ControlMonkey today added artificial intelligence (AI) agents to its infrastructure automation platform that promise to make it simpler for almost any developer to securely provision infrastructure as code (IaC).
Company CEO Aharon Twizer said this KoMo AI extension to the ControlMonkey platform will eliminate a skills gap that often conspires to slow the pace at which applications can be built and deployed.
At its core, the ControlMonkey platform automates the management of code created using IaC tools based on open-source Terraform software. The KoMo AI agents now extend that capability to enable AI agents to create code using data vetted by ControlMonkey to ensure the output is both secure by design and complies with any number of regulatory mandates, said Twizer.
Those AI agents are also more context aware because they have access to all the code that resides in the IaC repository provided by ControlMonkey, he added. Rather than generating generic Terraform code, that capability ensures that all the policies and guardrails that a DevOps team needs to enforce are consistently applied as code, noted Twizer.
Additionally, KoMo AI can be used to explain how Terraform code was constructed in human-readable language in addition to tracing dependencies, module usage and identifying misconfiguration risks. Going forward, ControlMonkey intends to keep adding multiple types of AI agents of varying size and capability to automate tasks, said Twizer.
The ControlMonkey platform is based on multiple types of deterministic and generative artificial intelligence (AI) technologies that generate Terraform code that is tailored for specific cloud computing environments, said Twizer. That approach not only reduces the amount of time application developers spend on configuring cloud infrastructure; it also improves the quality of the code being used in a way that also eliminates much of the undifferentiated heavy lifting that developers needed to manually perform, he added. In effect, any IaC skills gap that might exist in an organization is effectively eliminated, said Twizer.
It’s not clear how aggressively DevOps teams are looking to centralize the management of provisioning on cloud infrastructure. However, many application developers, in the name of expediency, assumed responsibility for it, as part of an effort to accelerate the pace at which applications are built and deployed. Unfortunately, application developers have limited cybersecurity expertise, so misconfiguration of cloud infrastructure services is now rampant. In fact, cybercriminals are now generally very adept at discovering misconfigurations they now know well how to exploit.
Rather than requiring application developers to hopefully write better Terraform code on their own, ControlMonkey is making a case for a platform that has been trained using best practices to consistently generate more reliable IaC code.
Each IT team, of course, will need to determine what level of automation to apply to the management of IT infrastructure. However, as the number of incidents involving issues stemming from the use of IaC tools steadily increases, the longer it takes to address them the bigger the potential blast radius of any given IT incident is likely to be.
