From Security Findings to Verified Fixes: Automated Repair of Infrastructure-as-Code Misconfigurations

Abstract

Traditional Infrastructure as Code misconfiguration remediation requires manual analysis, a labor-intensive approach that cannot meet the scale and speed demands of modern cloud deployments. We present IacFix, an agentic tool that combines LLM-based agents with formal methods to enable automated IaC security remediation from security findings to validated patches. IacFix introduces end-to-end remediation capabilities across CDK and CloudFormation packages, leveraging historical fix patterns and iterative refinement to produce validated patches for complex misconfigurations. For example, IacFix achieves 80.9% end-to-end success rate with 97.7% fault localization precision and 7.12 minutes average processing time, demonstrating comparable effectiveness to manual fixes while delivering automated solutions significantly faster. Notably, IacFix outperforms LLM-only baselines by 45 percentage points in real-world scenarios such as dangling hostclass remediation. The system exhibits one-sided error: it either produces a validated patch or safely declines to patch, ensuring that no incorrect patch is surfaced to developers. Our approach shows promising potential for addressing diverse misconfiguration types at scale.