Research on Security Challenges in Cloud Environments

and Solutions based on the “Security-as-Code” Approach

Oleksandr Vakhula1, Ivan Opirskyy1, and Olha Mykhaylova1
1 Lviv Polytechnic National University, 5 Knyaz Roman str., Lviv, 79013, Ukraine

Abstract
“Security as code” is an approach to security organization in cloud environments, which
is based on the method of integrating security controls, policies, and best practices
directly into the software development and deployment processes. The integration
process includes the transformation of security requirements and configurations into
software code, which in turn is considered an integral part of the full software
development life cycle. By embedding security measures into code, scripts, templates, and
automated workflows, an organization ensures that there are well-defined security
controls that will be consistently enforced across all operational phases of software
creation (development, testing, implementation, and support). This article examines the
main problems of building security in cloud environments and their causes, also
considers the components and principles of the “Security as Code” approach,
implementation examples with an explanation, of the advantages of this approach, as well
as the role of DevSecOps. This article aims to help readers understand the importance of
the security-as-code approach as one of the most effective methods for managing security
in cloud environments. As cloud environments continue to evolve and proliferate, and
threats become more sophisticated, the Security as Code approach represents a core
strategy for proactively protecting digital assets. This publication serves as a guide to
understanding, implementing, and benefiting from a security-as-code approach,
providing insight into the future cloud security landscape and the critical role of
automation and integration in addressing today’s security challenges. To support the
research, an extensive review of literature and articles providing information on the
Security as Code approach and its application was conducted.

Keywords 1
Security as code, Infrastructure as code, DevSecOps, DevOps, cloud environments, cloud
service provider, software development cycle, cloud security threats, shift-left security
approach.

1. Introduction “Security as Code”, born at the intersection of

cybersecurity and software development,
In cloud computing, which is constantly represents a paradigm shift in how
evolving and combining flexibility and organizations conceptualize, implement, and
innovation, the importance of robust security maintain their security strategies in cloud
measures cannot be overstated. As environments. This approach encapsulates the
organizations continue to harness the fusion of security principles into code, creating
transformative potential of cloud technologies, a proactive, automated, and integrated security
the need to protect digital assets from a ecosystem seamlessly aligned with modern
growing spectrum of threats becomes not just development methodologies [3–4].
a priority but a strategic imperative [1–2]. The authors examine the fundamental
security challenges faced by consumers of

CPITS-2023-II: Cybersecurity Providing in Information and Telecommunication Systems, October 26, 2023, Kyiv, Ukraine
EMAIL [email protected] (O. Vakahula); [email protected] (I. Opirskyy); [email protected]
(O. Mykhaylova)
ORCID: 0009-0008-5367-3344 (O. Vakahula); 0000-0002-8461-8996 (I. Opirskyy); 0000-0002-3086-3160 (O. Mykhaylova)
©️ 2023 Copyright for this paper by its authors.
Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0).

CEUR Workshop Proceedings (CEUR-WS.org)

55
cloud services. Root causes include a lack of The latest research in this field shows, that,
understanding of the shared responsibility Security as Code is the driving force behind
model, which is foundational; the dynamic and future application security. According to
scalable nature of the environment, unlike O’Reilly, Security as Code is a way to build
traditional on-premises infrastructure; Security by mapping how code and
inadequate visibility of resources or “shadow infrastructure change to DevOps tools and
IT;” underestimating risks associated with workflows and finding places to add security
APIs; the complexity of navigating data in a controls, tests, and ports without cost or delay.
distributed environment, including sensitive Developers can define the infrastructure using
data; manual configuration settings and the a programming language with Infrastructure as
high likelihood of errors due to human factors; Code. You need to do the same to bring security
the complexity of Identity and Access up to DevOps speed [11].
Management (IAM) services; multi-cloud and All of the above allows us to assert the
hybrid environments; and the shortage of relevance of the issue and calls for proposals
qualified cloud security professionals— on its resolution. In this publication, we will
demand outweighs supply [5]. focus on the active security approach as a form
This publication aims to highlight the of security code that can be considered
aforementioned problems, actuality, and their preventive security control.
root causes, and to explore the “Security as
Code” approach, which can help to solve part of 2. Challenges in Organizing
it and mitigate risks related. A lot of articles
point out that DevOps practitioners degrade Security in Cloud Environments
the priority of security since the regard 2.1. Shared Responsibility Model,
security is the biggest hurdle to rapid Leading to Confusion over Security
application development considering Responsibilities
traditional security methods do not fit the
pipeline and are an inhibitor to DevOps agility [6]. The problem of cloud providers following a
Traditionally, security measures are shared responsibility model, leading to
typically addressed after the development confusion over who is responsible for securing
team has completed the product. This approach what, is a crucial aspect of cloud security that
often results in a backlog of challenging bugs to organizations must address. In cloud
fix. The project manager may think, “If we computing, the shared responsibility model is
implement all these fixes, we'll be delayed, and a widely accepted framework that defines the
the company won't be pleased. Let's put it off division of security responsibilities between
until the next iteration” [7–8]. the Cloud Service Provider (CSP) and the cloud
As an illustration, consider a scenario where customer (organization using the cloud
a product manager wants to grant customers services). The exact responsibilities assigned
access to certain data without requiring any to each party can vary depending on the type
form of authentication. In the past, the security of cloud service, such as Infrastructure as a
team has consistently rejected such requests. Service (IaaS), Platform as a Service (PaaS), or
However, with the implementation of Software as a Service (SaaS).
DevSecOps, the response shifts to, “Yes, you can
provide this access, but it must be done in a
secure manner” [9]. In many instances, in
pursuit of business agility and velocity,
essential security aspects are overlooked in
operational applications. Security is often
relegated to the final check, conducted after the
application is fully developed. In practical
terms, ensuring security with each iteration
can be a considerable challenge, both in terms
of time and financial resources, unless it is
deliberately incorporated into the early stages
of the DevOps workflow [10]. Figure 1: AWS Shared Responsibility Model [12]

56
Cloud providers, like AWS, Azure, and Google challenging without comprehensive
Cloud, are responsible for the security of the monitoring of the entire cloud ecosystem.
underlying cloud infrastructure, including the Compliance with standards is a crucial
physical data centers, networking, and the requirement for organizations. The absence of
hypervisor layer. They also typically provide visibility complicates the ability to
security features and controls related to the demonstrate compliance with standards to
overall cloud platform’s integrity and availability. auditors and regulatory bodies, potentially
On the other hand, cloud customers resulting in fines and reputational damage.
(organizations) are responsible for securing
their data, applications, configurations, and 2.3. Complex IAM—Ensuring
access controls within the cloud environment. Comprehensive Identity and Access
This includes securing virtual machines, Management Across Multiple Cloud
containers, databases, and any other resources Services
they deploy on the cloud platform. Customers
are also responsible for managing user access
Modern cloud environments encompass a wide
and permissions, implementing encryption,
range of services, each with its own set of user
and configuring security settings specific to
accounts, access control mechanisms, and
their cloud resources.
authorization systems. These services can
The challenge arises when there is a lack of
cover infrastructure resources, applications,
clarity or understanding about where the CSP’s
databases, and more, and are often provided by
responsibilities end and the customer’s
various cloud providers.
responsibilities begin.
Each cloud provider typically maintains its
repository of identity data, which stores user
2.2. Lack of Visibility—Inadequate information, account details, and access
Insight into Cloud Environments policies. This diversity of identity data
repositories creates what is known as a user
The cloud environment, by its nature, is identity data silo and complicates the task of
complex and consists of numerous services, unified identity management across all
components, containers, and microservices providers and services.
distributed across different regions. This In multi-cloud environments, users and
distributed multi-component structure creates applications often require interaction between
a vast attack surface, making it extremely different services. Managing access and
important to maintain complete visibility of all permissions necessary for these interactions
assets within the cloud ecosystem. can quickly become complex, leading to errors,
Traditional security tools designed for on- misconfigurations, and security gaps.
premises environments find it challenging to The vast number of permissions and roles that
adapt to the dynamic cloud landscape. The need to be defined, managed, and reviewed
traditional concept of a “perimeter” lacks clear increases the likelihood of errors and oversight.
boundaries, complicating the monitoring and Complex access management scenarios
protection of interactions between various amplify security risks. Users may be granted
components. excessive permissions or incorrect
The lack of visibility leads to “blind spots” configurations may inadvertently provide
where security teams cannot effectively unauthorized access to confidential data. These
monitor and detect events in cloud resources. vulnerabilities can be exploited by malicious
Configuration errors, anomalous behavior, actors to gain unauthorized access.
unauthorized access, and potential breaches
can go unnoticed, putting confidential data and
critical business services at risk.
Detecting incidents, indicators of
compromise, identifying the root cause of an
incident (the so-called “patient zero”), tracking
the spread, and containment become

57
2.4. Security Configuration 2.5. API Security—Safeguarding
Management—Navigating the Cloud Environments from
Complexity of Consistent Security Vulnerabilities in APIs
Configurations in Cloud Services
Cloud services heavily rely on Application
As organizations transition to cloud Programming Interfaces (APIs), which can be
environments, the management of security vulnerable to attacks. Very often, security
configurations becomes a paramount concern. engineers underestimate this vector.
Cloud services offer unprecedented flexibility Application Programming Interfaces serve
and agility, allowing resources to be as a crucial link facilitating interactions
provisioned, modified, and decommissioned between cloud services. This technology allows
rapidly. However, this dynamic nature developers to access cloud resources,
introduces a significant challenge: ensuring manipulate data, and execute functions
consistent and robust security configurations remotely. While this streamlined interaction
across the multitude of services, instances, and enhances efficiency, it also exposes APIs to
platforms that constitute a modern cloud potential security risks.
ecosystem. Because APIs facilitate communication
Cloud environments are designed for agility, between various components, they can become
with resources being created, scaled, and entry points for attackers. Weaknesses in API
terminated dynamically. This dynamism design, implementation, or authentication can
accelerates development and deployment but be exploited for unauthorized access, injection
complicates the task of maintaining consistent attacks, or data breaches.
security settings. Common vulnerabilities that can harm APIs
In the cloud, security misconfigurations are in cloud environments include:
a leading cause of data breaches and cyber Injection Attacks: Insufficient input data
incidents. A single misconfigured security validation can lead to injection attacks where
group, firewall rule, or access policy can expose malicious code or commands are inserted into
sensitive resources to unauthorized access. the input.
Modern cloud environments offer a bunch Broken Authentication: Weak
of services, each with its security controls, authentication mechanisms or improper
access mechanisms, and configuration options. session management can allow unauthorized
Securing virtual machines, databases, access to APIs.
serverless functions, and containers requires Insecure Deserialization: Mishandling
mastering different configurations. serialized data can result in remote code
Multi-cloud and hybrid cloud strategies execution.
often involve services spread across different Inadequate Authorization: Flaws in access
cloud providers, regions, and accounts. control mechanisms can permit users to
Ensuring consistent security configurations perform actions they are not authorized for.
across this scale is a formidable task. Exposure of Sensitive Data: Mishandling
As cloud resources evolve, security of data or improper encryption can lead to the
configurations can drift away from best leakage of sensitive information.
practices or organizational policies. Manual In multi-cloud and hybrid cloud
interventions and updates can lead to environments, third-party developer APIs
deviations from desired security settings. further complicate the security landscape.
Meeting regulatory requirements and Organizations often rely on external APIs for
industry standards demands consistent specialized services, expanding the attack
security configurations. Failing to maintain surface.
these configurations can result in compliance
violations and legal consequences.

58
2.6. Data Protection and Compliance nuances of security features and configurations
Challenges Arising from Dispersed for each platform.
Cloud Data Consistent threat detection and response
processes in multi-cloud environments pose a
Cloud environments offer flexibility, allowing challenge for security teams. Different
organizations to distribute data among monitoring tools and mechanisms complicate
different services, regions, and even multiple the standardization of threat detection
cloud providers. Data can be stored in procedures and incident response.
databases, file systems, object stores, and more, In hybrid environments, where data moves
encompassing a wide spectrum of cloud between on-premises infrastructure and
resources. multiple cloud platforms, data protection and
Effective data protection requires secure data transfer become even more
encryption both at rest and during complex due to a lack of complete visibility.
transmission and processing. However,
different cloud services may employ various 2.8. Lack of Cloud Security Expertise—
encryption methods, key management Confronting the Challenge of Insufficient
techniques, and security levels. Managing Cloud Security Knowledge
encryption in these services can be complex.
Managing access control and permissions The rapid evolution of cloud computing has
for decentralized data is a challenging task. revolutionized the way organizations operate,
Improperly configured access control can lead but it has also exposed a critical challenge: the
to unauthorized access, data leaks, and scarcity of cloud security expertise. As
compliance violations. businesses transition to cloud environments,
In multi-cloud environments where data they often find themselves grappling with the
can be stored on various cloud platforms, complexities of securing these dynamic and
compliance with regulatory standards distributed systems. The shortage of skilled
becomes even more challenging. professionals who possess the necessary cloud
Compliance with data residency and security knowledge presents a significant
jurisdiction rules poses a complex challenge. obstacle to achieving robust cloud security
Ensuring data storage and processing within practices.
the legal boundaries of relevant regulations can Cloud security is a specialized domain that
be problematic when data is distributed across demands an understanding of both traditional
cloud services with different geographical cybersecurity principles and the unique
locations. intricacies of cloud platforms. Rapid
technological advancements continually
2.7. Multi-Cloud and Hybrid reshape the threat landscape, necessitating
Environments—Navigating Complex constant learning and adaptation.
Security Management Across Diverse Cloud environments encompass an array of
Platforms services, each with its own security controls,
configurations, and best practices. Securing
Multi-cloud and hybrid environments, where virtual machines, containers, serverless
multiple cloud providers are used, each with functions, and data stores requires expertise
different services, interfaces, and security that spans a wide spectrum of cloud services.
paradigms, multiply the complexity of security The demand for cloud security experts
management. outpaces the available talent pool.
Each cloud platform can become a silo of Organizations struggle to find and retain
security practices, making it challenging to professionals with the necessary skills to
maintain consistency in security policies, architect, implement, and manage robust cloud
access controls, and threat detection security measures.
mechanisms. In the absence of cloud security expertise,
Effective security management often misconfigurations become a common risk.
requires specialized knowledge for each of the Poorly configured security settings can
cloud providers. Teams must understand the inadvertently expose sensitive data, increase

59
attack surfaces, and compromise the overall successfully implement the “Security as Code”
security posture. approach, we need a comprehensive cloud
Effective threat detection and incident strategy that also works as code. The
response in cloud environments require fundamental idea is that we cannot secure
specialized knowledge. Identifying and something using the “Security as Code”
responding to cloud-specific threats and approach if it’s not implemented as code.
vulnerabilities requires understanding the Most consumers of cloud services agree that
nuances of cloud operations. “Infrastructure as Code” (IaC) allows for the
Different cloud providers offer distinct rapid deployment of services in the cloud
security features, tools, and practices. Cloud without manual configuration and,
security experts must navigate these nuances consequently, errors. “Security as Code” takes
to implement consistent security measures this approach further by defining security
across diverse platforms. policies, standards, and best practices
programmatically so that they can be used by
3. “Security as a Code” Approach default in configuration scripts used to set up
cloud services and systems. IT departments can
for Cloud Environments transition from the eternal balance between
business flexibility and security to the
Considering all the problems mentioned above, realization that these elements can be
which can sometimes be a hindrance to combined to provide an adequate level of both
organizations migrating to the cloud,— without sacrificing either.
“Security as code” (SaC has been the most Let’s consider a simplified example (Fig. 2):
effective approach to securing cloud workloads organizational policies contain a list of
with speed and agility. At this point, most cloud required security controls. Controls are broken
leaders agree that Infrastructure as Code (IaC) down into rules, which are transformed into
allows them to automate the building of code that is understandable by a Centralized
systems in the cloud without error-prone Compliance Check service. Later, rules are
manual configuration. SaC takes this one step grouped into policies organized hierarchically
further by defining cybersecurity policies and and defined by an inheritance structure. The
standards programmatically, so they can be Centralized Compliance Check service serves,
referenced automatically in the configuration as a conditional gate where infrastructure code
scripts used to provision cloud systems and is checked for compliance with the resources
systems running in the cloud can be compared that are supposed to be deployed according to
with security policies to prevent “drift” [13]. To the specified policies [14–15].

Figure 2: Simplified scheme of SaC concept

For example, if an organization sets a policy the policy is automatically rejected. Examples
that dictates personal data or payment card of policies could also include requirements
data in storage must be encrypted, this policy such as container or virtual machine
will be declared as one of the rules that are deployment images must come from trusted
automatically triggered when DevSecOps registries, mandatory database backup,
deploys cloud resources. A code that violates resource replication across two availability

60
zones, mandatory disk encryption for virtual • GDPR
machines, tagging and naming conventions for • HIPAA
resources, and so on [15]. • PCI DSS
Policies can be sourced from standards, • SOC2
regulations, best practices, and • Internal
recommendations, including external • Others.
institutions such as:
In most cases, these requirements and
• Cloud Security Alliance (CSA)
recommendations can be described as code,
• Center for Internet Security (CIS) which can serve as preventive, detective, and
• NIST reactive controls.

Figure 3: Process of static and dynamic validation according to policy

IaC is a prerequisite preceding the static policy Regula, both of which are open-source
compliance check. IaC can be implemented software. In the Cloud Native Computing
using tools like CloudFormation for AWS, Foundation (CNCF), OPA was adopted as an
Deployment management for GCP, or Resource incubating project in April 2019 and then
Manager for Azure, and for a more universal moved to the Graduated maturity level on
solution, Terraform or Pulumi. Static policy January 29, 2021. It provides a unified
checks should be integrated into the framework for policy enforcement across the
infrastructure code’s CI/CD pipeline and stack. OPA allows you to decouple policy
adhere to GitOps best practices to avoid the decisions from your services, APIs, and
installation of erroneous configurations and to microservices and manage policies separately
correct inconsistencies at an early stage. from your application code. OPA can be used in
Detective control involves checking for API management to declaratively define and
inconsistencies in resource changes caused by enforce policy at multiple layers [16–17].
uncontrolled factors such as manual changes or OPA can work with JSON files and perform
the establishment of a process that does not static Infrastructure as Code checks, aligning
adhere to IaC standards. Dynamic policy with preventive control practices.
checking provides real-time scanning of Regarding the tool for dynamically checking
infrastructure to confirm its current state. the current state’s policy compliance for
Reactive control is performed according to already running cloud resources, Cloud
detected non-compliance events and ensures Custodian can be used. It is an open-source
automatic correction using serverless product that serves as both a detective and, if
functions. needed, a reactive control. This tool is built in
The component of the Centralized Policy Python, agentless, and can be deployed as a
Compliance Verification Service can be serverless function, with rules described in
implemented using Open Policy Agent (OPA) or YAML format [18].

61
4. Policy examples based on CIS statement.Action ==
administrativePrivileges[_]
Amazon Web Services statement.Effect == "Allow"
policyName ==
Foundations Benchmark v2.0.0 resource["values"]["name"]["new"]
}
}
All CIS Benchmarks focus on technical default allow = true
configuration settings used to maintain and/or
increase the security of the addressed The policy imports the input.tfplan input,
technology, and they should be used in which represents the Terraform plan.
conjunction with other essential cyber hygiene It uses a deny rule to check each IAM policy
tasks like: resource in the Terraform plan. If the policy
• Monitoring the base operating contains any statements that allow full
system for vulnerabilities and quickly administrative privileges (specified as “*:*”), it
updating with the latest security generates a denial message.
patches. The hasFullAdminPrivileges function
• Monitoring applications and libraries checks if the IAM policy document contains any
for vulnerabilities and quickly statements that allow *:* (full administrative
updating with the latest security privileges).
patches. The default allow = true statement at the
end of the policy allows all other resources not
In the end, the CIS Benchmarks are designed
matched by the deny rule.
as a key component of a comprehensive
CIS Amazon Web Services Foundations
cybersecurity program.
Benchmark v2.0.0 - 06-28-2023 -2.1.1. Ensure
This document provides prescriptive
S3 Bucket Policy is set to deny HTTP requests
guidance for configuring security options for a
subset of Amazon Web Services with an package
emphasis on foundational, testable, and terraform.aws_s3_bucket_policy_validatio
architecture-agnostic settings [19]. n
import input.tfplan
CIS Amazon Web Services Foundations deny[msg] {
Benchmark v2.0.0 - 06-28-2023 - 1.16. Ensure resource = tfplan.resources[_]
IAM policies that allow full “*:*” administrative resource["type"] ==
privileges are not attached "aws_s3_bucket_policy"
not
hasDenyHttpStatement(resource["values"][
package
"policy"]["new"])
terraform.aws_iam_admin_policies
msg = sprintf("S3 Bucket policy '%v'
import input.tfplan
does not deny HTTP requests and should
deny[msg] {
be denied.",
resource = tfplan.resources[_]
[resource["values"]["bucket"]])
resource["type"] ==
}
"aws_iam_policy" # Adjust the resource
hasDenyHttpStatement(policyDoc) {
type as per your Terraform
statements := policyDoc["Statement"]
configuration.
some i, statement := statements {
hasFullAdminPrivileges(resource["values
statement.Effect == "Deny"
"]["name"]["new"])
statement.Action ==
msg = sprintf("IAM policy '%v'
"s3:GetObject"
allows full administrative privileges
and should not be attached.",
containsHttpCondition(statement.Conditio
[resource["values"]["name"]["new"]])
n)
}
}
hasFullAdminPrivileges(policyName) {
}
# Define a list of administrative
containsHttpCondition(condition) {
privileges you want to deny.
keys := keys(condition)
administrativePrivileges := ["*:*"]
"IpAddress" in keys
resource_policy :=
condition["IpAddress"] ==
data.aws_iam_policy_document[resource["v
{"aws:SourceIp": "HTTP request IP
alues"]["policy"]["new"]]
address"}
statements :=
}
resource_policy["Statement"]
default allow = true
some i, statement := statements {

62
It checks each S3 Bucket Policy resource in the not isEncryptionEnabled(resource)
msg = sprintf("RDS instance %s is
Terraform plan. If the policy does not contain a not configured with encryption at
Deny statement that denies HTTP requests, it rest.", [resource["name"]])
generates a denial message. }
The hasDenyHttpStatement function checks isEncryptionEnabled(resource) {
# Modify this rule to match the
if the policy document contains a Deny naming convention of your encryption
statement that specifically denies HTTP attribute.
requests for s3:GetObject actions. attribute_exists :=
The containsHttpCondition function checks resource["values"]["storage_encrypted"]
attribute_value :=
if the Deny statement contains a condition that resource["values"]["storage_encrypted"][
involves an HTTP request IP address. "new"]
The default allow = true statement at the attribute_value == true
}
end of the policy allows all other resources not default allow = false
matched by the deny rule.
CIS Amazon Web Services Foundations
The policy imports the input.tfplan input,
Benchmark v2.0.0 - 06-28-2023 - 2.2.1. Ensure
which represents the Terraform plan.
EBS Volume Encryption is Enabled in all
It uses a deny rule to check each AWS RDS
Regions
instance resource in the Terraform plan. If the
package storage_encrypted attribute is not set to true
terraform.aws_ebs_volume_encryption (i.e., encryption at rest is not enabled), it
import input.tfplan generates a denial message.
deny[msg] { In AWS, storage_encrypted is typically used
resource = tfplan.resources[_]
resource["type"] == "aws_ebs_volume" to enable encryption at rest.
# Adjust the resource type as per your The default allow = true statement at the
Terraform configuration. end of the policy allows all other resources not
not isEBSEncrypted(resource) matched by the deny rule.
msg = sprintf("EBS volume encryption
is not enabled in all regions in the CIS Amazon Web Services Foundations
Terraform configuration.") Benchmark v2.0.0 - 06-28-2023 - 3.1. Ensure
} CloudTrail is enabled in all regions
isEBSEncrypted(resource) {
encryption_enabled :=
package terraform.aws_cloudtrail
resource["values"]["encrypted"]["new"]
import input.tfplan
encryption_enabled == true
deny[msg] {
}
resource = tfplan.resources[_]
default allow = true
resource["type"] == "aws_cloudtrail"
not isCloudTrailEnabled(resource)
The policy imports the input.tfplan input, msg = sprintf("AWS CloudTrail is not
which represents the Terraform plan. enabled in all regions in the Terraform
configuration.")
It uses a deny rule to check each AWS EBS }
volume resource in the Terraform plan. If the isCloudTrailEnabled(resource) {
encrypted attribute is not set to true (i.e., EBS # Modify this rule to match the
volume encryption is not enabled), it generates naming convention of your CloudTrail
attributes.
a denial message. attribute_exists :=
The default allow = true statement at the resource["values"]["is_multi_region_trai
end of the policy allows all other resources not l"]
attribute_value :=
matched by the deny rule. resource["values"]["is_multi_region_trai
CIS Amazon Web Services Foundations l"]["new"]
Benchmark v2.0.0 - 06-28-2023 - 2.3.1. Ensure attribute_value == true
that encryption-at-rest is enabled for RDS }
default allow = true
Instances

import input.tfplan The policy imports the input.tfplan input,

deny[msg] { which represents the Terraform plan.
resource = tfplan.resources[_] It uses a deny rule to check each AWS
resource["type"] ==
"aws_db_instance" CloudTrail resource in the Terraform plan. If

63
the is_multi_region_trail attribute is not set to AWS Config configuration changes are
true (i.e., CloudTrail is not configured to be monitored.
enabled in all regions), it generates a denial
message. package terraform.aws_config_monitoring
import input.tfplan
The default allow = true statement at the deny[msg] {
end of the policy allows all other resources not resource = tfplan.resources[_]
matched by the deny rule. resource["provider"] ==
CIS Amazon Web Services Foundations "provider[\"aws\"]"
resource["type"] ==
Benchmark v2.0.0 - 06-28-2023 - 5.2. Ensure "aws_config_configuration_recorder"
no security groups allow ingress from 0.0.0.0/0
to remote server administration ports. not hasConfigMonitoring(resource)
msg = sprintf("AWS Config
package configuration changes must be
terraform.aws_security_group_validation monitored.")
import input.tfplan }
deny[msg] { hasConfigMonitoring(recorder) {
resource = tfplan.resources[_] recorder["values"]["recording_group"][0]
resource["type"] == ["all_supported"] == true
"aws_security_group_rule" }
isRemoteAdminPort(resource["values"]["fr default allow = true
om_port"])
isEverywhereAllowed(resource["values"][" It checks each AWS Config Configuration
cidr_blocks"])
Recorder resource in the Terraform plan. If the
msg = sprintf("Security group rule
allows ingress from 0.0.0.0/0 to remote recorder is not monitoring all supported
server administration ports: %v", resource types (all_supported set to true), it
[resource["values"]["from_port"]]) generates a denial message.
}
isRemoteAdminPort(port) {
The hasConfigMonitoring function checks if
port == 22 // Add more remote server the Configuration Recorder has all_supported
administration ports as needed (e.g., set to true, indicating that it’s monitoring all
3389 for RDP) supported resource types.
}
The default allow = true statement at the
isEverywhereAllowed(blocks) { end of the policy allows all other resources not
"0.0.0.0/0" in blocks matched by the deny rule.
} Rego, however, is a language that works
default allow = true
very differently than most and can be quite
unintuitive at first glance. It’s more similar to
This policy uses the input.tfplan input,
SQL than to common imperative languages like
which represents the Terraform plan.
Python. This means that the learning curve can
It checks each AWS Security Group Rule
be quite steep. Moreover, copy-paste
resource in the Terraform plan. If the rule
development will very often not help you
allows ingress from 0.0.0.0/0 (anywhere) to
understand Rego—and authoring complicated
remote server administration ports (e.g., SSH
policies—better [20].
on port 22), it generates a denial message.
The isRemoteAdminPort function checks if
the rule’s from_port matches a remote server 5. DevSecOps role in Implemen-
administration port (e.g., 22 for SSH). You can tation of “Security as a Code”
add more ports as needed. Approach
The isEverywhereAllowed function checks
if 0.0.0.0/0 is present in the cidr_blocks of the
DevSecOps is the evolution of the DevOps
rule, indicating that it allows ingress from
philosophy, which integrates security into the
anywhere.
software development and deployment
The default allow = true statement at the
process from its early stages. The role of
end of the policy allows all other resources not
DevSecOps in the “Security as Code” paradigm
matched by the deny rule.
is pivotal, as it ensures that security concerns
CIS Amazon Web Services Foundations
are embedded throughout the entire software
Benchmark v2.0.0 - 06-28-2023 - 4.9. Ensure

64
development lifecycle, providing a proactive intersect with the “Security as Code” approach.
and holistic approach to cloud security. To aid in understanding, we’ll use a graphical
Let’s consider the fundamental principles of representation of the software development
DevSecOps methodologies and how they lifecycle with security controls highlighted.

Figure 4: A software development cycle with security controls, some of which can be
implemented using the “Security as Code” approach
Let’s review the popular DevSecOps • Infrastructure-as-Code (IaC) is widely
methodology Shift-Left principle. The principle used to deploy environments
of Shift-Left in DevSecOps practices means that declaratively, using tools like Amazon
security integration should occur at the early CloudFormation and Terraform.
stages of development. “Security as Code” • Kubernetes is everywhere, enabling
precisely facilitates such inclusion of controls, organizations to provision containerized
reducing the risk of deploying unprotected workloads dynamically using
configurations [21] automated, adaptive processes.
Let’s dive deeper, and answer on question— This shift has tremendously improved
why Shift-Left security, before the advent of development productivity and velocity, but
agile development practices and cloud also raises serious security concerns. In this
computing, developers would request fast paced environment, there is little time for
infrastructure from IT and receive a server post-development security reviews of new
weeks or months later. Over the past two software versions or analysis of cloud
decades, IT has shifted left. Today development infrastructure configurations. Even when
infrastructure is fully automated and operates problems are discovered, there is little time for
on a self service basis: remediation before the next development
Developers can provision resources to sprint begins.
public clouds such as AWS, GCP, or Azure DevOps organizations realized that they
without involving operations or IT staff: must also shift security left to avoid
• Continuous integration and continuous introducing more security risks than security
deployment (CI/CD) processes and operations teams can manage. This
automatically set up testing, staging, and movement is known as DevSecOps, and uses a
production environments in the cloud or variety of tools and technologies to close the
on-premises and tear them down when gap and enable rapid, automated security
they are no longer needed. assessment as part of the CI/CD pipeline [22].

65
Automated compliance checks in DevSecOps 6. Fundamental principles of the
imply maximum automation and the
elimination of manual components in
"Security as Code" approach
configurations, aligning well with the “Security
as Code” approach. Automated security checks We can highlight the following fundamental
and scanning can be easily integrated into technological principles for SaC:
continuous integration and continuous • Automation
deployment (CI/CD) pipelines (Fig. 4). This “Security as Code” relies on automation for
ensures that code and infrastructure are the consistent and scalable implementation of
evaluated for security compliance at each stage security policies. This includes automating the
of development. deployment of security controls, vulnerability
A collaborative approach in DevSecOps detection, and issue remediation.
involves cooperation between development, • Version Control
operations, and security teams. In the context “Security as Code” should be treated as
of “Security as Code”, this collaboration software code and managed within a version
ensures that all teams understand and adhere control system. This ensures a clear history of
to security requirements. Security experts changes, facilitates collaboration among teams,
guide defining policies, while developers and allows for testing changes in a controlled
implement these policies in code. environment before production.
Code review and analysis are continuous • Reusability
processes in DevSecOps. In the “Security as “Security as Code” should be modular and
Code” paradigm, this process extends beyond designed for reusability. This enables different
functional code and encompasses security- teams to use and share standardized security
related code. Automated code analysis tools control components and configurations,
can help identify security vulnerabilities and reducing the time and effort required for
compliance violations. security implementation.
Continuous monitoring is a fundamental • Open Standards
aspect of DevSecOps, involving ongoing “Security as Code” should be built upon
monitoring of applications and infrastructure. open standards. This provides a more flexible
Using the “Security as Code” approach, you can and vendor-agnostic approach, reducing
monitor the cloud environment for security dependence on specific providers and allowing
policy and configuration deviations. teams to choose the best solutions for various
Automated monitoring tools can rapidly use cases [24].
identify deviations from established security Also, there are key organizational principles
standards and remediate them to the for achieving success in the implementation of
appropriate level. SaC:
DevSecOps should have incident response • Establishing Clear Ownership and
tools for rapid security incident response. Accountability
Implementing the “Security as Code” approach The initial principle underscores the
allows for the automation of incident response importance of emphasizing ownership and
concerning deviations from established accountability within an organization. This
practices and policies. The ability to react involves creating an internal framework to
quickly is critically important. govern roles, responsibilities, and permissions.
The synergy between DevSecOps For example, determining who can author
methodologies and the “Security as Code” policies and for which aspects of the cloud
approach creates a reliable security foundation infrastructure is vital.
for cloud environments. It aligns security with • Develop and Administer Codified
the principles of automation, collaboration, and Controls
continuous improvement, enabling The second principle revolves around the
organizations to actively address security creation and management of control objectives
challenges in a dynamic cloud landscape [23]. tailored to address specific, identified use
cases. Crafting policy content that is detailed
enough to meet established cloud control
standards is essential. Additionally, it involves

66
efficiently managing an ever-expanding under older methodologies. When this
inventory of codified security assets. approach is applied, teams work in sync and
• Implement Cloud Security Controls have a shared understanding because they
Thoroughly essentially speak the same language of code.
The third and final principle encompasses Increased visibility and transparency—
the widespread application of security with the “Security as Code” approach, security
measures and safeguards wherever feasible. teams clearly understand which policies are
Employ APIs to embed security mechanisms applied and actively work with them.
into source code management tools, CI/CD
pipelines, and runtime environments. 8. Summary
Continuously perform audits on cloud services
and workloads to assess their security, In the ever-evolving world of cloud computing,
resilience, and adherence to regulatory where flexibility and innovation are
requirements. Furthermore, establish a unified paramount, the importance of robust security
framework to enhance visibility, control, and practices cannot be overstated. As
collaboration across multi-cloud environments. organizations embark on digital
All the principles mentioned above, transformation journeys and migrate their
technological and organizational, can help infrastructures to the cloud, the significance of
avoid mistakes in the initial phases of SaC a dynamic and adaptable approach to security
implementation and are indispensable for becomes critical. The concept of ‘Security as
establishing a strong, adaptable, and agile Code” is introduced, a revolutionary concept
Security-as-Code program to address the ever- that not only aligns with the requirements of
evolving demands of public clouds [25]. modern cloud environments but also
transforms the fundamentals of cybersecurity.
7. Advantages of the “Security as This publication has shown that “Security as
Code” Approach Code” is more than just a trendy term; it is a
transformational strategy that blends security
The first advantage is speed. To fully realize the principles with software development
business benefits of the cloud, security teams practices. By treating security policies,
must move at a pace they are not accustomed controls, and best practices as code,
to in on-premises environments. Manual organizations gain the ability to automate,
security control configurations create friction integrate, and enforce security measures
that slows down progress and questions the throughout the entire lifecycle of cloud
overall value of the cloud for the business. resources. One of the key findings of our
The second advantage is risk reduction. research may be that “Security as Code” is
Local security control tools simply do not more than just a technological shift; it
account for the nuances of the cloud. Cloud represents an evolutionary leap. Teams
security requires its components to evolve comprising developers, operators, and
throughout the entire development lifecycle. security experts come together with a shared
The only way to achieve this level of goal of safeguarding digital assets. Through
integration is through “Security as Code”. automated testing, continuous monitoring, and
This approach fosters business growth. iterative improvements, these teams not only
Security and compliance requirements are close vulnerabilities but also promote a culture
becoming increasingly important for company of transparent security. Organizations across
products and services. In this regard, “Security various sectors have experienced
as Code” not only accelerates time-to-market improvements in security, streamlined
but also expands opportunities for product compliance adherence, and accelerated
innovation and creativity without incident response times. The concept has
compromising security. proven effective in various cloud
Improved collaboration and morale—as environments, from startups to enterprises,
development teams transitioned to more agile providing a standardized environment that
workflows more quickly, it created a certain aligns with the dynamics of cloud
gap with security teams that often operated infrastructure. “Security as Code” is a resilient

67
strategy capable of adapting to new threats Smart Industry and the Internet of
and technologies. Things, vol. 3149 (2022) 107–117.
[6] Z. Xin, et al., Revisit Security in the Era of
9. Conclusion DevOps: An Evidence Based Inquiy Into
DevSecOps Industry, IET Softw. 17(4)
(2023) 435–454. doi: 10.1049/sfw2.
As a result of this research, it can be concluded
12132.
that the “Security as Code” approach, when
[7] V. Buriachok, V. Sokolov, P. Skladannyi,
implemented correctly, can significantly
Security Rating Metrics for Distributed
mitigate the risks posed by the aforementioned
Wireless Systems, in: Workshop of the
challenges, which represent the most
8th International Conference on
significant threat to valuable information
"Mathematics. Information
assets and resources.
Technologies. Education": Modern
This publication provides us with a
Machine Learning Technologies and
direction for further research aimed at
Data Science, vol. 2386 (2019) 222–233.
enhancing the effectiveness of this method. It
[8] V. Buhas, et al., Using Machine Learning
also explores the expansion of its application to
Techniques to Increase the Effectiveness
a wider range of services offered by cloud
of Cybersecurity, in: Workshop on
providers and investigates the feasibility and
Cybersecurity Providing in Information
practicality of its application in environments
and Telecommunication Systems, vol.
such as multi-cloud or hybrid setups.
3188, no. 2 (2021) 273–281.
[9] R. Kumar, R. Goyal, Modeling Continuous
References Security: A Conceptual Model for
Automated DevSecOps Using Open-
[1] S. Yevseiev, et al., Modeling of Security Source Software Over Cloud (ADOC),
Systems for Critical Infrastructure Comput. Secur. 97 (2020). doi:
Facilities, Technology Center (2022). 10.1016/j.cose.2020.101967.
doi: 10.15587/978-617-7319-57-2. [10] K. Carter, Francois Raynaud on
[2] S. Vasylyshyn, et al., A Model of Decoy DevSecOps, IEEE Software 34(5) (2017)
System Based on Dynamic Attributes for 93–96. doi: 10.1109/ms.2017.3571578.
Cybercrime Investigation, Eastern- [11] S. Das, Security as Code, 1st Edition,
European J. Enterp. Technol. 1(9) (121) O'Reilly Media (2023).
(2023) 6–20. doi:10.15587/1729- [12] Amazon Web Service Documentation,
4061.2023.273363. Shared Responsibility Model. URL:
[3] V. Grechaninov, et al., Decentralized https://aws.amazon.com/compliance/s
Access Demarcation System hared-responsibility-model/?nc1=h_ls
Construction in Situational Center [13] C. Adtani, et al., Security as Code: The
Network, in: Workshop on Cybersecurity Best (and Maybe Only) Path to Securing
Providing in Information and Cloud Applications and Systems (2022).
Telecommunication Systems II, vol. URL: https://www.mckinsey.com/
3188, no. 2 (2022) 197–206. capabilities/mckinsey-digital/our-insigh
[4] P. Anakhov, et al., Increasing the ts/security-as-code-the-best-and-maybe
Functional Network Stability in the -only-path-to-securing-cloud-applicatio
Depression Zone of the Hydroelectric ns-and-systems
Power Station Reservoir, in: Workshop [14] R. Ferreira, Policy Design in the Age of
on Emerging Technology Trends on the Digital Adoption: Explore how PolicyOps
Smart Industry and the Internet of can drive Policy as Code adoption in an
Things, vol. 3149 (2022) 169–176. organization’s digital transformation, 1st
[5] V. Grechaninov, et al., Formation of Edition (2022).
Dependability and Cyber Protection [15] X. Zhang (2021). Cloud Governance and
Model in Information Systems of Compliance on AWS With Policy as Code
Situational Center, in: Workshop on (2011). URL: https://aws.amazon.com/
Emerging Technology Trends on the ru/blogs/opensource/cloud-governance -

68
 and-compliance-on-aws-with-policy-as-
code/
[16] S. Chevre, A. Soormally, 6 Open Source
Projects to Boost Your Cloud-Native API
Management Game (2023). URL:
https://www.cncf.io/blog/2023/05/24
/6-open-source-projects-to-boost-your-
cloud-native-api-management-game/
[17] T. Sandall, Open Policy Agent Graduates
in the Cloud Native Computing
Foundation (2021). URL: https://blog.
openpolicyagent.org/open-policy-agent
-graduates-in-the-cloud-native-computi
ng-foundation-f00145202a99
[18] X. Zhang, Compliance as Code and Auto-
Remediation with Cloud Custodian
(2020). URL: https://aws.amazon.com/
blogs/opensource/compliance-as-code-
and-auto-remediation-with-cloud-custo
dian/
[19] C. Spiess, et al., CIS Amazon Web
Services Foundations Benchmark v2.0.0
(2023). URL: https://www.scribd.com/d
ocument/664903767/CIS-Amazon-Web-
Services-Foundations-Benchmark-v2-0-0
[20] J. Martin, Introduction ro Open Policy
Agent (OPA) Rego Language (2022).
URL: https://spacelift.io/blog/open-poli
cy-agent-rego
[21] B. Lee, Using Open Policy Agent (OPA) to
Apply Policy-as-Code to Infrastructure-
as-Code (2022). URL: https://cloudse
curityalliance.org/blog/2020/04/02/us
ing-open-policy-agent-opa-to-apply-poli
cy-as-code-to-infrastructure-as-code/
[22] S. Gunja, Shift Left vs Shift Right: A
DevOps Mystery Solved (2023). URL:
https://www.dynatrace.com/news/blog/
what-is-shift-left-and-what-is-shift-right
[23] G. Wilson, DevSecOps A Leasder’s Guide
to Producing Secure Software Without
Compromising Flow Feedback and
Continuous Improvement (2020).
[24] Written by Mike Tyson of the Cloud
Security as Code(SaC): How to
Implement and Why Use it? (2023). URL:
https://blog.brainboard.co/security-as-
code-3d06e0d4cd80
[25] T. Karam, Securing DevOps: The ABCs of
Security-as-Code (2022). URL:
https://cloudsecurityalliance.org/blog/
2022/01/19/securing-devops-the-abcs-
of-security-as-code/

69