Policy-as-Code Framework for Automated Security and Compliance Enforcement in Cloud-Native Infrastructure
Main Article Content
Abstract
Cloud-native infrastructure heavily depends on Infrastructure as Code (IaC), orchestration of containers, and continuous integration and continuous deployment (CI/CD) pipelines. Whereas the tool of a static analysis can indicate the existence of insecure Terraform setup and Kubernetes manifest, the violation may not necessitate the halt of corresponding infrastructure modification to be deployed into production. The paper has given a proposal of a context-sensitive Policy-as-Code (PaC) infrastructure, which integrates configuration analysis, declaration-based policy analysis, contextualized risk analysis and serviceable deployment choices into a single homogenous security control layer. Such properties considered by the framework as security-relevant are excessive identity and access management (IAM) permissions, public storage exposure, unlimited network ingress, lack of encryption, exposure of secrets, privileged containers and unsafe Kubernetes workload configuration. It is based on Open Policy Agent (OPA) and Rego as the policy evaluation layer and CI/CD gates and Kubernetes admission control as the enforcement limits of chaperoning. The policy decisions consist of allow, warn, must have and block the environment sensitivity, exception validity, resource criticality and compensating controls feature as part of the decision-making process. The test plan contains a repeatable test suite, the secure and insecure Terraform and Kubernetes updates, test tiers, the metrics of detection rates, the metrics of the enforcement level, the metrics of false blocks, the metrics of missed insecure deployments, the metrics of policy coverage, the metrics of pipeline overhead. The main contribution is high-quality auditable enforcement model which delineates violation identification and delivery-authorizing deployment decisions and reproducible policy decisions across delivery phases. Empirical performance assertions require that the specified benchmark be run and, therefore, this manuscript subconsciously differentiates the suggested design and assessment plan and experimentally supported findings.
Article Details
Section
How to Cite
References
[1] Verdet, A., Hamdaqa, M., Da Silva, L., & Khomh, F. (2023). Exploring security practices in infrastructure as code: An empirical study. arXiv preprint. https://doi.org/10.48550/arXiv.2308.03952
[2] Piskachev, G., Becker, M., & Bodden, E. (2023). Can the configuration of static analyses make resolving security vulnerabilities more effective? A user study. Empirical Software Engineering, 28, Article 118. https://doi.org/10.1007/s10664-023-10354-3
[3] Ntentos, E., Lueger, N. E., Simhandl, G., Zdun, U., Schneider, S., Scandariato, R., & Díaz Ferreyra, N. E. (2024). On the understandability of design-level security practices in infrastructure-as-code scripts and deployment architectures. ACM Transactions on Software Engineering and Methodology, 34(1), Article 12. https://doi.org/10.1145/3691630
[4] Chandramouli, R. (2022). Implementation of DevSecOps for a microservices-based application with service mesh (NIST Special Publication 800-204C). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-204C
[5] Rahman, A., & Williams, L. (2016). Software security in DevOps: Synthesizing practitioners' perceptions and practices. In Proceedings of the IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (pp. 289–298). https://doi.org/10.1145/2889160.2889237
[6] Jarraya, Y., Pourzandi, M., & Wang, L. (2022). ProSPEC: Proactive security policy enforcement for containers. In Proceedings of the 12th ACM Conference on Data and Application Security and Privacy (pp. 155–166). ACM. https://doi.org/10.1145/3508398.3511515
[7] Cito, J., & Leitner, P. (2017). An empirical analysis of the Docker container ecosystem on GitHub. In Proceedings of the 14th International Conference on Mining Software Repositories (pp. 323–333). IEEE. https://doi.org/10.1109/MSR.2017.38
[8] Rahman, A., Helms, E., Williams, L., & Parnin, C. (2019). Synthesizing continuous integration and continuous deployment practices and challenges. Journal of Systems and Software, 155, 1–17. https://doi.org/10.1016/j.jss.2019.04.032
[9] Dalla Palma, S., Di Nucci, D., Palomba, F., & Di Penta, M. (2023). Through the looking-glass: An empirical study on blob infrastructure blueprints in the Topology and Orchestration Specification for Cloud Applications. Journal of Software: Evolution and Process, 36(4), Article e2533. https://doi.org/10.1002/smr.2533
[10] Kumara, I., & Dam, H. K. (2022). Towards automated identification of infrastructure-as-code security smells. In Proceedings of the Australasian Software Engineering Conference (ASWEC). IEEE. https://doi.org/10.1109/ASWEC56330.2022.00017
[11] Jiang, Y., & Adams, B. (2022). What goes around comes around: An empirical study of DevOps code smells and refactoring in Terraform scripts. In Proceedings of the IEEE International Conference on Software Maintenance and Evolution (ICSME). https://doi.org/10.1109/ICSME55013.2022.00035
[12] Hoorn, D., & Jansen, S. (2022). Policy-as-code: Governance, automation, and compliance in cloud-native applications. Software Quality Journal, 30, 895–921. https://doi.org/10.1007/s11219-022-09590-0
[13] Shah, R., & Dubash, P. (2022). Securing continuous deployment pipelines with automated policy checks. In Proceedings of the International Conference on Cloud Computing and Security (pp. 112–125). Springer. https://doi.org/10.1007/978-3-031-16812-3_9
[14] Ebert, C., Gallardo, G., Hernantes, J., & Serrano, N. (2016). DevOps. IEEE Software, 33(3), 94–100. https://doi.org/10.1109/MS.2016.68
[15] Shamim, M. S. I. (2021). Mitigating security attacks in Kubernetes manifests for security best practices violation. In Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering (pp. 1475–1479). ACM. https://doi.org/10.1145/3468264.3473495
[16] Pîrvulescu, C., & Iordache, D. (2022). Cloud-native security automation using GitOps and policy enforcement. Journal of Information Systems & Operations Management, 16(2), 45–58.
[17] Supit, C. A., Pangeran, A. A., Laban, K. O. C., & Ramadhan, A. (2023). Incorporating cloud native architecture and DevOps culture to improve company agility. In 2023 3rd International Conference on Intelligent Cybernetics Technology & Applications. IEEE. https://doi.org/10.1109/ICICyTA60173.2023.10428951
[18] Rahman, A., & Williams, L. (2022). Characterizing security smells in infrastructure as code scripts. IEEE Transactions on Software Engineering, 48(10), 4032–4048. https://doi.org/10.1109/TSE.2021.3113524