Infrastructure as code pre-deployment compliance testing
A unified cloud configuration evaluation (UCCE) system is described capable of evaluating both asset configurations in a live cloud environment and proposed configuration changes produced by a cloud configuration development (CCD) system. In embodiments, the UCCE system may be implemented as a Cloud Security Posture Management (CPSM) system that monitors assets in the cloud environment and check the assets' configurations for compliance with a set of compliance rules. In embodiments, the UCCE system ingests a cloud configuration definition generated by the CCD system. In embodiments, the CCD system is implemented as an Infrastructure as Code (IaC) system that allows a user to create a cloud configuration definition that describes proposed configuration changes to the cloud environment. The UCCE system is configured to interpret the cloud configuration definition and analyze the proposed configuration changes for compliance using the same set of compliance rules used for the live cloud environment.
1. A system comprising:
one or more computer devices configured to implement a unified cloud configuration evaluation (UCCE) system; and
one or more non-transitory computer-readable storage media storing executable instructions that, when executed by the one or more computer devices cause the one or more computer devices to:
obtain, from a cloud computing infrastructure provider service, live asset configuration data about assets in a cloud environment hosted by the cloud computing infrastructure provider service, the live asset configuration data being in a first format associated with the cloud computing infrastructure provider service;
convert the live asset configuration data from the first format to a second format associated with the UCCE system;
generate a first model of the cloud environment using the live asset configuration data in the second format associated with the UCCE system;
obtain a cloud configuration definition created in a cloud configuration development (CCD) system specifying proposed configuration changes to the cloud environment, the cloud configuration definition being in a third format associated with the CCD system;
convert the cloud configuration definition from the third format associated with the CCD system to the second format associated with the UCCE system;
generate a second model reflecting the proposed configuration changes using the cloud configuration definition in the second format associated with the UCCE system; and
evaluate compliance of the live asset configuration data and the proposed configuration changes using a set of compliance rules by:
evaluating compliance of the live asset configuration data by applying the set of compliance rules to the first model, and
evaluating compliance of the proposed configuration changes by applying the set of compliance rules to the second model.
2. The system of claim 1 , wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to:
determine that the proposed configuration changes comply with the set of compliance rules, and in response, initiate deployment of the proposed configuration changes to the cloud environment.
3. The system of claim 2 , wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to:
initiate the deployment of the proposed configuration changes based on a user approval of the proposed configuration changes.
4. The system of claim 1 , wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to:
update the second model and apply the set of compliance rules to the second model in response to changes made to the cloud configuration definition in the CCD system.
5. The system of claim 1 , wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to:
update the second model and apply the set of compliance rules to the second model in response to receiving a request from the CCD system to evaluate compliance of the proposed configuration changes.
6. The system of claim 1 , wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to:
receive the live asset configuration data from the cloud computing infrastructure provider service over a network.
7. The system of claim 1 , wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to:
obtain additional live asset configuration data about assets in the cloud environment from the cloud computing infrastructure provider service; and
convert the additional live asset configuration data from the first format to the second format;
wherein generating the first model comprises updating the first model of the cloud environment using the additional live asset configuration data in the second format.
8. The system of claim 1 , wherein:
the first format is a provider-specific format specific to the cloud computing infrastructure provider service; and
the third format is a definition language specific to the CCD system.
9. The system of claim 1 , wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to:
store the first model and the second model in a model database.
10. The system of claim 1 , wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to:
determine that the cloud configuration definition contains a reference refers to an existing asset in the cloud environment;
retrieve configuration data about the referenced asset from the first model; and
combine the retrieved configuration data with the cloud configuration definition to update the second model.
11. The system of claim 10 , wherein retrieving the configuration data about the referenced asset from the first model comprises:
identifying the referenced asset in the first model using an identifier of the referenced asset indicated in the cloud configuration definition.
12. The system of claim 10 , wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to:
automatically update the second model in response to changes to the referenced asset in the cloud environment.
13. The system of claim 1 , wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to:
check for security vulnerabilities in the cloud environment using the first model.
14. A method comprising:
using one or more computer devices, which are configured to implement a unified cloud configuration evaluation (UCCE) system, to perform:
obtaining, from a cloud computing infrastructure provider service, live asset configuration data about assets in a cloud environment hosted by the cloud based cloud computing infrastructure provider service, the live asset configuration data being in a first format associated with the cloud computing infrastructure provider service;
converting the live asset configuration data from the first format to a second format associated with the UCCE system;
generating a first model of the cloud environment using the live asset configuration data in the second format associated with the UCCE system;
obtaining a cloud configuration definition created in a cloud configuration development (CCD) system specifying proposed configuration changes to the cloud environment, the cloud configuration definition being in a third format associated with the CCD system;
converting the cloud configuration definition from the third format associated with the CCD system to the second format associated with the UCCE system;
generating a second model reflecting the proposed configuration changes using the cloud configuration definition in the second format associated with the UCCE system; and
evaluating compliance of the live asset configuration data and the proposed configuration changes using a set of compliance rules by:
evaluating compliance of the live asset configuration data by applying the set of compliance rules to the first model, and
evaluating compliance of the proposed configuration changes by applying the set of compliance rules to the second model.
15. The method of claim 14 , wherein the UCCE system is further configured to perform:
determining that the proposed configuration changes comply with the set of compliance rules, and in response, initiating deployment of the proposed configuration changes to the cloud environment.
16. The method of claim 14 , wherein the UCCE system is further configured to perform:
updating the second model and applying the set of compliance rules to the second model in response to changes made to the cloud configuration definition in the CCD system.
17. The method of claim 14 , wherein the UCCE system is further configured to perform:
updating the second model and applying the set of compliance rules to the second model in response to receiving a request from the CCD system to check evaluate compliance of the proposed configuration changes.
18. The method of claim 14 , wherein:
the first format is a provider-specific format specific to the cloud computing infrastructure provider service; and
the third format is a definition language specific to the CCD system.
19. The method of claim 14 , wherein the UCCE system is further configured to perform:
determining that the cloud configuration definition contains a reference to an existing asset in the cloud environment;
retrieving configuration data about the referenced asset from the first model; and
combining the retrieved configuration data with the cloud configuration definition to update the second model.
20. One or more non-transitory computer-readable storage media storing program instructions that when executed on one or more processors implement a unified cloud configuration evaluation (UCCE) system and cause the UCCE system to perform:
obtaining, from a cloud computing infrastructure provider service, live asset configuration data about assets in a cloud environment hosted by the cloud computing infrastructure provider service, the live asset configuration data being in a first format associated with the cloud computing infrastructure provider service;
converting the live asset configuration data from the first format to a second format associated with the UCCE system;
generating a first model of the cloud environment using the live asset configuration data in the second format associated with the UCCE system;
obtaining a cloud configuration definition created in a cloud configuration development (CCD) system specifying proposed configuration changes to the cloud environment, the cloud configuration definition being in a third format associated with the CCD system;
converting the cloud configuration definition from the third format associated with the CCD system to the second format associated with the UCCE system;
generating a second model reflecting the proposed configuration changes using the cloud configuration definition in the second format associated with the UCCE system; and
evaluating compliance of the live asset configuration data and the proposed configuration changes using a set of compliance rules by:
evaluating compliance of the live asset configuration data by applying the set of compliance rules to the first model, and
evaluating compliance of the proposed configuration changes by applying the set of compliance rules to the second model.