Cloud Deployment Configuration Management Engine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face challenges in managing cloud deployment configuration files and container base images, including lack of visibility and control over new configurations, high manual effort, and risk of using compromised or vulnerable base images.
Innovation Solution
A system and method that utilize a cloud platform deployment management engine to analyze application source code, identify best-practice violations, and execute remediation actions, while validating base images for security and vulnerabilities, and triggering test runs to ensure functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If base images are pulled directly from source registries, then deployment speed is improved, but security risk increases due to compromised or vulnerable base images
Solution Approach 1:
The patent introduces an intermediary registry that acts as a mediator between source registries and deployment environments. Base images are first pulled from source registries, validated for security vulnerabilities, and then stored in the intermediary registry before being used in deployments. This intermediary layer maintains deployment speed while ensuring security through validation.
Solution Approach 2:
The patent performs preliminary security validation and vulnerability scanning of base images before they are deployed. By checking base images in advance and storing validated images in the intermediary registry, the system ensures that only secure images are used in deployments, eliminating the need for slow runtime security checks.
2Measurement precision
If manual management of cloud deployment configurations is performed, then control and visibility are improved, but time consumption and error-proneness increase
Solution Approach 1:
The patent implements automated self-service mechanisms where the system automatically pulls base images from source registries, validates them for security, stores them in the intermediary registry, and manages deployment configurations without manual intervention. This automation maintains precise control over configurations while eliminating time-consuming manual processes.
Solution Approach 2:
The patent incorporates feedback loops where the system automatically monitors deployment configurations, validates base images, and adjusts deployments based on security validation results. This automated feedback mechanism ensures configuration control while reducing time consumption compared to manual monitoring and adjustment.
3Ease of manufacture
If existing techniques analyze generated artifacts, then vulnerability detection is simplified, but information loss occurs as base image details are not detected
Solution Approach 1:
The patent performs preliminary analysis of base images before they are used in deployments. By extracting and analyzing base image information in advance and storing it in the intermediary registry, the system simplifies subsequent vulnerability detection while preserving complete base image information for future reference and analysis.
Data Source
AI summary
A system and a method for managing cloud deployment configuration files and container base images for applications is provided. One or more application source code associated with configuration files and container images of applications are analyzed based on one or more pre-defined rule sets for determining cloud platform best-practice violations associated with the application source code. Further, impact on the application source code due to cloud platform changes is identified based on one or more search sets. Further, one or more remediation actions are executed for rectifying the determined cloud platform best-practice violations associated with the impacted application source code based on one or more remediation types. Base images of the container images are validated to be secure and without vulnerabilities. Lastly, a test run is triggered to determine that the remediation actions have not removed functionalities associated with the application source code.