# US 12,015,635 B2 · Infrastructure as code pre-deployment compliance testing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,635 B2 - Document ID: US12015635B2 - Status: Granted - Kind: B2 - Application number: 17/668,005 - Filed: 2022-02-09 - Published: 2022-11-03 - Granted: 2024-06-18 - Earliest claimed: 2021-04-29 - Assignees: Rapid7, Inc. - Applicants: Rapid7, Inc. - Inventors: James Witschey; John Jason Senich; Jun Park; Val Komarov; Miguel Ledezma; Chris DeRamus - Web page: https://patentgrep.com/patent/US12015635B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 8/65: Updates (security arrangements therefor G06F21/57) - G06F 9/44505: {Configuring for program initiating, e.g. using registry, configuration files} - G06F 9/5072: {Grid computing} - G06F 9/5077: {Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455)} - G06Q 10/0635: Risk analysis of enterprise or organisation activities - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract A unified cloud configuration evaluation (UCCE) system is described capable of evaluating both asset configurations in a live cloud environment and proposed configuration changes produced by a cloud configuration development (CCD) system. In embodiments, the UCCE system may be implemented as a Cloud Security Posture Management (CPSM) system that monitors assets in the cloud environment and check the assets' configurations for compliance with a set of compliance rules. In embodiments, the UCCE system ingests a cloud configuration definition generated by the CCD system. In embodiments, the CCD system is implemented as an Infrastructure as Code (IaC) system that allows a user to create a cloud configuration definition that describes proposed configuration changes to the cloud environment. The UCCE system is configured to interpret the cloud configuration definition and analyze the proposed configuration changes for compliance using the same set of compliance rules used for the live cloud environment. ## Claims ### Claim 1 A system comprising: one or more computer devices configured to implement a unified cloud configuration evaluation (UCCE) system; and one or more non-transitory computer-readable storage media storing executable instructions that, when executed by the one or more computer devices cause the one or more computer devices to: obtain, from a cloud computing infrastructure provider service, live asset configuration data about assets in a cloud environment hosted by the cloud computing infrastructure provider service, the live asset configuration data being in a first format associated with the cloud computing infrastructure provider service; convert the live asset configuration data from the first format to a second format associated with the UCCE system; generate a first model of the cloud environment using the live asset configuration data in the second format associated with the UCCE system; obtain a cloud configuration definition created in a cloud configuration development (CCD) system specifying proposed configuration changes to the cloud environment, the cloud configuration definition being in a third format associated with the CCD system; convert the cloud configuration definition from the third format associated with the CCD system to the second format associated with the UCCE system; generate a second model reflecting the proposed configuration changes using the cloud configuration definition in the second format associated with the UCCE system; and evaluate compliance of the live asset configuration data and the proposed configuration changes using a set of compliance rules by: evaluating compliance of the live asset configuration data by applying the set of compliance rules to the first model, and evaluating compliance of the proposed configuration changes by applying the set of compliance rules to the second model. ### Claim 2 (depends on 1) The system of claim 1, wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to: determine that the proposed configuration changes comply with the set of compliance rules, and in response, initiate deployment of the proposed configuration changes to the cloud environment. ### Claim 3 (depends on 2) The system of claim 2, wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to: initiate the deployment of the proposed configuration changes based on a user approval of the proposed configuration changes. ### Claim 4 (depends on 1) The system of claim 1, wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to: update the second model and apply the set of compliance rules to the second model in response to changes made to the cloud configuration definition in the CCD system. ### Claim 5 (depends on 1) The system of claim 1, wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to: update the second model and apply the set of compliance rules to the second model in response to receiving a request from the CCD system to evaluate compliance of the proposed configuration changes. ### Claim 6 (depends on 1) The system of claim 1, wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to: receive the live asset configuration data from the cloud computing infrastructure provider service over a network. ### Claim 7 (depends on 1) The system of claim 1, wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to: obtain additional live asset configuration data about assets in the cloud environment from the cloud computing infrastructure provider service; and convert the additional live asset configuration data from the first format to the second format; wherein generating the first model comprises updating the first model of the cloud environment using the additional live asset configuration data in the second format. ### Claim 8 (depends on 1) The system of claim 1, wherein: the first format is a provider-specific format specific to the cloud computing infrastructure provider service; and the third format is a definition language specific to the CCD system. ### Claim 9 (depends on 1) The system of claim 1, wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to: store the first model and the second model in a model database. ### Claim 10 (depends on 1) The system of claim 1, wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to: determine that the cloud configuration definition contains a reference refers to an existing asset in the cloud environment; retrieve configuration data about the referenced asset from the first model; and combine the retrieved configuration data with the cloud configuration definition to update the second model. ### Claim 11 (depends on 10) The system of claim 10, wherein retrieving the configuration data about the referenced asset from the first model comprises: identifying the referenced asset in the first model using an identifier of the referenced asset indicated in the cloud configuration definition. ### Claim 12 (depends on 10) The system of claim 10, wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to: automatically update the second model in response to changes to the referenced asset in the cloud environment. ### Claim 13 (depends on 1) The system of claim 1, wherein the executable instructions, when executed by the one or more computer devices cause the one or more computer devices to: check for security vulnerabilities in the cloud environment using the first model. ### Claim 14 A method comprising: using one or more computer devices, which are configured to implement a unified cloud configuration evaluation (UCCE) system, to perform: obtaining, from a cloud computing infrastructure provider service, live asset configuration data about assets in a cloud environment hosted by the cloud based cloud computing infrastructure provider service, the live asset configuration data being in a first format associated with the cloud computing infrastructure provider service; converting the live asset configuration data from the first format to a second format associated with the UCCE system; generating a first model of the cloud environment using the live asset configuration data in the second format associated with the UCCE system; obtaining a cloud configuration definition created in a cloud configuration development (CCD) system specifying proposed configuration changes to the cloud environment, the cloud configuration definition being in a third format associated with the CCD system; converting the cloud configuration definition from the third format associated with the CCD system to the second format associated with the UCCE system; generating a second model reflecting the proposed configuration changes using the cloud configuration definition in the second format associated with the UCCE system; and evaluating compliance of the live asset configuration data and the proposed configuration changes using a set of compliance rules by: evaluating compliance of the live asset configuration data by applying the set of compliance rules to the first model, and evaluating compliance of the proposed configuration changes by applying the set of compliance rules to the second model. ### Claim 15 (depends on 14) The method of claim 14, wherein the UCCE system is further configured to perform: determining that the proposed configuration changes comply with the set of compliance rules, and in response, initiating deployment of the proposed configuration changes to the cloud environment. ### Claim 16 (depends on 14) The method of claim 14, wherein the UCCE system is further configured to perform: updating the second model and applying the set of compliance rules to the second model in response to changes made to the cloud configuration definition in the CCD system. ### Claim 17 (depends on 14) The method of claim 14, wherein the UCCE system is further configured to perform: updating the second model and applying the set of compliance rules to the second model in response to receiving a request from the CCD system to check evaluate compliance of the proposed configuration changes. ### Claim 18 (depends on 14) The method of claim 14, wherein: the first format is a provider-specific format specific to the cloud computing infrastructure provider service; and the third format is a definition language specific to the CCD system. ### Claim 19 (depends on 14) The method of claim 14, wherein the UCCE system is further configured to perform: determining that the cloud configuration definition contains a reference to an existing asset in the cloud environment; retrieving configuration data about the referenced asset from the first model; and combining the retrieved configuration data with the cloud configuration definition to update the second model. ### Claim 20 One or more non-transitory computer-readable storage media storing program instructions that when executed on one or more processors implement a unified cloud configuration evaluation (UCCE) system and cause the UCCE system to perform: obtaining, from a cloud computing infrastructure provider service, live asset configuration data about assets in a cloud environment hosted by the cloud computing infrastructure provider service, the live asset configuration data being in a first format associated with the cloud computing infrastructure provider service; converting the live asset configuration data from the first format to a second format associated with the UCCE system; generating a first model of the cloud environment using the live asset configuration data in the second format associated with the UCCE system; obtaining a cloud configuration definition created in a cloud configuration development (CCD) system specifying proposed configuration changes to the cloud environment, the cloud configuration definition being in a third format associated with the CCD system; converting the cloud configuration definition from the third format associated with the CCD system to the second format associated with the UCCE system; generating a second model reflecting the proposed configuration changes using the cloud configuration definition in the second format associated with the UCCE system; and evaluating compliance of the live asset configuration data and the proposed configuration changes using a set of compliance rules by: evaluating compliance of the live asset configuration data by applying the set of compliance rules to the first model, and evaluating compliance of the proposed configuration changes by applying the set of compliance rules to the second model.