Software development environment construction method and system

Abstract

A method and system for constructing an environment for software development is provided, comprising: receiving a plurality of infrastructure-as-code files that specify a configuration of a runtime environment for a deployable image of source code in a continuous integration and continuous delivery pipeline for a cloud platform; generating compliance code for at least one of the plurality of infrastructure-as-code files; constructing a deployable image of the source code in the continuous integration and continuous delivery pipeline in accordance with the configuration and compliance code specified by the plurality of infrastructure-as-code files; and deploying an instance of the image in the runtime environment.

Description

[Background technology]

[0001] Aspects of the present invention relate generally to software development environments, and more particularly to systems, computer program products, and methods for automating software development, security, and operations (DevSecOps).

[0002] Infrastructure as Code (IaC) is a method for automatically configuring system dependencies and provisioning local and remote instances of software deployments. Practitioners view IaC as a fundamental pillar for implementing software development and operations (DevOps) methodologies to rapidly deliver software and services to end users. For companies creating cloud-based projects that leverage IaC, strategies for identifying defects or security flaws during environment development and deployment are useful for corporate compliance and audit purposes. Summary of the Invention

[0003] In a first aspect of the present invention, there is a computer-implemented method that includes: a processor receiving a plurality of infrastructure-as-code files that specify a configuration of a runtime environment for a deployable image of source code in a continuous integration and continuous delivery pipeline for a cloud platform; the processor generating compliance code for at least one of the plurality of infrastructure-as-code files; the processor building the deployable image of the source code in the continuous integration and continuous delivery pipeline in accordance with the configuration and compliance code specified by the plurality of infrastructure-as-code files; and the processor deploying an instance of the image in the runtime environment.

[0004] In another aspect of the invention, there is a computer program product comprising one or more computer-readable storage media having program instructions collectively stored on the one or more computer-readable storage media, the program instructions being executable to: input characteristics of each of a plurality of code files in a continuous integration and continuous delivery pipeline for a cloud platform into a machine learning model trained with test data including examples of non-compliant code having security vulnerabilities; detect non-compliant code in at least one of the plurality of code files in the continuous integration and continuous delivery pipeline for the cloud platform using the machine learning model; build a deployable image of source code in the continuous integration and continuous delivery pipeline according to a configuration of a runtime environment defined by the plurality of code files, including the at least one of the plurality of code files incorporating compliance code that remediates the security vulnerability; and deploy an instance of the image into the runtime environment.

[0005] In another aspect of the present invention, there is a system including a set of processors, one or more computer-readable storage media, and program instructions collectively stored on the one or more computer-readable storage media, the program instructions being executable to: detect code in at least one file of a plurality of infrastructure-as-code files in a continuous integration and continuous delivery pipeline for a cloud platform that does not comply with compliance rules of a security and compliance policy; append compliance code that complies with the compliance rules of the security and compliance policy to the at least one file of the plurality of infrastructure-as-code files; and deploy a deployable image of source code in the continuous integration and continuous delivery pipeline into the runtime environment according to a configuration of the runtime environment defined by the plurality of infrastructure-as-code files including the at least one file to which the compliance code that complies with the compliance rules has been appended. [Brief explanation of the drawings]

[0006] Aspects of the present invention are described in the following detailed description, with reference to a number of drawings, which are given as non-limiting examples of illustrative embodiments of the invention.

[0007] [Figure 1] FIG. 1 illustrates a computing environment according to one embodiment of the present invention.

[0008] [Figure 2] FIG. 1 is a block diagram of an exemplary environment in accordance with an aspect of the present invention.

[0009] [Figure 3] 1 is an illustration of an exemplary workflow according to an aspect of the present invention.

[0010] [Figure 4]1 is a flowchart of an exemplary method according to an aspect of the present invention.

[0011] [Figure 5] 1 is an illustration of an exemplary process flow diagram according to an embodiment of the present invention.

[0012] [Figure 6] 1 is a flowchart of an exemplary method according to an aspect of the present invention.

[0013] [Figure 7] 1 is a flowchart of an exemplary method according to an aspect of the present invention.

[0014] [Figure 8] 1 is a flowchart of an exemplary method according to an aspect of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0015] Aspects of the present invention relate generally to software development environments, and more particularly to systems, computer program products, and methods for automating software development, security, and operations (DevSecOps). More specifically, aspects of the present invention relate to methods, computer program products, and systems for an optimized continuous integration and continuous delivery (CI / CD) pipeline environment that remediates non-compliant code and validates compliant code according to corporate compliance and security policies during the development and deployment of serverless functions, microservices, and Application Programming Interface (API) gateways on cloud platforms. When cloud service providers rely on third-party security consultants to support compliance and security development in cloud service deployments, inefficient and inconsistent processes result. According to aspects of the present invention, the methods, systems, and computer program products described herein automatically detect and remediate non-compliant code as part of the process in a CI / CD environment, and also validate the code for compliance as part of the deployment process.

[0016] In embodiments, methods, systems, and program products described herein receive source code written for serverless functions and an API gateway, and a CI / CD pipeline configuration file including infrastructure-as-code (IaC) files that specify the cloud service's configuration, the events that trigger the functions, and the runtime environment's resources, e.g., the infrastructure stack, to deploy a cloud service. The source code and CI / CD pipeline configuration file are processed as part of a CI / CD integration and delivery environment by applying machine learning analysis, e.g., long short-term memory (LSTM) analysis, within a machine learning model trained using enterprise data and / or crowdsourced data. This analysis detects code that does not comply with security and compliance policy compliance rules. Compliance code that complies with the compliance rules is generated and appended to each code file with the detected non-compliant code, thereby making the code compliant with the compliance rules. A deployable image of the service for the source code is built in a continuous integration and continuous delivery pipeline according to the runtime environment configuration specified by the pipeline configuration file, including the files updated with the compliance code. Additionally, the build of the deployable image is validated to verify that the code adheres to compliance rules as part of the deployment process, and the cloud service is deployed onto the cloud platform.

[0017] Furthermore, the method, system, and program product used in embodiments of the present disclosure incorporate security / policy compliance into the DevSecOps pipeline by crowdsourcing compliance recommendations for common compliance security / policy issues (e.g., threats, vulnerabilities) and using a reward system (e.g., reputation scores) to identify useful recommendations. The crowdsourced compliance recommendations are used as training data to train a cognitive engine to generate compliance code for input source code. The trained cognitive engine can then generate compliance code for a given set of serverless cloud computing code. The reward system can employ blockchain to track individual compliance recommendations and reward contributors of those compliance recommendations based on the success of their compliance recommendations against actual security / policy issues.

[0018] Aspects of the present invention are directed to improvements to computer-related technologies and existing technical processes in CI / CD environments for deploying cloud services. In embodiments, a system including a processor, a computer-readable memory, one or more computer-readable storage media, and program instructions collectively stored on the one or more computer-readable storage media can detect code in a continuous integration and continuous delivery pipeline for a cloud service that does not comply with security and compliance policy compliance rules, append compliance code that complies with the security and compliance policy compliance rules to remediate the non-compliant code, verify that the code complies with the security and compliance policy compliance rules, and deploy the cloud service. These are specific improvements in how computers can operate and interact to automatically detect and remediate non-compliant code, further validating that a deployable cloud service complies with a company's compliance and security policies.

[0019] In implementations of the present disclosure, additional elements are described that are specific improvements in the way a computer can operate, and these additional elements provide non-abstract improvements to the computer's functionality and capabilities. As an example, a computer program product including one or more computer-readable storage media having program instructions collectively stored on the one or more computer-readable storage media can input characteristics of code files in a continuous integration and continuous delivery pipeline for a cloud service into a machine learning model trained with examples of non-compliant code having security vulnerabilities, detect non-compliant code in one or more code files in the continuous integration and continuous delivery pipeline for the cloud service using the machine learning model, build a deployable image for the cloud service in the continuous integration and continuous delivery pipeline according to a configuration of the runtime environment defined by the code files, including one or more code files that incorporate compliance code that repairs the security vulnerabilities, and deploy the cloud service in the runtime environment.

[0020] To the extent implementations of the present invention collect, store, or employ personal information provided by or obtained from individuals, it should be understood that such information will be used in accordance with all applicable laws regarding the protection of personal information. Additionally, the collection, storage, and use of such information may be subject to the individual's consent to such activities, for example, through an "opt-in" or "opt-out" process that may be appropriate for the situation and type of information. The storage and use of personal information may be in an appropriately secure manner that reflects the type of information, for example, through various encryption and anonymization techniques for particularly sensitive information.

[0021] Various aspects of the present disclosure are described through text, flowcharts, block diagrams of computer systems, and / or block diagrams of machine logic included in embodiments of a computer program product (CPP). With respect to any flowchart, operations may be performed in a different order than shown in a given flowchart, depending on the technology involved. For example, two operations shown in successive flowchart blocks may be performed in the reverse order, as a single integrated step, simultaneously, or in an at least partially overlapping manner, again depending on the technology involved.

[0022] A computer program product embodiment ("CPP embodiment" or "CPP") is a term used in this disclosure to describe any set of one or more storage media (also called "mediums") collectively contained in one or more storage devices that collectively contain machine-readable code corresponding to instructions and / or data for performing the computer operations set forth in a given CPP claim. A "storage device" is any tangible device that can hold and store instructions for use by a computer processor. Without limitation, the computer-readable storage medium may be an electronic storage medium, a magnetic storage medium, an optical storage medium, an electromagnetic storage medium, a semiconductor storage medium, a mechanical storage medium, or any suitable combination of the foregoing. Some known types of storage devices that include these media include diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanically encoded device (such as pits / lands formed on a major surface of a punch card or disk), or any suitable combination of the foregoing. Computer-readable storage media, as the term is used in this disclosure, is not to be construed as storage in the form of a transient signal per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide, light pulses passing through fiber optic cables, electrical signals transmitted through wires, and / or other transmission media. As will be appreciated by those skilled in the art, data is typically moved at some infrequent time during the normal operation of the storage device, such as during access, defragmentation, or garbage collection, but the above does not qualify a storage device as transient because the data is not transient while it is stored.

[0023] Computing environment 100 includes an example of an environment for executing at least some of the computer code involved in implementing the methodology of the present invention, such as an optimized serverless continuous integration and continuous delivery environment 200 on a cloud platform for software development, security, and operations. In addition to block 200, computing environment 100 includes, for example, computer 101, wide area network (WAN) 102, end user device (EUD) 103, remote server 104, public cloud 105, and private cloud 106. In this embodiment, computer 101 includes a set of processors 110 (including processing circuitry 120 and cache 121), a communications fabric 111, volatile memory 112, persistent storage 113 (including operating system 122 and the above-identified block 200), a set of peripheral devices 114 (including a set of user interface (UI) devices 123, storage 124, and a set of Internet of Things (IoT) sensors 125), and a network module 115. Remote server 104 includes a remote database 130. The public cloud 105 includes a gateway 140, a cloud orchestration module 141, a set of host physical machines 142, a set of virtual machines 143, and a set of containers 144.

[0024] Computer 101 may take the form of a desktop computer, a laptop computer, a tablet computer, a smartphone, a smartwatch or other wearable computer, a mainframe computer, a quantum computer, or any other form of computer or mobile device now known or later developed that can execute programs, access a network, or query a database, such as remote database 130. As is well understood in the field of computer technology, and depending on the technology, the performance of a computer-implemented method may be distributed among multiple computers and / or multiple locations. However, in this description of computing environment 100, for purposes of simplicity, the detailed discussion focuses on a single computer, specifically computer 101. Although computer 101 is not depicted in FIG. 1 within a cloud, it may be located within a cloud. However, computer 101 is not required to reside within a cloud except to any extent expressly indicated.

[0025] Processor set 110 includes one or more computer processors of any type now known or later developed. Processing circuitry 120 may be distributed across multiple packages, e.g., multiple linked integrated circuit chips. Processing circuitry 120 may implement multiple processor threads and / or multiple processor cores. Cache 121 is memory located within the processor chip package and is typically used for data or code that should be available for fast access by threads or cores executing on processor set 110. Cache memory is typically organized into multiple levels depending on relative proximity to the processing circuitry. Alternatively, some or all of the cache for a processor set may be located “off-chip.” In some computing environments, processor set 110 may be designed to operate with qubits and perform quantum computing.

[0026] Computer-readable program instructions are typically loaded into computer 101 and cause processor set 110 of computer 101 to perform a series of operational steps, thereby performing a computer-implemented method; the instructions so executed will thus instantiate the methods set forth in the computer-implemented method flowcharts and / or descriptions contained in this document (collectively, the "methods of the present invention"). These computer-readable program instructions are stored in various types of computer-readable storage media, such as cache 121 and other storage media discussed below. The program instructions and associated data are accessed by processor set 110 to control and direct the performance of the methods of the present invention. In computing environment 100, at least some of the instructions for performing the methods of the present invention may be stored in block 200 of persistent storage 113.

[0027] Communications fabric 111 is the signal-conducting pathway that allows various components of computer 101 to communicate with one another. Typically, this fabric is made up of switches and conductive pathways, such as those that make up buses, bridges, physical input / output ports, and the like. Other types of signal communication pathways may be used, such as fiber optic and / or wireless communication pathways.

[0028] Volatile memory 112 may be any type of volatile memory now known or later developed. Examples include dynamic random access memory (RAM) or static RAM. Typically, volatile memory is characterized by random access, although this is not required unless expressly stated. In computer 101, volatile memory 112 is located in a single package and is internal to computer 101, although alternatively or additionally, volatile memory may be distributed across multiple packages and / or located external to computer 101.

[0029] Persistent storage 113 is any form of non-volatile storage for a computer, now known or later developed. The non-volatility of this storage means that stored data is maintained regardless of whether power is supplied to computer 101 and / or directly to persistent storage 113. While persistent storage 113 may be read-only memory (ROM), typically at least a portion of persistent storage allows data to be written, data to be deleted, and data to be rewritten. Some well-known forms of persistent storage include magnetic disks and solid-state storage devices. Operating system 122 may take several forms, such as various known proprietary operating systems employing a kernel or open-source Portable Operating System Interface-type operating systems. The code contained in block 200 typically includes at least some of the computer code involved in implementing the methods of the present invention.

[0030] Peripheral device set 114 includes the set of peripheral devices of computer 101. Data communication connections between peripheral devices and other components of computer 101 may be implemented in various ways, such as Bluetooth connections, near field communication (NFC) connections, connections made by cables (such as universal serial bus (USB)-type cables), insertion-type connections (e.g., Secure Digital (SD) cards), connections made through local area communication networks, and even connections made through wide area networks such as the Internet. In various embodiments, UI device set 123 may include components such as display screens, speakers, microphones, wearable devices (such as goggles and smartwatches), keyboards, mice, printers, touchpads, game controllers, and haptic devices. Storage 124 may be external storage, such as an external hard drive, or insertable storage, such as an SD card. Storage 124 may be persistent and / or volatile. In some embodiments, storage 124 may take the form of a quantum computing storage device for storing data in the form of qubits. In embodiments where computer 101 is required to have a large amount of storage (e.g., computer 101 stores and manages a large database locally), then this storage may be provided by a peripheral storage device designed to store very large amounts of data, such as a storage area network (SAN) shared by multiple geographically distributed computers. IoT sensor set 125 consists of sensors used in Internet of Things applications. For example, one sensor may be a thermometer and another sensor may be a motion detector.

[0031] Network module 115 is a collection of computer software, hardware, and firmware that enables computer 101 to communicate with other computers over WAN 102. Network module 115 may include hardware such as a modem or Wi-Fi signal transceiver, software for packetizing and / or depacketizing data for communication network transmission, and / or web browser software for communicating data over the Internet. In some embodiments, the network control and network forwarding functions of network module 115 are implemented on the same physical hardware device. In other embodiments (e.g., embodiments utilizing software-defined networking (SDN)), the control and forwarding functions of network module 115 are implemented on physically separate devices, such that the control function manages several different network hardware devices. Computer-readable program instructions for implementing the methods of the present invention may be downloaded to computer 101, typically from an external computer or external storage device, through a network adapter card or network interface included in network module 115.

[0032] WAN 102 is any wide area network (e.g., the Internet) capable of communicating computer data over non-local distances by any technology for communicating computer data now known or later developed. In some embodiments, a WAN may be replaced and / or supplemented by a local area network (LAN) designed to communicate data between devices located in a local area, such as a Wi-Fi network. WANs and / or LANs typically include copper transmission cables, optical fiber transmissions, wireless transmissions, and computer hardware such as routers, firewalls, switches, gateway computers, and edge servers.

[0033] End-user device (EUD) 103 is any computer system used and controlled by an end user (e.g., a customer of the enterprise operating computer 101) and may take any of the forms discussed above in connection with computer 101. EUD 103 typically receives useful and useful data from the operation of computer 101. For example, in the hypothetical case where computer 101 is designed to provide recommendations to end users, the recommendations would typically be communicated from computer 101's network module 115 over WAN 102 to EUD 103. In this manner, EUD 103 can display or otherwise present the recommendations to the end user. In some embodiments, EUD 103 may be a client device such as a thin client, a heavy client, a mainframe computer, a desktop computer, etc.

[0034] Remote server 104 is any computer system that provides at least some data and / or functionality to computer 101. Remote server 104 may be controlled and used by the same entity that operates computer 101. Remote server 104 represents a machine that collects and stores useful and useful data for use by other computers, such as computer 101. For example, in the hypothetical case where computer 101 is designed and programmed to provide recommendations based on historical data, then this historical data may be provided to computer 101 from remote database 130 of remote server 104.

[0035] A public cloud 105 is any computer system available for use by multiple entities that provides on-demand availability of computer system resources and / or other computer capabilities, particularly data storage (cloud storage) and computing power, without direct active management by users. Cloud computing typically leverages resource sharing to achieve consistency and economies of scale. Direct active management of the computing resources of the public cloud 105 is performed by the computer hardware and / or software of a cloud orchestration module 141. The computing resources provided by the public cloud 105 are typically implemented by virtual computing environments running on various computers comprising a host physical machine set 142, which is the universe of physical computers within and / or available to the public cloud 105. A virtual computing environment (VCE) typically takes the form of a virtual machine from a virtual machine set 143 and / or a container from a container set 144. It is understood that these VCEs may be stored as images and transferred among and between various physical machine hosts, either as images or after instantiation of the VCE. Cloud orchestration module 141 manages the transfer and storage of images, deploys new instantiations of VCE, and manages active instantiations of VCE deployments. Gateway 140 is a collection of computer software, hardware, and firmware that enables public cloud 105 to communicate over WAN 102.

[0036] We now provide some further explanation of virtualized computing environments (VCEs). A VCE can be stored as an "image." A new active instance of a VCE can be instantiated from the image. Two well-known types of VCEs are virtual machines and containers. A container is a VCE that uses operating system-level virtualization. This refers to a feature of an operating system where the kernel allows multiple isolated user space instances, called containers, to exist. These isolated user space instances typically behave as actual computers from the perspective of programs running within them. A computer program running on a typical operating system can utilize all of the computer's resources, such as connected devices, files and folders, network shares, CPU power, and quantifiable hardware capabilities. However, a program running inside a container can only use the contents of the container and the devices assigned to that container; this feature is known as containerization.

[0037] A private cloud 106 is similar to a public cloud 105, except that the computing resources are available only for use by a single enterprise. While the private cloud 106 is illustrated as being in communication with the WAN 102, in other embodiments, the private cloud may be completely disconnected from the Internet and accessible only through a local / private network. A hybrid cloud is a composite of multiple clouds of different types (e.g., private, community, or public cloud types), often implemented by different vendors. While each of the multiple clouds remains a separate, discrete entity, the larger hybrid cloud architecture is bound together by standardized or proprietary technologies that enable orchestration, management, and / or data / application portability between the constituent clouds. In this embodiment, both the public cloud 105 and the private cloud 106 are part of the larger hybrid cloud.

[0038] Figure 2 illustrates a block diagram of an exemplary environment 205 according to an aspect of the present invention. In an embodiment, the environment includes a server 206, which may be a computer system such as computer 101 described with reference to Figure 1, with which end user devices 103 and remote servers 104, each also described with reference to Figure 1, may communicate over a network, such as WAN 102 described with reference to Figure 1. Generally, server 206 supports services related to serverless continuous integration and continuous delivery (CI / CD) on a cloud platform optimized for software development, security, and operations (DevSecOps) methodologies.

[0039] Server 206 includes server memory 208, such as volatile memory 112 described with respect to Figure 1. Server 206 includes within memory 208 a cognitive module 210 that is capable of receiving data including source code, Infrastructure as Code (IaC) code, playbooks, CI / CD pipeline configuration files, among other data provided and used during CI / CD delivery on a cloud platform, processing this data to detect non-compliance of the code with corporate compliance rules and policies, and generating compliance code that updates the source code, IaC code, and other files to comply with corporate compliance rules and policies. Server 206 also includes in memory 208 a continuous integration module 212 that is capable of downloading source code from a repository and any dependent code that the source code requires for execution, compiling the source code with the dependent code, building an executable instance of the compiled source code with the dependent code, and testing the executable instance of the source code, among other functions such as performing code analysis. Additionally, server 206 includes a continuous delivery module 214 that is capable of packaging builds into deployable images, such as containers or virtual machine (VM) images, configuring the deployable images for a runtime environment, and deploying the configured images into a production environment, among other functions such as load testing.

[0040] Server 206 may further include in memory 208 a serverless functions module 216 having serverless functions, a microservices module 218 having microservice processes, and a gateway API module 220 that, in some embodiments, is capable of supporting HTTP API requests to the serverless functions of serverless functions module 216, and in alternative embodiments, is capable of supporting HTTP API requests to the microservice processes of microservices module 218. Each of these modules may be generated by continuous integration module 212 during CI / CD delivery from one or more source code files 230, a compliance code file 236 generated by recognition module 210, and other files used during CI / CD delivery on the cloud platform, such as pipeline configuration file 238.

[0041] Server 206 may further include in memory 208 a test cognitive module 222 that has the functionality of cognitive module 210 for receiving data including source code, IaC code, playbooks, CI / CD pipeline configuration files, among other data provided and used during CI / CD delivery on the cloud platform, and processing this data to detect non-compliance of the code with the enterprise's compliance rules and policies. Test cognitive module 222 is also trained using the same training data used to train cognitive module 210, and thus detects non-compliance of the code with compliance rules and policies similar to cognitive module 210. Test cognitive module 222 may be trained using new training data, such as crowdsourced training data 228, to verify that the new training data improves the detection of test cognitive module 222 before cognitive module 210 is trained with the new training data.

[0042] In embodiments, server 206 of FIG. 2 includes a cognitive module 210, a continuous integration module 212, a continuous delivery module 214, and a test cognitive module 222, each of which may include modules of code in block 200 of FIG. 1. These modules of code in block 200 are executable by processing circuitry 120 of FIG. 1 to implement the inventive methods described herein. Server 206 may include additional or fewer modules than those shown in FIG. 2. In embodiments, separate modules may be combined into a single module. Additionally or alternatively, a single module may be implemented as multiple modules. Furthermore, the number of devices and / or networks in an environment is not limited to those shown in FIG. 2. In practice, an environment may include additional devices and / or networks; fewer devices and / or networks; different devices and / or networks; or differently arranged devices and / or networks relative to those shown in FIG. 2.

[0043] According to an aspect of the present invention, Figure 2 also illustrates a block diagram of storage 224, which may be a storage such as storage 124 of computer 101 described with respect to Figure 1. Storage 224 may store training data 226 in file format for training cognitive module 210. For example, the training data may include a corpus of non-compliant source code, IaC code, playbooks, CI / CD pipeline configuration files, and other non-compliant data provided and used during CI / CD delivery on a cloud platform, and compliance code for updating source code, IaC code, and other non-compliant files to comply with compliance rules and policies. Storage 224 may also store crowdsourced training data 228 in file format for testing cognitive module 222 and training cognitive module 210. Crowdsourced training data 228 may include, for example, a corpus of non-compliant source code, IaC code, playbooks, CI / CD pipeline configuration files, and other non-compliant data provided and used during CI / CD delivery on the cloud platform, and compliance code to update the source code, IaC code, and other non-compliant files to comply with compliance rules and policies.

[0044] Storage 224 may also store source code 230 files and IaC code 232 files. The source code 230 files may be source code in any programming language, including Java, JavaScript, Python, Node JS, Golang, or other programming languages. The IaC code 232 files may include various configuration format files, such as HCL, JSON, or YAML file formats, that contain functional and / or procedural instructions for provisioning configurations of infrastructure components in a runtime environment. For example, storage 224 may store playbooks 234, each of which is a type of IaC code 232 file written in YAML that contains declarations that specify end-state infrastructure for provisioning for a runtime environment. Storage 224 may store other types of pipeline configuration files 238 used during CI / CD delivery on the cloud platform, such as configuration files for artifacts, stack template files, role files, and project object model (pom) files. Storage 224 may also store runtime processing logs 242 that can be examined to diagnose the cause of CI / CD pipeline failures, such as incorrect syntax, incorrect variable values, job failures, etc.

[0045] Storage 224 may additionally store compliance code 236 and compliance rules and policies file 240. Compliance rules and policies file 240 may include specifications of security standards to be followed by, for example, serverless module 216, microservices module 218, and / or gateway API module 220 and validated prior to deployment in production. The security standards specification may list any number of compliance rules to protect against exposure of various vulnerabilities, such as encryption standards and key lengths for specific data types and information, password protection requirements specifying minimum password lengths and the requirement to include specific character types, and sets of rules specified for various cybersecurity standards, among other compliance rules. Compliance code 236 includes code that updates source code, IaC code, and other files in the CI / CD pipeline to comply with the compliance rules and policies specified in compliance rules and policies file 240 during production of, for example, serverless module 216, microservices module 218, and / or gateway API module 220 for deployment.

[0046] According to aspects of the present invention, environment 205 of Figure 2 also illustrates user device 246, which may be a computer system such as end-user device 103 described with respect to Figure 1, corporate server 252, which may be a computer system such as remote server 104 described with respect to Figure 1, and remote server 256, which may be a computer system such as remote server 104 described with respect to Figure 1, each of which may communicate over WAN 244, which may be a wide area network such as WAN 102 described with respect to Figure 1. Corporate server 252 may include security and compliance services 254, which may communicate over WAN 244 to provide server 206 with compliance rules and policy files 240, which are stored in storage 224 shown in Figure 2.

[0047] User device 246 may include, among other software development tools for software developers, an integrated development environment (IDE) tool 248 and an IaC tool 250 that provide a software development environment. IDE tool 248 may generate source code, such as source code 230, which may be source code in any programming language, including Java, JavaScript, Python, Node.JS, Golang, or other programming languages, and IaC tool 250 may generate IaC code, such as IaC code 232, which may include various configuration format files, such as HCL, JSON, or YAML file formats. For example, a software developer may use IDE tool 248 and IaC tool 250 to write Java code or JavaScript for serverless functions, microservices, and / or gateway APIs. In this example, IDE tool 248 may generate source code 230 and IaC tool 250 may generate IaC code 232 for serverless module 216, microservice module 218, and / or gateway API module 220. In embodiments, the cognitive module 210 may process the source code 230 and the IaC code 232, among other data provided and used within the CI / CD pipeline, to detect non-compliance of the code with the compliance rules and policies in the compliance rules and policies file 240, and generate compliance code 236 that updates the source code 230 and the IaC code 232, among other non-compliant files, to comply with the compliance rules and policies.

[0048] The remote server 256 may include a crowdsourced data aggregator service 258, which communicates over the WAN 244 to provide crowdsourced training data 228 to the server 206. The crowdsourced training data may be anonymized, facilitating the continued inclusion of best-of-breed solutions regardless of where the solutions were developed. The test cognitive module 222 may be trained using the crowdsourced training data 228 to verify that the crowdsourced training data 228 improves the detection of the test cognitive module 222. If the crowdsourced training data 228 improves the detection of the test cognitive module 222, the crowdsourced training data 228 may be used to train the cognitive module 210; otherwise, the crowdsourced training data may be discarded.

[0049] Figure 3 shows an illustration of an exemplary DevSecOps workflow in accordance with aspects of the present invention. In one embodiment, illustration 300 shows security and compliance services 304 of an enterprise cloud platform 302 providing security and compliance information, such as compliance rules and policy file 240 described with respect to Figure 2, to a software development pipeline, where compliance script updates 322 are generated to update the software in the development pipeline to comply with the enterprise's security and compliance policies. Figure 3 also shows software developers 308 receiving requirements 306 for developing software and developing the software in accordance with requirements 306 using development tools provided in developer environment 310. As shown in Figure 3, security and compliance information that must be followed by IaC code generated by IaC tool 312, source code 314, and IDE 316 in the software development pipeline is additionally provided by security and compliance services 304 of enterprise cloud platform 302. This security and compliance information is provided to a cognitive engine 318, which is trained by trainers 320 to detect non-compliant software and generate compliance script updates 322 that update code in the development pipeline to comply with corporate security and compliance policies.

[0050] 4 shows a flowchart of an exemplary method according to an embodiment of the present invention. The steps of the method may be performed in the environment of FIG. 2 and will be described with reference to elements shown in FIG.

[0051] Stage 402 defines requirements for infrastructure services or application deployment using serverless functions or API gateways. Defining these requirements can initiate a DevSecOps development process. In an embodiment, the requirements are received by a developer using a user device 246 with an IDE tool 248 and an IaC tool 250, as described with respect to FIG. 2 .

[0052] In stage 404, the requirements are reviewed with reference to any defined architecture documentation to identify any serverless functions that must be designed and built. In an embodiment, the requirements are reviewed by a developer using a user device 246 with an IDE tool 248 and an IaC tool 250, as described with respect to FIG.

[0053] In step 406, source code for the serverless functions and API gateway may be written. For example, a developer may write Java code or JavaScript for the serverless functions and API gateway, a pom.xml file to handle build dependencies, and a template.yml file to configure the service in which the serverless functions are defined, the events that trigger the functions are specified, and the resources to deploy the functions are specified. In an embodiment, a developer using a user device 246 with an IDE tool 248 and an IaC tool 250 writes the serverless functions and API gateway using the IDE tool 248 and the IaC tool 250, as described with respect to FIG. 2 .

[0054] In step 408, the serverless function and API gateway definitions are entered into template.yml. In an embodiment, a developer using a user device 246 with an IDE tool 248 and an IaC tool 250 writes the serverless function and API gateway definitions into template.yml using the IDE tool 248 and the IaC tool 250, as described with respect to FIG.

[0055] In step 410, identities and access roles for the serverless functions and API gateways are defined in a role file. The role file includes, among other configuration artifacts, tasks that the role performs, handlers, modules, variables, metadata with role dependencies, and template files. In an embodiment, as described with respect to FIG. 2, a developer using a user device 246 with an IDE tool 248 and an IaC tool 250 defines identities and access roles for the serverless functions and API gateways in the role file using the IDE tool 248 and the IaC tool 250.

[0056] At stage 412, an infrastructure stack can be defined in a playbook file or template. The infrastructure stack models the data center infrastructure by defining the interrelationships between system components in a runtime environment. In an embodiment, a developer using a user device 246 with an IDE tool 248 and an IaC tool 250, as described with respect to FIG. 2, uses the IDE tool 248 and the IaC tool 250 to define the infrastructure stack for the serverless functions and API gateway in a playbook file or template.

[0057] In step 414, the system receives the IaC file and generates compliance code for the non-compliant code in the CI / CD pipeline. The compliance code may be one or more compliance script updates to one or more of the source code, IaC code, and / or other CI / CD pipeline code in embodiments to update the non-compliant code to comply with security and compliance policies. In embodiments, and as described with respect to FIG. 2, the recognition module 210 receives the IaC file and generates compliance code 236 that updates the code in the CI / CD pipeline to comply with compliance rules and policies file 240.

[0058] In step 416, the system appends compliance code to non-compliant code files in the CI / CD pipeline. For example, in embodiments, the system appends separate compliance script updates containing compliance code to individual files containing non-compliant code, which may be source code files, IaC code files, and / or other CI / CD pipeline code files. In embodiments, and as described with respect to FIG. 2 , the recognition module 210 appends compliance code 236 to non-compliant code files in the CI / CD pipeline, such as source code 230 files, IaC code 232 files, or other pipeline configuration files 236 (including playbook files 234), for production of, for example, serverless modules 216, microservice modules 218, and / or gateway API modules 220 for deployment.

[0059] In stage 418, the system builds a CI / CD pipeline with the compliance code to generate a deployable image. For example, the system compiles the source code and the compliance code with the dependent code and builds an executable instance of the compiled code. In an embodiment, and as described with respect to FIG. 2, the continuous integration module 212 builds a CI pipeline with the compliance code to generate a deployable image.

[0060] In step 420, the system validates enterprise-wide policies for infrastructure services. For example, the system tests executable instances of the compiled code with the compiled compliance code to validate that the compiled code complies with the enterprise's compliance rules and policies. In an embodiment, and as described with respect to FIG. 2, continuous integration module 212 tests executable instances of the compiled code with the compiled compliance code to validate that the compiled code complies with compliance rules and policies file 240.

[0061] In stage 422, the system executes the CI / CD pipeline, completes the build using development scripts that meet the enterprise's security and compliance policies, and deploys the configured image into a production environment. For example, the system completes the build of code in the CI / CD pipeline, including compiled compliance code that has been validated as conforming to enterprise-wide policies for infrastructure services. In an embodiment, and as described with respect to FIG. 2, the continuous delivery module 214 packages the build into a deployable image, such as a container or virtual machine (VM) image, configures the deployable image for a runtime environment, and deploys the configured image into a production environment.

[0062] FIG. 5 shows an illustration of an exemplary process flow diagram according to an aspect of the present invention. In an embodiment, the process flow diagram in FIG. 5 illustrates the generation of test data from customers submitting crowdsourced test data used to train a cognitive module. Customer raw data 502, such as source code, IaC code, and / or other pipeline configuration code, can be analyzed using static code analysis 504 to identify security vulnerabilities. Customers developing compliant code for security vulnerabilities can label security vulnerabilities, also known as interactive problem labeling 506. If a customer decides to provide test data for aggregation with the crowdsourced training data 508, the training data is sanitized by a knowledge catalog 510 to anonymize customer-specific information and normalize the labeling to provide labeled, sanitized data 512. This labeled, sanitized data 512 is submitted to a crowdsourced data aggregator 528.

[0063] The quality test data 516 is curated to establish a benchmark for test results and can be input to the test recognition engine 518 along with the labeled and sanitized data 512 submitted to the crowdsourcing data aggregator 528. The performance of the detection engine can be checked, as indicated at 520. For example, if the speed of the detection engine improves, the number of false positives decreases, and / or the number of false negatives decreases, the performance of the detection engine is better. If the performance of the detection engine is better after adding the new training dataset, as indicated at 522, the recognition engine is retrained with the new data, as indicated at 534, and the recognition engine 538 is ready to be used to detect non-compliant code, generate compliant code, and validate the compliant code in the CI / CD pipeline. The submitter's reputation score is increased and provided to the crowdsourcing data aggregator 528, as indicated at 536. However, if the detection engine's performance does not improve after adding the new training data set, the training data is rejected as shown at reference numeral 524, and the submitter's trust score is lowered as shown at reference numeral 526 and provided to a crowdsourcing data aggregator 528.

[0064] Additionally, homomorphic encryption (HE) may be used by the crowdsourcing data aggregator on the crowdsourced data used by the cognitive module to share data without exposing the unencrypted crowdsourced data. The crowdsourcing data aggregator 528 may submit the labeled, sanitized data 512 to an HE processing engine 532 to encrypt the labeled, sanitized data 512 and then provide the encrypted, labeled, sanitized data 512, including compliance codes for security vulnerabilities, to the customer. The HE processing engine 532 also provides an encrypted risk score 530, which is provided to the customer as an unencrypted risk score 514 indicating the risk level in using the encrypted compliance codes from the crowdsourcing.

[0065] Additionally, the crowdsourced data aggregator 528 may store this crowdsourced data on the blockchain. Contributors to crowdsourced data will have the option to set a cryptocurrency address associated with their submission, for example, which provides an incentive for companies to share the best solutions they have researched and developed. Another company could use this submission to thwart an attempted attack, potentially saving the company millions of dollars. By incorporating smart contracts within the blockchain, the company could automatically pay the contributor a small reward for their contribution.

[0066] For example, Company A may define a method to check for and block a critical new vulnerability that allows an attacker to download all customer data from a web database. When Company A shares this solution with a crowdsourcing data aggregator on the blockchain, its cryptocurrency address is linked to this submission. Company B decides to include the submission in its environment. A week later, Company B's intrusion detection system detects a failed attack from someone trying to hack into the database, which was thwarted by the submission shared by Company A. By including a smart contract in the submission, Company A can automatically receive a certain amount of money as a reward for its contribution and the amount of money saved Company B.

[0067] 6-8 show flowcharts and / or block diagrams illustrating the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. As noted above with respect to any flowchart, depending on the technology involved, operations may be performed in an order different from that shown in a given flowchart. For example, depending again on the technology involved, two operations shown in successive flowchart blocks may be performed in the reverse order, as a single integrated step, simultaneously, or in an at least partially overlapping manner. Also, depending on the functionality involved, some blocks shown may be performed and other blocks may not be performed.

[0068] Figure 6 illustrates a flowchart of an exemplary method according to an aspect of the present invention. The method steps may be performed within the environment of Figure 2 and will be described with reference to elements shown in Figure 2. Specifically, the flowchart of Figure 6 illustrates an exemplary method for generating compliance code that updates code in a CI / CD pipeline to conform to compliance rules and policies according to an aspect of the present invention.

[0069] In step 602, the system receives compliance rules and policies. For example, with respect to database security, a compliance rule may exist that stipulates that access to a particular database requires a verified password. As another example, a compliance rule may exist that stipulates that a firewall for wireless access be configured with specific parameters in edge computing rather than default parameters. In one embodiment, the cognitive module includes a machine learning model using a long short-term memory (LSTM) algorithm, which is initially trained with positive examples that are code that follows the compliance rules, e.g., code that makes a database access request after receiving a valid password to access the database, and negative examples that are code that does not follow the compliance rules, e.g., code that makes a database access request without receiving a valid password to access the database. The cognitive module can process the code accordingly and detect code that does not comply with the compliance rules. In an embodiment, and as described with respect to FIG. 2, the cognitive module 210 receives the compliance rules and policies in the compliance rules and policies file 240. Those skilled in the art will appreciate that other recurring neural network algorithms, including gated recurring units (GRUs), may be used by the machine learning model.

[0070] In step 604, the system receives and processes source code. For example, source code in a CI / CD development pipeline may be input to a cognitive module to process and detect non-compliant code. When processing the source code, features are extracted from the source code and compared to features in a machine learning model extracted from examples of non-compliant code during training to detect non-compliant code in the source code. In an embodiment, and as described with respect to FIG. 2, cognitive module 210 receives and processes source code 230.

[0071] In step 606, the system receives and processes the IaC code. For example, IaC code in a CI / CD development pipeline may be input to a cognitive module to process and detect non-compliant code. When processing the IaC code, features are extracted from the IaC code and compared to features in a machine learning model extracted from examples of non-compliant code during training to detect non-compliant code in the IaC code. In an embodiment, and as described with respect to FIG. 2, cognitive module 210 receives and processes IaC code 232.

[0072] In step 608, the system receives and processes the playbook. For example, a playbook in a CI / CD development pipeline can be input to a cognitive module to process and detect non-compliant code. When processing a playbook, features are extracted from the playbook and compared to features in a machine learning model extracted from examples of non-compliant code during training to detect non-compliant code in the playbook. In an embodiment, and as described with respect to FIG. 2, cognitive module 210 receives and processes playbook 234.

[0073] In step 610, the system receives and processes other pipeline configuration files in addition to the playbook. For example, other pipeline configuration files in a CI / CD development pipeline may be input to the recognition module to process and detect non-compliant code. When processing the pipeline configuration files, features are extracted from the pipeline configuration files and compared to features in the machine learning model extracted from examples of non-compliant code during training to detect non-compliant code in the pipeline configuration files. In an embodiment, and as described with respect to FIG. 2, the recognition module 210 receives and processes the pipeline configuration file 238.

[0074] In step 612, the system receives and processes runtime processing logs. For example, runtime processing logs in a CI / CD development pipeline, including pipeline logs generated during testing in the CI / CD development pipeline, may be input to a cognitive module for processing and detecting non-compliant code. When processing the runtime processing logs, features are extracted from the runtime processing logs and compared to features in a machine learning model extracted from examples of non-compliant code during training to detect non-compliant code in the runtime processing logs. In an embodiment, and as described with respect to FIG. 2, cognitive module 210 receives and processes runtime processing logs 242.

[0075] In step 614, the system generates compliance code for any non-compliant code detected during code processing. For example, the recognition module 210 may generate code or scripts to update any non-compliant code detected by the machine learning model when processing source code, IaC code, playbooks, other pipeline configuration files, and runtime processing logs. The system may append compliance code to locations within the file where the non-compliant code was detected. The system may also validate that the code file with the appended compliance code complies with security and compliance policies. In an embodiment, and as described with respect to FIG. 2, the recognition module 210 generates compliance code 236 for any non-compliant code detected during code processing.

[0076] Figure 7 illustrates a flowchart of an exemplary method according to an embodiment of the present invention. The method steps may be performed in the environment of Figure 2 and will be described with reference to elements shown in Figure 2. Specifically, the flowchart of Figure 7 illustrates an exemplary method for updating a recognition engine using customer data according to an embodiment of the present invention.

[0077] In step 702, the system receives customer test data. For example, the customer data may be labeled examples of source code, IaC code, and / or other pipeline component code that have identified security vulnerabilities. Additionally, the customer test data may also include updated code that repairs the security vulnerabilities. In an embodiment, and as described with respect to FIG. 2, the test recognition module 222 receives the customer test data.

[0078] In step 704, the system receives quality test data. The quality test data is curated to establish benchmarks for test results of the performance of a test recognition module trained using customer test data. In an embodiment, and as described with respect to FIG. 2, the test recognition module 222 receives the quality test data.

[0079] In step 706, the system trains the test recognition module using the customer test data as training data. The test recognition module includes a machine learning model using an LSTM algorithm that is initially trained with quality test data that includes positive examples, which are code that follows compliance rules, and negative examples, which are code that does not follow compliance rules. The system trains the test recognition model using customer data that may include positive examples, which are code that does not have identified security vulnerabilities, and / or negative examples, which are code that does have identified security vulnerabilities. In an embodiment, and as described with respect to FIG. 2, server 206 trains test recognition module 222 using the customer test data as training data.

[0080] In step 708, the system determines whether detection at the test cognitive module has improved after training using the customer test data as training data. For example, if the detection speed has improved, the number of false positives has decreased, and / or the number of false negatives has decreased, then the performance of the test cognitive module is better. If detection at the test cognitive module has not improved, the system rejects the training data in step 710 and processing ends. If detection at the test cognitive module has improved, performance of the steps of the exemplary method continues in step 712. In an embodiment, and as described with respect to FIG. 2, server 206 determines whether detection at the test cognitive module 222 has improved after training using the customer test data as training data.

[0081] In step 712, the system retrains the cognitive module using the customer test data as training data. In one embodiment, the cognitive module's machine learning model uses an LSTM algorithm and is trained using customer data that may include positive examples, which are code that does not have the identified security vulnerability, and / or negative examples, which are code that has the identified security vulnerability. In an embodiment, and as described with respect to FIG. 2, server 206 trains cognitive module 210 using the customer test data as training data.

[0082] In step 714, the system stores the retrained cognitive module, and in embodiments, the customer training data. In addition to learning security vulnerabilities through training, the cognitive module can learn as it processes code throughout the iterations of developing that code in a CI / CD pipeline for an individual company. In this manner, the cognitive module can be customized by and for an individual company. In embodiments, and as described with respect to FIG. 2, server 206 stores the retrained cognitive module 210 in persistent storage, such as persistent storage 113 described with respect to FIG. 1. The updated cognitive engine is then ready to be used to detect non-compliant code, generate compliant code, and validate compliant code in a CI / CD pipeline.

[0083] Figure 8 shows a flowchart of an exemplary method according to an embodiment of the present invention. The method steps may be performed in the environment of Figure 2 and will be described with reference to elements shown in Figure 2. Specifically, the flowchart of Figure 8 shows an exemplary method for updating a recognition engine using crowdsourced data according to an embodiment of the present invention.

[0084] In step 802, the system receives crowdsourced test data. For example, the crowdsourced test data may be labeled examples of source code, IaC code, and / or other pipeline configuration code that have identified security vulnerabilities. Additionally, the crowdsourced test data may also include updated code that repairs the security vulnerabilities. The crowdsourced test data may be sanitized to anonymize customer-specific information, and the labeling may be normalized to provide labeled, sanitized data. In an embodiment, and as described with respect to FIG. 2, the test recognition module 222 receives the crowdsourced test data.

[0085] In step 804, the system trains a test cognitive module using the crowdsourced training data. The test cognitive module includes a machine learning model using an LSTM algorithm, and the system trains the test cognitive model using the crowdsourced training data, which may include positive examples, which are code that does not have the identified security vulnerability, and / or negative examples, which are code that has the identified security vulnerability. In an embodiment, and as described with respect to FIG. 2, server 206 trains test cognitive module 222 using the crowdsourced training data.

[0086] In step 806, the system determines whether detection in the test cognitive module has improved after training with the crowdsourced training data. For example, if the detection speed has improved, the number of false positives has decreased, and / or the number of false negatives has decreased, then the performance of the test cognitive module is better. If detection in the test cognitive module has not improved, the system rejects the training data in step 808, and performance of the steps of the exemplary method continues in step 810. If detection in the test cognitive module has improved, performance of the steps of the exemplary method continues in step 812. In an embodiment, and as described with respect to FIG. 2, server 206 determines whether detection in the test cognitive module 222 has improved after training with the crowdsourced training data.

[0087] In step 810, because the detection in the test cognitive module did not improve, the system lowers the submitter's credit score, and performance of the exemplary method steps continues in step 818. The credit score enables and supports setting a threshold for selecting submitters of crowdsourced update data for inclusion in future integrations. In an embodiment, and as described with respect to FIG. 2, if the detection in the test cognitive module 222 did not improve after training with the crowdsourced training data, the server 206 lowers the submitter's credit score.

[0088] If detection in the test cognitive module improved in step 806, the system retrains the cognitive module using crowdsourced training data in step 812. In one embodiment, the cognitive module's machine learning model uses an LSTM algorithm and is trained using crowdsourced training data, which may include positive examples, which are code that does not have the identified security vulnerability, and / or negative examples, which are code that does have the identified security vulnerability. In an embodiment, and as described with respect to FIG. 2, server 206 trains cognitive module 210 using the crowdsourced training data.

[0089] In step 814, the system stores the retrained cognitive module, and in embodiments, the crowdsourced training data. In embodiments, and as described with respect to Figure 2, server 206 stores the retrained cognitive module 210 in persistent storage, such as persistent storage 113 described with respect to Figure 1. The updated cognitive engine is then ready to be used to detect non-compliant code, generate compliant code, and validate compliant code in the CI / CD pipeline.

[0090] In step 816, the system increases the submitter's credit score. In an embodiment, and as described with respect to Figure 2, if the test recognition module 222 improves detection after training with the crowdsourced training data, the server 206 increases the submitter's credit score. Also, in step 818, the system stores the submitter's credit score. In an embodiment, and as described with respect to Figure 2, the server 206 stores the submitter's credit score.

[0091] In this manner, new or updated solutions for identifying security vulnerabilities in embodiments of the present disclosure are evaluated through a test cognitive engine. Solutions that improve the company's overall security posture are likely adopted, while solutions that do not are discarded. Advantageously, the cognitive engine can leverage crowdsourced, anonymized data to provide rapid training and value to new implementers of embodiments of the present disclosure. Furthermore, embodiments of the present disclosure enable the ongoing inclusion of best-of-breed solutions, whether developed in-house or externally by other companies.

[0092] In embodiments, a service provider may offer to implement the processes described herein. In this case, the service provider may create, maintain, deploy, support, etc., a computer infrastructure that implements the process steps of the present invention for one or more customers. These customers may be, for example, any business that uses technology. In return, the service provider may receive payments from the customers under subscription and / or fee agreements and / or the service provider may receive payments from the sale of advertising content to one or more third parties.

[0093] In yet additional embodiments, the present invention provides a computer-implemented method over a network, where a computer infrastructure, e.g., computer 101 of Figure 1, may be provided, and one or more systems for implementing the processes of the present invention may be acquired (e.g., created, purchased, used, modified, etc.) and deployed onto the computer infrastructure. To this extent, system deployment may be achieved by: This may comprise one or more of: (1) installing program code from a computer-readable medium onto a computing device, such as computer 101 of FIG. 1; (2) adding one or more computing devices to the computer infrastructure; and (3) incorporating and / or modifying one or more existing systems of the computer infrastructure to enable the computer infrastructure to perform the processes of the present invention.

[0094] The description of various embodiments of the present invention has been presented for illustrative purposes and is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein has been selected to best explain the principles, practical applications, or technical improvements of the embodiments over art found in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. receiving, by a processor, a plurality of infrastructure-as-code files that specify a configuration of a runtime environment for a deployable image of source code within a continuous integration and continuous delivery pipeline for a cloud platform; generating a compliance code for at least one of the plurality of infrastructure-as-code files by the processor; the processor building the deployable image of the source code in the continuous integration and continuous delivery pipeline according to the configuration and compliance code specified by the plurality of infrastructure-as-code files; and the processor deploying an instance of the image within the runtime environment. A method comprising:

2. The method of claim 1 , further comprising the processor receiving the source code in the continuous integration and continuous delivery pipeline for the cloud platform.

3. 3. The method of claim 2, wherein the source code is selected from the group consisting of source code for a serverless function, source code for a microservice, and source code for an API gateway.

4. The method of claim 1 , further comprising appending the compliance code to the at least one file.

5. receiving compliance rules for a security and compliance policy by the processor; and the processor detecting code in the at least one file of the plurality of infrastructure-as-code files that does not comply with compliance rules. The method of claim 1 further comprising:

6. generating additional compliance code for the source code; and the processor compiling the source code with the additional compliance code. The method of claim 1 further comprising:

7. The method of claim 1 , further comprising the processor validating that the plurality of infrastructure-as-code files with the compliance code adhere to security and compliance policies.

8. the processor inputting features of each of the plurality of infrastructure-as-code files into a machine learning model; and detecting from the machine learning model that the at least one file of the plurality of infrastructure-as-code files does not comply with the compliance rules of the security and compliance policy; The method of claim 1 further comprising:

9. 10. The method of claim 8, wherein the machine learning model uses a long short-term memory (LSTM) algorithm that is initially trained with positive examples, which are code that follows compliance rules, and negative examples, which are other code that does not follow the compliance rules.

10. The method of claim 9 , wherein the positive examples, which are code that conforms to the compliance rules, and the negative examples, which are other code that does not conform to the compliance rules, are crowdsourced.

11. 9. The method of claim 8, wherein the detecting step comprises comparing, with the machine learning model, the features of each of the plurality of infrastructure-as-code files with extracted features of negative examples, the negative examples being code that does not comply with compliance rules.

12. The method of claim 1 , wherein the plurality of infrastructure-as-code files comprises one or more playbooks.

13. 1. A computer program product comprising one or more computer-readable storage media having program instructions, the program instructions collectively stored on the one or more computer-readable storage media, the program instructions comprising: inputting characteristics of each of a plurality of code files in a continuous integration and continuous delivery pipeline for a cloud platform into a machine learning model trained with test data including examples of non-compliant code having security vulnerabilities; Detecting non-compliant code in at least one of the plurality of code files in the continuous integration and continuous delivery pipeline for the cloud platform with the machine learning model; building a deployable image of the source code in the continuous integration and continuous delivery pipeline according to a configuration of a runtime environment defined by the plurality of code files, including the at least one of the plurality of code files incorporating compliance code that repairs the security vulnerability; and Deploying an instance of the image within the runtime environment A computer program product that is executable to

14. 14. The computer program product of claim 13, wherein the plurality of code files includes infrastructure-as-code files.

15. 14. The computer program product of claim 13, wherein the program instructions are further executable to generate the compliance code for the at least one of the plurality of code files.

16. 14. The computer program product of claim 13, wherein the source code is selected from the group consisting of source code for a serverless function, source code for a microservice, and source code for an API gateway.

17. a set of processors, one or more computer-readable storage media, and program instructions collectively stored on the one or more computer-readable storage media, the program instructions comprising: Detecting code in at least one of a plurality of infrastructure-as-code files in a continuous integration and continuous delivery pipeline for a cloud platform that does not comply with security and compliance policy compliance rules; appending compliance code that conforms to the compliance rules of the security and compliance policy to the at least one file of the plurality of infrastructure-as-code files; and Deploying a deployable image of the source code in the continuous integration and continuous delivery pipeline into the runtime environment according to a configuration of the runtime environment defined by the plurality of infrastructure-as-code files including the at least one file to which the compliance code that complies with the compliance rules has been appended. The system is viable as follows:

18. 20. The system of claim 17, wherein the program instructions are further executable to generate the compliance code for the at least one file of the plurality of infrastructure-as-code files.

19. 20. The system of claim 17, wherein the program instructions are further executable to validate that the plurality of infrastructure-as-code files, including the at least one file to which the compliance code that complies with the compliance rules has been appended, conform to the compliance rules of the security and compliance policy.

20. 20. The system of claim 17, wherein the program instructions executable to detect code comprise program instructions executable to apply LSTM analysis of the code within a machine learning model trained using crowdsourced data.

Images