Towards safer continuous infrastructure-as-code deployments

As cloud computing resources become more adopted, the infrastructures in which they are used naturally grow in the amount of resources and overall complexity, becoming harder to manage.

Infrastructure-as-Code (IaC) is presented as a solution to this problem, allowing developers to manage and provision these cloud resources programmatically. The infrastructure is then maintained through a code base, allowing general software good practices like version control and peer review, as well as aiding replication of the infrastructure across environments.

Some IaC solutions also offer the ability to review the effects of new infrastructure changes before deploying them. By defining pieces of infrastructure through code or configuration files, it becomes easy to share and reuse them. As such, community-made infrastructure is now widely available - and even more accessible through platforms like CDK Construct Catalog1 , Chef Supermarket2 or Puppet Forge3 -, which enables developers to include third-party libraries or templates in their infrastructure.

Such a process is hard to review as they can introduce large sets of changes, hampering compliance checks and creating security concerns. Moreover, infrastructure-as-code deployments are often part of continuous delivery pipelines where the review and approval of changes are manual steps, which contradicts the fundamental principles of continuous delivery.

Throughout this dissertation, techniques for analyzing IaC code were researched and developed to ultimately increase the efficiency and experience of the review and approval processes without sacrificing safety. We were able to create a description and visualization of infrastructure changes for easier user review, as well as enabling automating approval of changes through userdefined rules, either based on recurrence or user expectations. These allow the developer to review changes more easily and eliminate some unnecessary manual actions.

This work was developed and tested for the Amazon Web Services’ (AWS) Cloud Development Kit (CDK) and, consequently, uses AWS services.