Servicenavigation

Project Details

Back

Projekt Print View

IAC2: Infrastructure-as-code Architecture Decision Compliance

Subject Area Software Engineering and Programming Languages
Term from 2017 to 2023
Project identifier Deutsche Forschungsgemeinschaft (DFG) - Project number 314720630
 
Final Report Year 2024

Final Report Abstract

Infrastructure-as-Code (IaC) is a set of practices that involve using reusable scripts and deployment models to manage and provision IT infrastructure. Moreover, the configuration and host environments for software applications are typically subject to domain-specific guidelines, laws, and policies, often expressed as Architectural Design Decisions (ADDs). IaC-based cloud deployments are no exception to that. However, an examination of the state-of-the-art highlights a lack of a precise definition of the concept of compliance of IaC-based applications to enforced ADDs and the absence of a systematic way to check and enforce such compliance throughout the software delivery phases. Therefore, the main goal of the IAC² project is to tackle these deficiencies by facilitating systematic definition and management of IaC-based cloud application compliance. This goal is achieved through multiple collaborations with academic and industrial partners and a total of 14 peer-reviewed research papers published in a variety of scientific journals and conference proceedings. Throughout the project, we analyzed established patterns and anti-patterns at the code and architecture levels focusing on aspects of security, component hosting and management, and coupling-related practices for IaC-based cloud applications. We further studied their usage as the basis for ADDs, and we developed specifications that facilitate rigorously defining what it means for an IaC-based cloud application to be compliant with such ADDs. Furthermore, we introduced multiple methods that facilitate the definition, checking, and enforcement of compliance rules both at design time and at run time. To facilitate design-time compliance management, we developed a detector-based approach that analyzes application source code, including IaC, to infer its architecture. Based on this, carefully designed detectors are used to determine compliance with the enforced ADDs, and an iterative, semi-automatic architecture refinement process is employed to gradually improve the conformance of the application design. To facilitate run-time compliance management, we developed a method that employs a crawler-based approach to reconstruct the architecture of a running IaC-based cloud application. Then, the resulting application instance is checked against a previously defined set of architectural compliance rules, potential violations are flagged, semiautomatic fixes are applied, and validation is performed to ensure integrity. Both introduced methods are evaluated through case studies and interviews with industrial experts to assess their usability and their ability to reduce complexity and effort. All the concepts and methods envisioned and designed throughout this project are extensible to further compliance management domains and are validated through plugin-based, readily usable, open-source prototypes that facilitate portability and reusability.

Publications

 
 

Additional Information

© 2025 DFG Disclaimer / Copyright / Privacy Policy

Textvergrößerung und Kontrastanpassung