> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AI-Powered Recommendations in InfraAudit

> How InfraAudit uses Google Gemini to generate remediation steps, savings estimates, and risk scores — plus the rule-based fallback for offline deployments.

InfraAudit generates recommendations for cost savings, security hardening, and compliance fixes. When a Gemini API key is configured, it uses `gemini-2.5-pro` to produce context-specific recommendations for each finding. Without a key, a rule-based engine runs instead — no API dependency, no rate limits.

## Gemini integration

When `GEMINI_API_KEY` is set in your environment, InfraAudit sends a structured prompt to Gemini for each new finding. The prompt includes:

* The finding type (drift, vulnerability, cost anomaly, or compliance failure)
* The severity and description of what was detected
* The affected resource type and its key configuration attributes
* The cloud provider and region
* Relevant compliance framework context, if applicable

Gemini returns a structured recommendation that includes:

* A plain-language explanation of why the finding matters
* Step-by-step remediation instructions specific to the resource
* Estimated monthly savings (for cost recommendations)
* Estimated risk reduction score (for security recommendations)

The model runs with `temperature=0` to produce deterministic, factual output.

<Info>
  Finding details — including resource configuration attributes, CVE IDs, and cost figures — are sent to the Gemini API. If your organization's security policy prohibits sending infrastructure details to external APIs, use the rule-based fallback by not setting `GEMINI_API_KEY`.
</Info>

## Rule-based fallback

When `GEMINI_API_KEY` is not set, InfraAudit's internal rule engine matches each finding against a library of pre-written recommendation templates. The rule engine covers:

* Top 50 most common S3 misconfigurations
* EC2 security group over-permission patterns
* IAM key age and usage recommendations
* RDS backup and encryption gaps
* Cost optimization rules: right-sizing, idle resources, Reserved Instance recommendations
* CIS Benchmark remediation steps

Rule-based recommendations are less context-specific than Gemini's but remain actionable. This mode is well-suited for air-gapped or high-volume deployments.

## Recommendation types

| Type        | Source data                              | Output                                     |
| ----------- | ---------------------------------------- | ------------------------------------------ |
| Cost        | Billing data, usage metrics              | Savings amount, resource to act on         |
| Security    | Drift, vulnerability, compliance finding | Risk description, step-by-step remediation |
| Performance | Resource utilization data                | Scaling or configuration adjustment        |

## When recommendations are generated

Recommendations are generated automatically and on demand:

* **Automatically** — after a drift scan, vulnerability scan, or compliance assessment, InfraAudit queues recommendation generation for any new findings above the severity threshold.
* **On demand** — from the resource detail panel, or via the CLI:

```bash theme={null}
# Generate a recommendation for a specific resource
infraudit recommendation generate --resource <resource-id>

# Generate recommendations for all findings in a compliance assessment
infraudit recommendation generate --assessment <assessment-id>
```

## Recommendation lifecycle

Each recommendation moves through three states:

```
pending → applied / dismissed
```

* **Pending** — generated, not yet acted on
* **Applied** — the recommended fix was applied, either manually or via automated remediation
* **Dismissed** — the recommendation was intentionally skipped, with an optional reason recorded

## Rate limiting and cost

Gemini API calls are rate-limited by Google. InfraAudit uses an internal queue and backs off exponentially on `429 Too Many Requests` responses. For large assessments (100+ findings), allow a few minutes for all recommendations to generate.

Each recommendation request uses approximately 1,000–3,000 tokens. At current Gemini pricing, this is roughly $0.001–$0.003 per recommendation. For typical usage of 50 new findings per day, monthly Gemini costs are under \$5.