Cloudpolicy-Infra: Automated Security Hardening Via Policy-As-Code In Cloud Devops Pipelines

Paper ID: EIJTEM_2026_13_3_223-237

Author's Name: Pratyay Paul, FatemaTuzZohora

Volume: 13

Issue: 3

Year: 2026

Page No: 223-237

Abstract:

The deployment of cloud infrastructure is increasingly adopting infrastructure as code and continuous delivery to reduce operational effort and cycle time. However, this transition introduces a critical conflict: the speed of infrastructure change often outpaces traditional security review processes. We introduce CloudPolicy-Infra, a framework designed to address this issue by enabling the execution of Policy-as-Code (PaC) unit tests within Continuous Integration and Continuous Deployment (CI/CD) pipelines for security validation. CloudPolicy-Infra is a framework that integrates Open Policy Agent (OPA) with Conftest to run PaC tests on Terraform plans, checking for compliance with the CIS AWS Foundations Benchmark and NIST 800-53 controls prior to resource provisioning. We evaluate CloudPolicy-Infra in an emulation testbed that models a financial services deployment using AWS resources for the development, QA, and production control gates. According to five deployment cycles’ results in the testbed, it is observed that CloudPolicy-Infra reduced policy violations by 83%, reduced the mean remediation time of the violations from 14.0 to 1.5 hours and increased the pipeline latency by 1.2 minute per pipeline run. The findings suggest that automated policy enforcement shows real promise for maintaining continuous compliance without decelerating deployment pipelines. Our framework can help organizations toward DevSecOps maturity.

Keywords: Policy-as-Code, CI/CD pipelines, infrastructure hardening, Open Policy Agent, DevOps security, cloud compliance, Infrastructure as Code.

References:

[1] N. Thallapally, “Implementing continuous integration and continuous deployment (CI/CD) pipelines,” International Journal of Science and Research Archive, vol. 3, no. 2, pp. 248–253, 2021.
[2] M. Soni, “End to End Automation on Cloud with Build Pipeline: The Case for DevOps in Insurance Industry,” in Proc. CCEM, 2015.
[3] Y. Avuthu, “Change management and rollback strategies using IaC in CI/CD pipelines,” International Journal of Science and Research Archive, vol. 2, no. 1, pp. 160–168, 2021.
[4] S. Vignesh and B. R. Kanna, “AWS infrastructure automation and security prevention using DevOps,” in Proceedings of the International Conference on Intelligent Computing and Control Systems (ICICCS), Springer, 2020, pp. 537–549.
[5] A. Rahman, S. A. Hossain, and R. Sharma, “Security smells in infrastructure as code: A taxonomy update beyond the seven sins,” in Proc. IEEE/ACM Int. Conf. Softw. Eng. (ICSE), 2025, pp. 1–12.
[6] M. P. A. de Souza, “Assessing the adoption of security policies by developers in terraform across different cloud providers,” Empirical Software Engineering, vol. 30, no. 3, pp. 1–25, 2025, doi: 10.1007/s10664-024-10610-0.
[7] A. Paul, R. Manoj, and S. Udhayakumar, “Amazon Web Services Cloud Compliance Automation with Open Policy Agent,” in Proc. Int. Conf. Expert Clouds Appl. (ICOECA), IEEE, 2024, pp. 1–5, doi: 10.1109/ICOECA62351.2024.00063.
[8] A. Zakharchenko, “Integrating Continuous Compliance into DevSecOps Pipelines: A Data Engineering Perspective,” Software, vol. 5, no. 1, pp. 1–25, 2026, doi: 10.3390/software5010006.
[9] P. Chuprikov, P. Eugster, and S. Mangipudi, “Security Policy as Code,” IEEE Security & Privacy, vol. 23, no. 2, pp. 23–31, Mar./Apr. 2025, doi: 10.1109/MSEC.2025.3525909.
[10] Open Policy Agent, “Documentation,” 2025. [Online]. Available: https://www.openpolicyagent.org/
[11] HashiCorp, “Sentinel Documentation,” 2025. [Online]. Available: https://www.hashicorp.com/sentinel
[12] Center for Internet Security, “CIS AWS Foundations Benchmark,” 2022.
[13] National Institute of Standards and Technology, “NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations,” 2020.
[14] J. Willis, “What Is DevSecOps?” DevOps.com, 2021.
[15] M. Opdeweegh and R. Johnson, “Defect prediction in infrastructure as code scripts,” in Proc. IEEE Int. Conf. Softw. Maint. Evol. (ICSME), IEEE, 2023, pp. 1–12.
[16] S. Miller and T. Johnson, “Comparative analysis of static analysis tools for infrastructure as code security,” in Proc. IEEE/ACM Int. Workshop Cloud Intell. (CloudInt), 2024, pp. 1–8.
[17] J. Choi, K. Lee, and S. Park, “Adoption of Security-as-Code practices in enterprise DevOps environments,” IEEE Transactions on Software Engineering, vol. 50, no. 3, pp. 456–472, 2024.

View PDF