Automated compliance checking through analysis of cloud infrastructure templates
Systems and methods for determining a state of an information technology (IT) environment are disclosed. A server accesses an infrastructure-as-code (IaC) template for the IT environment, where the IT environment is virtualized and cloud-based. The server deconstructs, using a parser for the IaC template, the IaC template to a graph database representation of the IT environment, wherein the graph database representation implements a predefined cloud resource ontology (CRO). The server determines, using the graph database representation, the state of the IT environment. The server provides, as a digital transmission, an output corresponding to the determined state of the IT environment.
1. A system for determining a state of an information technology (IT) environment, the system comprising:
a hardware processor and memory; the hardware processor to:
access an infrastructure-as-code (IaC) template for the IT environment, wherein the IT environment is virtualized and cloud-based;
deconstruct, using a parser for the IaC template, the IaC template to a graph database representation of the IT environment, wherein the graph database representation implements a predefined cloud resource ontology (CRO);
determine, using the graph database representation, the state of the IT environment; and
provide, as a digital transmission, an output corresponding to the determined state of the IT environment.
2. The system of claim 1 , wherein:
the hardware processor determines the state of the IT environment by determining adherence of the IT environment to one or more rules; and
the output corresponding to the determined state of the IT environment comprises an indication whether the IT environment adheres to the one or more rules.
3. The system of claim 2 , wherein the one or more rules comprise following a security policy or following a resource usage policy.
4. The system of claim 1 , wherein:
the hardware processor determines the state of the IT environment by comparing a first version of the IT environment to a second version of the IT environment; and
the output corresponding to the determined state of the IT environment comprises an indication of differences between the first version and the second version.
5. The system of claim 4 , wherein the differences between the first version and the second version comprise security-related changes between the first version and the second version.
6. The system of claim 1 , wherein:
the hardware processor determines the state of the IT environment by receiving a query from a user, the query being based on one or more parameters of the IT environment; and
the output corresponding to the determined state of the IT environment comprises a response to the query.
7. The system of claim 1 , wherein:
the hardware processor accesses the IaC template for the IT environment by accessing the IaC template after check-in of the IT environment and in parallel with building the IT environment.
8. A non-transitory machine-readable medium for determining a state of an information technology (IT) environment, the machine-readable medium comprising instructions that, when executed by one or more processors of a machine, cause the one or more processors to carry out operations comprising:
accessing an infrastructure-as-code (IaC) template for the IT environment, wherein the IT environment is virtualized and cloud-based;
deconstructing, using a parser for the IaC template, the IaC template to a graph database representation of the IT environment, wherein the graph database representation implements a predefined cloud resource ontology (CRO);
determining, using the graph database representation, the state of the IT environment; and
providing, as a digital transmission, an output corresponding to the determined state of the IT environment.
9. The machine-readable medium of claim 8 , wherein:
determining the state of the IT environment comprises determining adherence of the IT environment to one or more rules; and
the output corresponding to the determined state of the IT environment comprises an indication whether the IT environment adheres to the one or more rules.
10. The machine-readable medium of claim 9 , wherein the one or more rules comprise following a security policy or following a resource usage policy.
11. The machine-readable medium of claim 8 , wherein:
determining the state of the IT environment comprises comparing a first version of the IT environment to a second version of the IT environment; and
the output corresponding to the determined state of the IT environment comprises an indication of differences between the first version and the second version.
12. The machine-readable medium of claim 11 , wherein the differences between the first version and the second version comprise security-related changes between the first version and the second version.
13. The machine-readable medium of claim 8 , wherein:
determining the state of the IT environment comprises receiving a query from a user, the query being based on one or more parameters of the IT environment; and
the output corresponding to the determined state of the IT environment comprises a response to the query.
14. The machine-readable medium of claim 8 , wherein:
accessing the IaC template for the IT environment comprises accessing the IaC template after check-in of the IT environment and in parallel with building the IT environment.
15. A method for determining a state of an information technology (IT) environment, the method comprising:
accessing an infrastructure-as-code (IaC) template for the IT environment, wherein the IT environment is virtualized and cloud-based;
deconstructing, using a parser for the IaC template, the IaC template to a graph database representation of the IT environment, wherein the graph database representation implements a predefined cloud resource ontology (CRO);
determining, using the graph database representation, the state of the IT environment; and
providing, as a digital transmission, an output corresponding to the determined state of the IT environment.
16. The method of claim 15 , wherein:
determining the state of the IT environment comprises determining adherence of the IT environment to one or more rules; and
the output corresponding to the determined state of the IT environment comprises an indication whether the IT environment adheres to the one or more rules.
17. The method of claim 16 , wherein the one or more rules comprise following a security policy or following a resource usage policy.
18. The method of claim 15 , wherein:
determining the state of the IT environment comprises comparing a first version of the IT environment to a second version of the IT environment; and
the output corresponding to the determined state of the IT environment comprises an indication of differences between the first version and the second version.
19. The method of claim 18 , wherein the differences between the first version and the second version comprise security-related changes between the first version and the second version.
20. The method of claim 15 , wherein:
determining the state of the IT environment comprises receiving a query from a user, the query being based on one or more parameters of the IT environment; and
the output corresponding to the determined state of the IT environment comprises a response to the query.