"cloud:{action}",
                    "parameters": {"type": "object", "properties": {"cidr": {"type": "string"}}}
                }
            }],
            extra_headers={"X-ControlZero-CIDR": cidr} # Propagate for ABAC check
        )
        message = response.choices[0].message
        if is_policy_denial(message.content):
            return f"Governance Block: {message.content}"
        if not message.tool_calls:
            return f"No cloud operation requested: {message.content or 'The model returned no tool call.'}"
        return response
    except Exception as e:
        return f"Gateway request failed: {e}"

# Scenario A: Safe Internal Ingress
print(manage_security_group("authorize_ingress", "10.0.0.0/8")) # ALLOWED

# Scenario B: Critical Security Risk (Internet-wide Ingress)
print(manage_security_group("authorize_ingress", "0.0.0.0/0")) # Verify branded inline policy denial

3. Validation Checklist

• Resource Isolation: Verify that an agent can manage dev instances but is blocked from prod instances.
• Condition Check: Verify that adding a wide CIDR range triggers the block-wide-firewalls rule.
• Denial Signal: Verify that a blocked call returns the branded [Control Zero] policy-denial message; a missing tool call alone is not a denial.
• IAM Mapping: Ensure that the platform-ops group in Control Zero matches your internal IdP.