Infrastructure as code predeployment compliance testing
A unified cloud configuration evaluation (UCCE) system is described capable of evaluating both asset configurations in a live cloud environment and proposed configuration changes produced by a cloud configuration development (CCD) system. In embodiments, the UCCE system may be implemented as a Cloud Security Posture Management (CPSM) system that monitors assets in the cloud environment and check the assets' configurations for compliance with a set of compliance rules. In embodiments, the UCCE system ingests a cloud configuration definition generated by the CCD system. In embodiments, the CCD system is implemented as an Infrastructure as Code (IaC) system that allows a user to create a cloud configuration definition that describes proposed configuration changes to the cloud environment. The UCCE system is configured to interpret the cloud configuration definition and analyze the proposed configuration changes for compliance using the same set of compliance rules used for the live cloud environment.
1. A system, comprising:
at least one computer device configured to implement a unified cloud configuration evaluation (UCCE) system; and
at least one non-transitory computer-readable storage medium storing executable instructions that, when executed, cause the at least one computer device to perform:
obtaining, in a first format, live asset configuration data about assets in a cloud environment;
converting the live asset configuration data from the first format to a second format associated with the UCCE system;
obtaining, in a third format, a cloud configuration definition specifying proposed configuration changes to the cloud environment;
converting the cloud configuration definition from the third format to the second format associated with the UCCE system; and
evaluating compliance of the live asset configuration data and the proposed configuration changes using a set of compliance rules by:
evaluating compliance of the live asset configuration data by applying the set of compliance rules to a first model of the cloud environment generated using the live asset configuration data in the second format associated with the UCCE system, and
evaluating compliance of the proposed configuration changes by applying the set of compliance rules to a second model of the cloud environment generated using the cloud configuration definition in the second format associated with the UCCE system.
2. The system of claim 1 , wherein the executable instructions, when executed, further cause the at least one computer device to perform:
generating the first model of the cloud environment using the live asset configuration data in the second format associated with the UCCE system.
3. The system of claim 1 , wherein the executable instructions, when executed, further cause the at least one computer device to perform:
generating the second model reflecting the proposed configuration changes using the cloud configuration definition in the second format associated with the UCCE system.
4. The system of claim 1 , wherein obtaining the live asset configuration data about assets in the cloud environment comprises obtaining the live asset configuration data from a cloud computing infrastructure provider service.
5. The system of claim 1 , wherein obtaining the cloud configuration definition comprises obtaining the cloud configuration definition from a cloud configuration development (CCD) system.
6. The system of claim 1 , wherein the executable instructions, when executed, further cause the at least one computer device to perform:
determining that the proposed configuration changes comply with the set of compliance rules, and in response to the determining, initiating deployment of the proposed configuration changes to the cloud environment.
7. The system of claim 1 ,
wherein the cloud environment is hosted by a cloud computing infrastructure provider service,
wherein the cloud configuration definition is obtained from a cloud configuration development (CCD) system,
wherein the first format is a provider-specific format specific to the cloud computing infrastructure provider service, and
wherein the third format is a definition language specific to the CCD system.
8. The system of claim 1 , wherein the executable instructions, when executed, further cause the at least one computer device to perform:
checking for security vulnerabilities in the cloud environment using the first model.
9. A method, comprising:
using at least one computer device to perform:
obtaining, in a first format, live asset configuration data about assets in a cloud environment;
converting the live asset configuration data from the first format to a second format associated with a unified cloud configuration evaluation (UCCE) system;
obtaining, in a third format, a cloud configuration definition specifying proposed configuration changes to the cloud environment;
converting the cloud configuration definition from the third format to the second format associated with the UCCE system; and
evaluating compliance of the live asset configuration data and the proposed configuration changes using a set of compliance rules by:
evaluating compliance of the live asset configuration data by applying the set of compliance rules to a first model of the cloud environment generated using the live asset configuration data in the second format associated with the UCCE system, and
evaluating compliance of the proposed configuration changes by applying the set of compliance rules to a second model of the cloud environment generated using the cloud configuration definition in the second format associated with the UCCE system.
10. The method of claim 9 , further comprising:
generating the first model of the cloud environment using the live asset configuration data in the second format associated with the UCCE system.
11. The method of claim 9 , further comprising:
generating the second model reflecting the proposed configuration changes using the cloud configuration definition in the second format associated with the UCCE system.
12. The method of claim 9 ,
wherein obtaining the live asset configuration data about assets in the cloud environment comprises obtaining the live asset configuration data from a cloud computing infrastructure provider service, and
wherein obtaining the cloud configuration definition comprises obtaining the cloud configuration definition from a cloud configuration development (CCD) system.
13. The method of claim 9 , further comprising:
determining that the proposed configuration changes comply with the set of compliance rules, and in response to the determining, initiating deployment of the proposed configuration changes to the cloud environment.
14. The method of claim 9 ,
wherein the cloud environment is hosted by a cloud computing infrastructure provider service,
wherein the cloud configuration definition is obtained from a cloud configuration development (CCD) system,
wherein the first format is a provider-specific format specific to the cloud computing infrastructure provider service, and
wherein the third format is a definition language specific to the CCD system.
15. The method of claim 9 , further comprising:
checking for security vulnerabilities in the cloud environment using the first model.
16. At least one non-transitory computer-readable storage medium storing executable instructions that, when executed, cause at least one computer device to perform a method comprising:
obtaining, in a first format, live asset configuration data about assets in a cloud environment;
converting the live asset configuration data from the first format to a second format associated with a unified cloud configuration evaluation (UCCE) system;
obtaining, in a third format, a cloud configuration definition specifying proposed configuration changes to the cloud environment;
converting the cloud configuration definition from the third format to the second format associated with the UCCE system; and
evaluating compliance of the live asset configuration data and the proposed configuration changes using a set of compliance rules by:
evaluating compliance of the live asset configuration data by applying the set of compliance rules to a first model of the cloud environment generated using the live asset configuration data in the second format associated with the UCCE system, and
evaluating compliance of the proposed configuration changes by applying the set of compliance rules to a second model of the cloud environment generated using the cloud configuration definition in the second format associated with the UCCE system.
17. The at least one non-transitory computer-readable storage medium of claim 16 , wherein the method further comprises:
generating the first model of the cloud environment using the live asset configuration data in the second format associated with the UCCE system, and
generating the second model reflecting the proposed configuration changes using the cloud configuration definition in the second format associated with the UCCE system.
18. The at least one non-transitory computer-readable storage medium of claim 16 ,
wherein obtaining the live asset configuration data about assets in the cloud environment comprises obtaining the live asset configuration data from a cloud computing infrastructure provider service, and
wherein obtaining the cloud configuration definition comprises obtaining the cloud configuration definition from a cloud configuration development (CCD) system.
19. The at least one non-transitory computer-readable storage medium of claim 16 , wherein the method further comprises:
determining that the proposed configuration changes comply with the set of compliance rules, and in response to the determining, initiating deployment of the proposed configuration changes to the cloud environment.
20. The at least one non-transitory computer-readable storage medium of claim 16 , wherein the method further comprises:
checking for security vulnerabilities in the cloud environment using the first model.