57 results about "Infrastructure as code" patented technology

A system and method for applying a unified security policy across a technology stack, includes detecting a cloud object in a first cloud computing environment, the cloud object including a plurality of attributes, each attribute having a corresponding value; detecting a node in a security graph having a data field value which matches an attribute value of the cloud object, wherein the security graph includes a representation of a cloud environment; applying a policy based on the data field value to the detected cloud object; and applying the policy to another cloud object in a second cloud computing environment, in response to determining that a node representing the cloud object in the security graph is connected to a node representing the another cloud object.

A computer-implemented method, according to one embodiment, includes analyzing a deployment plan for an instance of Infrastructure as Code (IaC) code to identify a plurality of milestones of the deployment plan, and creating access policies for the identified milestones. The method further includes monitoring milestone state logs during an execution of the instance of IaC code for occurrence of predetermined milestone events. In response to a determination that a first of the predetermined milestone events has occurred, first user device access permissions are adjusted based on the created access policies. A computer program product, according to one embodiment, includes a computer readable storage medium having program instructions embodied therewith. The program instructions are readable and / or executable by a processing circuit to cause the processing circuit to perform the foregoing method.

A system and method for an infrastructure as code (IaC) environment includes automatically generating different infrastructure code for different timepoints based at least in part on changes in infrastructure configurations at the different timepoints of a first virtual private cloud (VPC) so as to execute one of the different infrastructure code for a second VPC to cause deployment of one of the infrastructure configurations; and includes automatically generating or updating a script based at least in part on changes in the infrastructure code, the script to be used to deploy at least a version of the infrastructure configurations with the changes in a second VPC of a different geographical location than associated with the first VPC.

A computer-implemented method of automatic infrastructure as code (IaC) remediation. The method includes encoding one or more policy statements and parsing IaC code to generate resources and configuration sets for the IaC code. The method includes intersecting the encoded one or more policy statements with the resources and configuration sets. The method includes identifying one or more non-compliant IaC resources based on differentiations between the encoded one or more policy statements with the resources and configuration sets. The method includes generating remediated IaC code to remediate identified non-compliant IaC code. The method includes verification that remediated IaC code fixes the intended issue.

Systems and methods for providing an automated quality assurance framework for infrastructure as code (“IaC”) implementations are provided. Pull requests with proposed change to existing IaC source code (“changed code”) are received from user devices, each associated with either a service enablement team member or an applications development team member. Team specific versions of the quality assurance framework are automatically triggered for the changed code which require successful passage through multiple modules, such as in a successive manner, before automatically being merged into the existing IaC source code.

Examples described herein relate to providing a simplified interface by a cloud platform to an IaC service. According to an example, operational details associated with multiple infrastructure as code (IaC) tools are abstracted by providing an application programming interface (API) of an IaC service through which multiple IaC templates are available for use to deploy workloads against multiple services within a cloud platform. Each IaC template describes a workload according to an IaC tool and specifies input parameters for the workload. A request to create a deployment based on a particular IaC template is received via the API. The request is satisfied by internally executing the IaC tool associated with the particular template based on parameter values supplied for the specified input parameters for the particular workload.

A system and method for detecting excessive permissions of a principal in a cloud computing environment utilizes code objects of infrastructure as code. The method also includes accessing a configuration code, the configuration code including a plurality of code objects, where a code object of the plurality of code objects corresponds to a deployed principal in the cloud computing environment; detecting in a log a plurality of access events, each access event associated with a first principal deployed in the cloud computing environment based on a first code object of the plurality of code objects; determining that the first code object includes a permission which is not utilized in any of the plurality of access events; and initiating a mitigation action for the first principal based on the permission.

Provided are techniques for a secure IaC solution for deploying cloud resources. A signed Infrastructure as Code (IaC) solution is received. A policy check is performed to determine that the signed IaC solution conforms to one or more policies. An automated validation of the signed IaC solution is performed to check for one or more compliance or security issues. A signature check of the signed IaC solution is performed to determine that the signed IaC solution has not been tampered with. It is determined that the signed IaC solution is authorized to be deployed by checking a trusted profile. The signed IaC solution is executed to deploy cloud resources.

Techniques described herein relate to creating and managing groups of cloud-based environments. An interface may be provided through which operators can provide environment configuration variables and request creation and deployment of cloud computing environments. The operator may provide configuration variables via the interface for the requested environment, and the configuration variables may be integrated into pre-existing templates for the organization compliant with a cloud provisioning system. Separate project spaces may be created and conditioned to generate different cloud environments, and infrastructure as code (IaC) configuration files or other executable software based on the variabilized templates may be stored in a project space. A continuous integration and deployment pipeline may be executed to invoke the cloud provisioning system to execute the IaC configuration files within the project space, to provision the requested cloud computing environment within a cloud of a cloud service provider.

A system and method for the centralized management of distributed intermittently connected runtime platforms. The method may include creating an artifact store pre-loaded with a set of utilities, libraries, and artifacts necessary to perform initial infrastructure creation in a local environment, creating an instance infrastructure for a central management system, and creating two or more availability zones, wherein each availability zone includes a private subnet and a public subnet. The method may further include transferring state data necessary to perform infrastructure as code (IaC) automation from the local environment to the artifact store.

An example method of managing infrastructure in a cloud includes: receiving, at a remote worker from a cloud automation service, a task to be executed for managing the infrastructure, the remote worker executing in a customer environment that includes the infrastructure, the remote worker having a runtime, the cloud automation service executing external to the customer environment; retrieving, using first credentials obtained by the runtime from the customer environment, source code from a version control system executing in the customer environment; and executing, by the runtime, the source code to manage the infrastructure in the customer environment according to the task.

A method may include detecting, by an integrated development environment (IDE), a code modification of an Infrastructure as Code (IaC) module; identifying a resource modification associated with the code modification; determining an estimated cost associated with the resource modification; and visually rendering information reflecting the estimated cost in a visual association with the code modification.

To present a process for defining cloud services in an Infrastructure as Code (IaC) tool.SOLUTION: A method dynamically determines the number of clusters, availability domains, compute nodes, and load balancers to define cloud services in an IaC tool. These values are used for determining the number of subnet levels required for Classless Inter-Domain Routing (CIDR) slicing operations to generate subnets for the compute nodes and load balancer nodes in the service. Because IaC languages do not provide nested loop control constructs, labels for each of the subnets are generated and assigned using a Cartesian product of label elements. These labels are modified by a count variable that is incremented each time a resource is duplicated in a script to simulate the effect of a nested loop construct.SELECTED DRAWING: Figure 7

A computing platform comprising a plurality of disaggregated data center resources and an infrastructure processing unit (IPU), communicatively coupled to the plurality of resources, to compose a platform of the plurality of disaggregated data center resources for allocation of microservices cluster.

A system and method for secure deployment of computing infrastructure resources. The method includes identifying a first set of attributes in original definitions of computing infrastructure resources, where each original definition is a definition of a respective computing infrastructure resource; mapping the first set of attributes to a second set of attributes of a generic definition template to determine a matching generic definition template for each original definition, where each of the generic definitions corresponds to a respective type of computing infrastructure resource and is defined in a unified format; converting the original definition into a generic definition using the generic definition template, where converting each original definition further comprises: inserting at least one of the first set of attributes into a matching generic definition template for the original definition; and managing deployment of the computing infrastructure resources based on the generic definition.

A method is provided, in which infrastructure configuration parameters received from a configuration management database are converted into an infrastructure-as-code configuration language file. Infrastructure configuration modifications are applied to the infrastructure-as-code configuration language file. The modified infrastructure-as-code configuration language file is forwarded to an infrastructure-as-a-service provider. Provisional infrastructure-as-code parameters output by the infrastructure-as-a-service provider in response to the modified infrastructure-as-code configuration language file are converted to updated infrastructure configuration parameters. The updated infrastructure configuration parameters are transmitted for storage in the configuration management database.

A computer-implemented method of packaging one or more module source files for an infrastructure as code, IaC, module, wherein the IaC module is not able to store binary files, the method comprising: parsing one or more module source files to identify at least one relative path to a binary file; for each relative path identified, adjusting the one or more module source files by replacing the relative path with an absolute path to an object stored in a cloud-based object storage, the object containing content from the binary file; and packaging the one or more adjusted module source files into the IaC module.

Systems and methods for providing an automated quality assurance framework for infrastructure as code (“IaC”) implementations are provided. Pull requests with proposed change to existing IaC source code (“changed code”) are received from user devices, each associated with either a service enablement team member or an applications development team member. Team specific versions of the quality assurance framework are automatically triggered for the changed code which require successful passage through multiple modules, such as in a successive manner, before automatically being merged into the existing IaC source code.

A system and method for detecting a vulnerable workload deployed in a cloud environment based on a code object of an infrastructure as code file utilizes a security graph. The method includes: extracting the code object from a state file, which includes a mapping between the code object to a first deployed workload and a second deployed workload; generating a node representing the code object in the security graph; generating a connection in the security graph between the node representing the code object and a node representing the first workload and a connection between the node representing the code object and a node representing the second workload; and determining that the second workload is a vulnerable workload, in response to detecting that the first workload node is associated with a cybersecurity threat, and that the nodes representing the workloads are each connected to the node representing the code object.

A system and method for planning IT infrastructure using ephemeral attribute values for a configuration of the IT infrastructure. A system includes an infrastructure as code (IaC) tool configured to manage a IT infrastructure according to at least one plan file and at least one state file. The IaC tool including a syntax structure configured to designate one or more of the values as ephemeral so that each designated value is not persisted in the at least one plan file or in the at least one state file. The system further includes a user interface having a command line interface for receiving input to create the at least one plan file.

A computer-implemented method of automatic infrastructure as code (laC) remediation. The method includes encoding one or more policy statements and parsing laC code to generate resources and configuration sets for the laC code. The method includes intersecting the encoded one or more policy statements with the resources and configuration sets. The method includes identifying one or more non-compliant laC resources based on differentiations between the encoded one or more policy statements with the resources and configuration sets. The method includes generating remediated laC code to remediate identified non-compliant laC code. The method includes verification that remediated laC code fixes the intended issue.

A method is provided, in which infrastructure configuration parameters received from a configuration management database are converted into an infrastructure-as-code configuration language file. Infrastructure configuration modifications are applied to the infrastructure-as-code configuration language file. The modified infrastructure-as-code configuration language file is forwarded to an infrastructure-as-a-service provider. Provisional infrastructure-as-code parameters output by the infrastructure-as-a-service provider in response to the modified infrastructure-as-code configuration language file are converted to updated infrastructure configuration parameters. The updated infrastructure configuration parameters are transmitted for storage in the configuration management database.

A computing platform comprising a plurality of disaggregated data center resources and an infrastructure processing unit (IPU), communicatively coupled to the plurality of resources, to compose a platform of the plurality of disaggregated data center resources for allocation of microservices cluster.

An automated infrastructure creation service of a service provider network may be used to create infrastructure for a virtual computing environment of the service provider network based on application code. The service identifies a data structure(s) in application code, the application code to be executed in a virtual computing environment of the service provider network, and the service generates a manifest(s) based on the data structure(s) identified in the application code. Infrastructure as code (IaC) can then be executed to create infrastructure for the virtual computing environment based at least in part on the manifest(s). Accordingly, the IaC uses the application code to create infrastructure. In this way, duplicity in the process of developing IaC and application code is reduced, or eliminated, and errors in the respective code bases are mitigated.

Provided is a system for orchestration of a mainframe computing environment. The system may include a mainframe. The system may include components such as a computer processor, a controller, a computing layer, a storage layer, and a network layer. The computer processor may run on the mainframe. The computer processor may utilize an application programming interface (API) to stitch the mainframe with the computing layer, the storage layer, and the network layer. An infrastructure as code (IaC) format may stitch together the components of the system. The computer processor may use the controller to utilize the IaC format to orchestrate the mainframe computing environment. The computer processor may optimize the utilization of the mainframe computing environment.

A system and method for cloud migration including deploying a plurality of resources in a cloud computing environment, is presented. The method includes accessing a plurality of code objects located in a code repository; generating a declaration code for an Infrastructure as Code (IaC) platform based on code objects, wherein the code objects are integrated into the declaration code and located in a IaC configuration file; and initiating network discovery to detect a plurality of resources in a cloud computing environment wherein each resource is deployed in the cloud computing environment based on the code objects of the declaration code located in the IaC configuration file.

A method for constructing an infrastructure as code is provided. The method comprises: inputting security information about a target service into a language model; using information output from the language model, so as to generate a security policy corresponding to the security information; inputting the security policy into the language model; using information output from the language model, so as to acquire attribute information about the target service and a first code script corresponding to the security policy; inputting the attribute information and the first code script into the language model; using information output from the language model, so as to generate a second code script for constructing an infrastructure of the target service; and using the second code script so as to automatically construct the infrastructure for providing the target service.

A unified cloud configuration evaluation (UCCE) system is described capable of evaluating both asset configurations in a live cloud environment and proposed configuration changes produced by a cloud configuration development (CCD) system. In embodiments, the UCCE system may be implemented as a Cloud Security Posture Management (CPSM) system that monitors assets in the cloud environment and check the assets' configurations for compliance with a set of compliance rules. In embodiments, the UCCE system ingests a cloud configuration definition generated by the CCD system. In embodiments, the CCD system is implemented as an Infrastructure as Code (IaC) system that allows a user to create a cloud configuration definition that describes proposed configuration changes to the cloud environment. The UCCE system is configured to interpret the cloud configuration definition and analyze the proposed configuration changes for compliance using the same set of compliance rules used for the live cloud environment.