Discovering and using application deployment dependencies to augment governance and compliance policy
A compliance discovery and integration process is implemented in association with a cloud-based security and compliance platform and associated CI/CD framework. The process assumes an existing DevOps-based deployment of a product, such as an enterprise application that executes in a runtime production environment. The technique of this disclosure addresses the problem of misalignment between a compliance policy and the product's post-deployment regulation posture by providing tools and methods that enable pro-active augmentation of governance and compliance policy during the pre-deployment phase and with respect to a next deployment of the product (e.g., a next or updated version). Thus, when the product is later deployed in its next deployment, its regulation posture (post-deployment) is already consistent with the compliance policy.
1. A method for continuous integration and deployment (CI/CD) in association with an enterprise application in a computing environment, comprising:
in association with a sequence of automated stages comprising a CI/CD pipeline, and prior to a next deployment of the enterprise application, the enterprise application comprising code that passes through the sequence of automated stages during its development:
discovering one or more software supply chain artifacts associated with the pipeline;
for at least one software supply chain artifact, discovering one or more tasks responsible for handling the software supply chain artifact, together with any associated dependencies;
retrieving a compliance policy associated with a development side of the computing environment;
registering the discovered software supply chain artifact, the one or more tasks, and the one or more associated dependencies with the compliance policy; and
within the development side of the computing environment, and based on at least one of the discovered software supply chain artifact, the one more tasks, and the one or more associated dependencies, updating one or more values associated with one or more policy check parameters associated with the compliance policy, wherein the one or more values associated with one or more policy check parameters are updated in an automated manner using pre-defined or pre-configured values; and
thereafter, deploying the enterprise application in a production environment.
2. The method as described in claim 1 wherein discovering the one or more software supply chain artifacts includes identifying one or more runtime monitoring artifacts.
3. The method as described in claim 2 wherein the one or more runtime monitoring artifacts include one of: properties, parameters, vulnerabilities, codes and lists.
4. The method as described in claim 1 wherein at least one associated dependency is associated with an Application Programming Interface (API)-named data model.
5. The method as described in claim 1 wherein the one or more values associated with one or more policy check parameters are updated responsive to receipt of values identified by compliance personnel within a compliance side of the computing environment, the compliance side being distinct from the development side.
6. The method as described in claim 1 wherein at least one discovery operation is recursive.
7. The method as described in claim 1 wherein the software supply chain artifact is a Software Development Kit (SDK) artifact, the SDK enabling direct changes to the computing environment.
8. The method as described in claim 1 further including validating that the enterprise application is compliant with the compliance policy as updated prior to deployment of the enterprise application in the production environment.
9. Apparatus, comprising:
at least one hardware processor;
computer memory holding computer program instructions executed by the at least one hardware processor for continuous integration and deployment (CI/CD) in association with an enterprise application in a computing environment, the computer program instructions comprising program code configured in association with a sequence of automated stages comprising a CI/CD pipeline to:
prior to a next deployment of the enterprise application, the enterprise application comprising code that passes through the sequence of automated stages during its development:
discover one or more software supply chain artifacts associated with the pipeline;
for at least one software supply chain artifact, discover one or more tasks responsible for handling the runtime artifact, together with any associated dependencies;
retrieve a compliance policy associated with a development side of the computing environment;
register the discovered software supply chain artifact, the one or more tasks, and the one or more associated dependencies with the compliance policy; and
within the development side of the computing environment, and based on at least one of: the discovered software supply chain artifact, the one more tasks, and the one or more associated dependencies, update one or more values associated with one or more policy check parameters associated with the compliance policy, wherein the one or more values associated with one or more policy check parameters are updated in an automated manner using pre-defined or pre-configured values; and
thereafter, deploy the enterprise application in a production environment.
10. The apparatus as described in claim 9 wherein the program code configured to discover the one or more software supply chain artifacts includes program code to identify one or more runtime monitoring artifacts.
11. The apparatus as described in claim 10 wherein the one or more runtime monitoring artifacts include one of: properties, parameters, vulnerabilities, codes and lists.
12. The apparatus as described in claim 9 wherein at least one associated dependency is associated with an Application Programming Interface (API)-named data model.
13. The apparatus as described in claim 9 wherein the one or more values associated with one or more policy check parameters are updated responsive to receipt of values identified by compliance personnel within a compliance side of the computing environment, the compliance side being distinct from the development side.
14. The apparatus as described in claim 9 wherein at least one discovery operation is recursive.
15. The apparatus as described in claim 9 wherein the program code is further configured to validate that the enterprise application is compliant with the compliance policy as updated prior to deployment of the enterprise application in the production environment.
16. A computer program product in a non-transitory computer-readable medium for use in a data processing system, the computer program product holding computer program instructions executed by the data processing system for continuous integration and deployment (CI/CD) in association with an enterprise application in a computing environment, the computer program instructions comprising program code configured in association with a sequence of automated stages comprising a CI/CD pipeline to:
prior to a next deployment of the enterprise application, the enterprise application comprising code that passes through the sequence of automated stages during its development:
discover one or more software supply chain artifacts associated with the pipeline;
for at least one software supply chain artifact, discover one or more tasks responsible for handling the software supply chain artifact, together with any associated dependencies;
retrieve a compliance policy associated with a development side of the computing environment;
register the discovered software supply chain artifact, the one or more tasks, and the one or more associated dependencies with the compliance policy; and
within the development side of the computing environment, and based on at least one of the discovered software supply chain artifact, the one more tasks, and the one or more associated dependencies, update one or more values associated with one or more policy check parameters associated with the compliance policy, wherein the one or more values associated with one or more policy check parameters are updated in an automated manner using pre-defined or pre-configured values; and
thereafter, deploy the enterprise application in a production environment.
17. The computer program product as described in claim 16 wherein the program code configured to discover the one or more software supply chain artifacts includes program code to identify one or more runtime monitoring artifacts.
18. The computer program product as described in claim 17 wherein the one or more runtime monitoring artifacts include one of: properties, parameters, vulnerabilities, codes and lists.
19. The computer program product as described in claim 16 wherein at least one associated dependency is associated with an Application Programming Interface (API)-named data model.
20. The computer program product as described in claim 16 wherein the one or more values associated with one or more policy check parameters are updated responsive to receipt of values identified by compliance personnel within a compliance side of the computing environment, the compliance side being distinct from the development side.
21. The computer program product as described in claim 16 wherein at least one discovery operation is recursive.
22. The computer program product as described in claim 16 wherein the program code is further configured to validate that the enterprise application is compliant with the compliance policy as updated prior to deployment of the enterprise application in the production environment.