DEV Community

Mohamed
Mohamed

Posted on

🛡️ RoleFlux: AI Security Gateway Architecture

I Built RoleFlux: An Open-Source, AI-Powered Cloud Detection & Response Platform for GCP

If you've ever worked in a Security Operations Center (SOC) managing a large Google Cloud environment, you know the pain of Audit Log Hell.

Every single administrative action—like a developer granting roles/owner to an external contractor—generates a massive, deeply nested JSON log. Staring at raw JSON all day leads to massive alert fatigue. To solve this, many teams are rushing to build "AI Wrappers" that just dump raw logs into an LLM and ask, "Is this bad?"

This approach is fundamentally flawed. It leads to AI hallucinations, lacks deterministic security rules, and isn't something you can trust in production.

That's why I built RoleFlux.

🛡️ What is RoleFlux?

RoleFlux is an open-source, 100% serverless Cloud Detection & Response (CDR) platform for GCP. It intercepts real-time IAM changes, maps threats to MITRE ATT&CK, and acts as a tireless, AI-powered SOC analyst to deliver human-readable incident reports directly to your Slack.

The Core Philosophy: "Detection Engine First, AI Second"

RoleFlux does NOT use AI as a security boundary. Instead, it follows a strict, production-grade security engineering pipeline:

  1. Deterministic Rules: A Python detection engine first evaluates the log against hardcoded SOC rules (e.g., External Principal + Production Project + Owner Role = CRITICAL).
  2. Risk Scoring & MITRE Mapping: The engine generates a numeric Risk Score (0-100) and maps the event to specific MITRE ATT&CK techniques (e.g., T1098 - Account Manipulation).
  3. AI Investigation: Only then is the structured output passed to Vertex AI (Gemini). The LLM's job is purely to synthesize this structured data into a sharp, 2-sentence executive summary and provide the exact gcloud remediation commands.

☁️ The Cloud-Native Architecture

RoleFlux is built the "Google Way." It uses a highly scalable, decoupled microservice architecture deployed via Terraform:

  • Ingestion: A GCP Log Router Sink filters for critical IAM events and pushes them to a Pub/Sub Topic.
  • The Brains: A Cloud Function (Gen2) pulls the log, runs the deterministic rules, scores the risk, and queries Vertex AI.
  • Data Lake: Structured incident reports are saved to BigQuery for long-term analytics.
  • Alerting: Critical alerts are pushed instantly to a Slack Webhook.

Because it is 100% serverless, it scales automatically to handle massive traffic spikes and scales down to zero when idle—meaning you can run it almost entirely on GCP's Free Tier!

💻 The Command Center & Attack Simulator

To make this a complete platform, I didn't just stop at the backend. RoleFlux includes a premium, dark-themed React/Next.js dashboard that connects directly to BigQuery for real-time threat visualization and triage.

Purple Team Attack Simulator

Want to test it without actually compromising your GCP environment? RoleFlux comes with a Python suite to safely inject realistic, fake GCP Audit Logs into the pipeline to verify your detection rules.

AI Triage & Slack Integration

When a critical incident is detected, the AI analyst generates the exact gcloud commands needed to revoke the compromised access and sends them to Slack.

🚀 Get Started

RoleFlux is completely open-source and ready for you to deploy. It comes with a quick bootstrap script and full Terraform workspaces for staging and production.

Check out the repository, star it if you find it useful, and let me know what detection rules you'd like to see added next!

🔗 View RoleFlux on GitHub

© 2026 Mohamed Medjahdi. All rights reserved.

Connect with me:

Top comments (0)