Infrastructure as code (IaC) scanner for infrastructure component security
AssigneeZscaler, Inc.
InventorsJeevan Reddy Ragula, Abhijeet Singh Rawat, Shyam Baitmangalkar, Aparna Saripaka, Robert Valek, Oleksii Stetsyk
Life of this patent
Estimating the term…
Abstract
Systems and methods for an Infrastructure as Code (IaC) scanner for infrastructure component security. Various embodiments include steps of receiving one or more files for security scanning; extracting and parsing one or more resources from the one or more files; evaluating one or more policies for each of the one or more resources thereby ensures that underlying infrastructure components are configured securely; and displaying findings and details associated with the evaluating of the one or more resources.
Claims18
A method comprising steps of:
- receiving one or more Infrastructure as Code (IaC) files for security scanning from a user, the receiving including authenticating the user via a posture control platform to obtain an authorization token;
- extracting and parsing, by an IaC parser, one or more resources from the one or more IaC files, the extracting including recursively evaluating functions within template files;
- storing the extracted resources in a database created at the start of the scanning, wherein the database is locally maintained on a developer machine,
- evaluating, by a policy engine, one or more policies for each of the one or more resources, the policies being maintained as Structured Query Language (SQL) expressions compiled from universal policy definition retrieved from the posture control platform;
- persisting results of the evaluating in the database;
- and
- displaying findings and details associated with the evaluating of the one or more resources, the findings including recommended remedial procedures, and uploading the findings and the one or more resources to the posture control platform for further processing and graphical visualization.
A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:
- receiving one or more Infrastructure as Code (IaC) files for security scanning from a user, the receiving including authenticating the user via a posture control platform to obtain an authorization token;
- extracting and parsing, by an IaC parser, one or more resources from the one or more IaC files, the extracting including recursively evaluating functions within template files;
- storing the extracted resources in a database created at the start of the scanning, wherein the database is locally maintained on a developer machine;
- evaluating. by a policy engine, one or more policies for each of the one or more resources, the policies being maintained as Structured Query Language (SQL) expressions compiled from universal policy definitions retrieved from the posture control platform;
- persisting results of the evaluating in the database;
- and
- displaying findings and details associated with the evaluating of the one or more resources, the findings including recommended remedial procedures, and uploading the findings and the one or more resources to the posture control platform for further processing and graphical visualization.
Dependencies are inferred from the claim text.