Update README.md

Author: alyssaa

README.md

@@ -8,7 +8,19 @@ You can contact the Salesforce GSoC team at [email protected] or by openin
 ### Cloudsplaining – [salesforce/cloudsplaining](https://github.com/salesforce/cloudsplaining) ###
 This project is open to original proposals from participants.
 
-* Ideas to come
+* **Build a web app that identifies excessive privileges in AWS**: 
+    * Cloudsplaining can scan an AWS account or a single AWS IAM Policy - but it currently does so on command line. We’d like to turn this into a web app so developers can copy/paste their IAM policies, or upload their authorization details file, and see the results in the web app.
+    * This will significantly lower the barrier to entry for identifying excessive privileges in AWS because developers will not have to learn a command-line tool - they will be able to use a web app instead.
+    * This can be developed with a JavaScript framework of choice (React, Vue, Svelte, etc.). 
+    * This web app will be available to the public so anyone can use it. It will not just help Salesforce, it will help the larger security community around the world.
+
+* **Enhance a REST API that provides Cloudsplaining’s IAM scanning capabilities**
+    * Cloudsplaining’s IAM scanning capabilities are currently hosted on a REST API. Enhancing this REST API will allow the web app to be more effective and responsive.
+    * Tech stack includes Python, FastAPI, and AWS Lambda functions. If you are comfortable with Python but not with the rest, the rest can be learned.
+
+* **Build IAM Security scans into CI/CD pipelines for Infrastructure as Code**
+    * Cloudsplaining is currently available as a command-line tool. This opportunity would include building automation using GitHub Actions to scan policies defined in Terraform and return the results on Pull Requests in GitHub.
+
 
 * **Aren't finding what you're interested in?** Look for more ideas at https://github.com/salesforce/cloudsplaining/issues