Cloud Operations agent

The Cloud Operations template in the Marketplace reviews your infrastructure code and dependencies. You get back a fix list sorted by severity: what’s exposed, what’s vulnerable and what’s costing more than it should, with the exact line and the fix. It can also open a ticket for each critical or high finding, so the work lands with your team.

What it checks

Area	It flags
Security	Admin ports (SSH, RDP, database ports) open to the whole internet · databases reachable from the internet · public storage buckets · passwords and keys written in the code · storage not encrypted at rest
Reliability	Automated backups off · deletion protection off · databases deleted without a final snapshot
Cost	Previous-generation server types · older gp2 disks (gp3 is about 20% cheaper) · very large server sizes worth checking
Vulnerabilities (CVEs)	Packages in `requirements.txt` and `package.json` with known vulnerabilities, from the public OSV database, with the version that fixes each one

It reads Terraform files (.tf) and YAML or JSON infrastructure templates. Vulnerabilities can only be checked for exactly pinned versions (flask==2.0.1, "lodash": "4.17.20").

1. Add your tools

The agent reads your code through a Developer tool (required) and opens tickets through a Ticketing tool (optional). Add both in Tools → Add tool, in the region you’ll install the agent in.

GitHub (Developer)

Pick the GitHub quick start. The base URL is https://api.github.com.
Credential: API key, in a Header, named Authorization, with the prefix Bearer. Use a fine-grained token limited to your infrastructure repository, with Contents: Read. Add Issues: Read and write if you want issues opened there.
Paste this under OpenAPI schema. It gives the agent exactly three operations: list files, read a file, and open an issue.

{
  "openapi": "3.0.0",
  "info": { "title": "GitHub", "version": "1" },
  "servers": [{ "url": "https://api.github.com" }],
  "paths": {
    "/repos/{owner}/{repo}/git/trees/{branch}": {
      "get": {
        "operationId": "listFiles",
        "summary": "List every file in a repository branch",
        "parameters": [
          { "name": "owner", "in": "path", "required": true, "schema": { "type": "string" } },
          { "name": "repo", "in": "path", "required": true, "schema": { "type": "string" } },
          { "name": "branch", "in": "path", "required": true, "schema": { "type": "string" } },
          { "name": "recursive", "in": "query", "required": true, "schema": { "type": "string", "enum": ["1"] } }
        ],
        "responses": { "200": { "description": "The file tree" } }
      }
    },
    "/repos/{owner}/{repo}/git/blobs/{sha}": {
      "get": {
        "operationId": "readFile",
        "summary": "Read one file by the sha listFiles gave it (its content is base64-encoded)",
        "parameters": [
          { "name": "owner", "in": "path", "required": true, "schema": { "type": "string" } },
          { "name": "repo", "in": "path", "required": true, "schema": { "type": "string" } },
          { "name": "sha", "in": "path", "required": true, "schema": { "type": "string" } }
        ],
        "responses": { "200": { "description": "The file" } }
      }
    },
    "/repos/{owner}/{repo}/issues": {
      "post": {
        "operationId": "createIssue",
        "summary": "Open an issue",
        "parameters": [
          { "name": "owner", "in": "path", "required": true, "schema": { "type": "string" } },
          { "name": "repo", "in": "path", "required": true, "schema": { "type": "string" } }
        ],
        "requestBody": {
          "required": true,
          "content": { "application/json": { "schema": { "type": "object", "required": ["title"], "properties": { "title": { "type": "string" }, "body": { "type": "string" } } } } }
        },
        "responses": { "201": { "description": "The issue" } }
      }
    }
  }
}

Jira (Ticketing, optional)

Pick the Jira quick start, with your own address (https://your-company.atlassian.net).
Credential: API key, in a Header, named Authorization, with the prefix Basic. The value is your-email:your-api-token encoded in base64. Create the token at id.atlassian.com.
Paste this under OpenAPI schema, with your address in servers:

{
  "openapi": "3.0.0",
  "info": { "title": "Jira", "version": "1" },
  "servers": [{ "url": "https://your-company.atlassian.net" }],
  "paths": {
    "/rest/api/3/search/jql": {
      "get": {
        "operationId": "searchTickets",
        "summary": "Find tickets with a JQL query, e.g. project = OPS AND statusCategory != Done",
        "parameters": [
          { "name": "jql", "in": "query", "required": true, "schema": { "type": "string" } },
          { "name": "fields", "in": "query", "required": false, "schema": { "type": "string", "default": "summary,status" } }
        ],
        "responses": { "200": { "description": "Matching tickets" } }
      }
    },
    "/rest/api/2/issue": {
      "post": {
        "operationId": "createTicket",
        "summary": "Open a ticket",
        "requestBody": {
          "required": true,
          "content": { "application/json": { "schema": { "type": "object", "properties": { "fields": { "type": "object", "properties": {
            "project": { "type": "object", "properties": { "key": { "type": "string" } } },
            "issuetype": { "type": "object", "properties": { "name": { "type": "string" } } },
            "summary": { "type": "string" },
            "description": { "type": "string" }
          } } } } } }
        },
        "responses": { "201": { "description": "The ticket" } }
      }
    }
  }
}

2. Install

Open Marketplace → Cloud Operations → Install. Pick your GitHub tool for the repository slot and your Jira tool for the ticketing slot. The agent is deployed once, with both attached. More on installing.

3. Ask it

From the agent’s page, tell it where to look:

Review the main branch of acme/infrastructure. Check every Terraform file and every requirements.txt and package.json.

You get a count of findings by severity, a table of each one (file and line, resource, problem, fix), the vulnerable packages with the version that fixes them, and Do first: the top three actions and why each matters.

To have tickets opened, say so and name the project:

…and open a Jira ticket in project OPS (type Task) for each critical or high finding.

It looks for an open ticket with the same title first, so running it again doesn’t create duplicates.

4. Add a policy

In Policies → New policy, under Things the agent must never do with its tools, add for example:

Merge pull requests
Delete repositories, branches or files
Close or delete tickets

Then pick the policy on the agent. If you gave the token write access to issues only, it already can’t change code. The policy makes that explicit, and it covers any tool you attach later.

5. Run it every week

On the agent’s page → Schedules & webhooks → + Schedule:

Ask: Review the main branch of acme/infrastructure and open a Jira ticket in project OPS for each new critical or high finding.
When: 0 7 * * 0 (Sundays at 07:00), timezone Asia/Riyadh.

Your team then starts each week with a short, deduplicated fix list. You can also add a webhook and call it from your CI after each merge to the main branch.

Good to know

It reviews code, not your live cloud account. If something was changed by hand outside the code, it won’t see it.
Each run is an ordinary request and uses credits. A large repository means more files read, and so more credits. Point it at the folders that matter (“only the prod/ folder”).
It’s your agent now. Open Edit to add your own rules to its code, change its instructions or pick a stronger model for large reviews. Updates to the Marketplace template don’t change an agent you’ve already installed.