AI FedRAMP compliance on AWS
Vesta AI
An AI platform that inspects an AWS environment and writes the FedRAMP compliance documentation for it, turning months of manual evidence-gathering into a guided, repeatable process.
- Pages of documentation generated
- ~900
- Access to AWS
- Read-only
- What we built
- Compliance web appEvidence engineAssessment agent
The problem
To sell cloud services to the US government, a company needs FedRAMP authorisation, and that means a System Security Plan that can run to around 900 pages. Writing it by hand takes a team months: gathering evidence from every account and service, mapping it to hundreds of controls and keeping it all accurate as the infrastructure changes.
What we built
Secure posture connects to the customer's AWS accounts through a read-only, assumed role with the SecurityAudit policy. It pulls configuration evidence from IAM, EC2, VPC, S3, RDS and more, and normalises it into compliance objects in PostgreSQL.
An assessment agent built with LangGraph then works through each FedRAMP control, using tools to fetch exactly the evidence it needs, and writes the SSP narrative in the format FedRAMP expects. Gaps are flagged, documents are exported to Word and Excel, and long jobs run in the background so a full package can be regenerated whenever the environment changes. A web app manages organisations, assessments and reviews.
Key features
- 01Read-only AWS access through AssumeRole with the SecurityAudit policy
- 02Evidence collection across IAM, EC2, VPC, S3, RDS and more
- 03Normalisation of raw configuration into compliance objects
- 04Control-by-control SSP narratives written by an assessment agent
- 05Agent tools that fetch only the evidence each control needs
- 06Gap detection and pinpointed findings for remediation
- 07Export to Word and Excel in FedRAMP's formats
- 08Background jobs so full packages can be regenerated as infrastructure changes
Tech stack
- AI
- OpenAILangGraphLangChainLlamaIndexpgvector
- Backend
- PythonFastAPIDjango REST FrameworkCeleryRedisPostgreSQL
- Cloud
- AWSboto3IAM AssumeRole
- Web
- Next.jsReactMaterial UIRedux Toolkit
- Documents
- python-docxopenpyxlReportLab
- Platform
- DockerRailway
Results
- Documentation that took a team months is drafted in a fraction of the time.
- Every narrative is grounded in evidence pulled from the live environment.
- Packages can be regenerated whenever the infrastructure changes.
Next project
AI medical records consultant
Free, no obligation
Have something similar in mind?
Book a free consultation and we'll conduct a meeting to talk it through, or start with a free audit. No obligation either way.