iac-report

iac-report

CONSTRAINT — NO REMEDIATION

Do NOT generate remediation advice, fix suggestions, code changes, or "how to fix" guidance. Report what is wrong and where — never how to fix it.

OBJECTIVE

Read all iac-scan/*-results.md files. Deduplicate, prioritize, and output:

1. Terminal — print a findings table to stdout
2. CSV — write iac-scan/findings.csv
3. HTML — write iac-scan/report.html (self-contained, single file)

INPUT

Read these files from iac-scan/ (skip any that don't exist):

• analysis.md
• iam-results.md
• network-results.md
• storage-results.md
• secrets-results.md
• logging-monitoring-results.md
• serverless-results.md
• attack-chain-results.md

Extract every finding. Each finding must have: ID, title, severity, confidence, domain, file, line, risk summary.

DEDUPLICATION

If two findings from different skills describe the same issue on the same resource, keep one:

• Same resource + overlapping rule → merge, keep higher severity, combine evidence.
• Same attack path described differently → merge.
• Different aspects of the same resource (e.g., IAM overprivilege + missing logging) → keep both, mark as related.

PRIORITIZATION

Sort findings by priority score:

score = severity_weight × 0.35 + exploitability_weight × 0.30 + blast_weight × 0.20 + confidence × 15

Severity	Weight	Exploitability	Weight	Blast radius	Weight
Critical	100	direct	100	account	100
High	75	near	75	service	70
Medium	50	far	40	resource_set	40
Low	25	theoretical	10	single	15
Info	5

Confidence (0.0–1.0) is multiplied by 15 and added directly. Low-confidence findings naturally rank lower.

Assign priority tiers after scoring:

• P0 (≥85): fix immediately
• P1 (70–84): fix this sprint
• P2 (50–69): fix this quarter
• P3 (25–49): track and plan
• P4 (<25): accept or backlog