eISSN: 3087-405X editor@aimjournals.com
All Journals
Submit your article

International Research Journal of Medical Sciences and Health Care

Open Access Peer Review International
Open Access

Infrastructure as Code Security: A Review of Automation, Compliance, and Risk Management

DOI https://doi.org/10.55640/irjmshc-v03i09-01
PDF
Mr. Swapnil Joshi 1 ,
4 Assistant Professor, Department of Computer Sciences and Applications

Abstract

Infrastructure as Code (IaC) has become an important approach for automating the provisioning, configuration, validation, and management of cloud and software infrastructure. This review covers five aspects of IaC: DevOps integration, security, automation, compliance, validation, and risk management. By version controlling, testing, validating, and automating the deployment of infrastructure configurations, IaC makes infrastructure changes and deployments more efficient and automated, which enables continuous integration and continuous deployment. Security considerations include misconfigurations, hardcoded secrets, inadequate access controls, vulnerable third-party modules, supply-chain attacks, and configuration drift. Infrastructure governance is reinforced by automation and compliance mechanisms that validate the infrastructure in the interest of a policy, check the compliance at runtime, and enforce the policy automatically. Automated validation embeds shift-left principles, static analysis, unit testing and policy-as-code to catch errors and violations before they reach the end-users. The other elements of risk management are identification of risk, configuration drift, vulnerability management, risk assessment, threat detection and continuous risk monitoring. In conclusion, the review underscores the importance of implementing secure, scalable, and reliable IaC practices that incorporates automation, compliance, validation, and risk management in the infrastructure lifecycle. These practices help reduce human error, ensure deployment uniformity, adhere to regulatory requirements, and enhance organizational resilience through sustainable infrastructure security, auditability, flexibility and suitability for changing operational needs.

Keywords

Infrastructure as Code, DevOps, Automation, Compliance

References

S. Girke, R. Klöfkorn, and M. Ohlberger, “Efficient Parallel Simulation of Atherosclerotic Plaque Formation Using Higher Order Discontinuous Galerkin Schemes,” Scenario, vol. 9, no. 1, pp. 688–696, Mar. 2014.
R. Azmeera, “The Effects of Increased Software Errors on Software Product Functionality,” University of the Cumberlands, 2025.
D. Antiya and O. Corporation, “Compliance as Code: Automating Compliance in Cloud Systems,” Int. J. Recent Innov. Trends Comput. Commun., vol. 8, no. February, 2025.
K. Jangiti, “Design and Validation of a Machine Identity Governance Framework for AI Agents in Multi-Cloud Environments,” in SoutheastCon 2026, IEEE, Feb. 2026, pp. 1–6. doi: 10.1109/SoutheastCon63549.2026.11476363.
R. K. Kanneganti, “Security and Compliance Issues in Cloud-Based Deployments of Content and Workflow Management Systems,” Eastasouth J. Inf. Syst. Comput. Sci., vol. 2, no. 01, pp. 131–138, Aug. 2024, doi: 10.58812/esiscs.v2i01.1122.
S. Rodrigues, “Intelligent Automation for Infrastructure as Code ( IaC ) in DevOps,” 2024.
S. Remella, J. Ligam, U. K. R. Gangula, V. Sannamuri, R. Ganta, and Q. T. Sadat, “End-to-End Cloud Procurement Lifecycle Automation,” in 2025 1st International Conference on Advancement in Futuristic Technologies (ICAFT), Belagavi, India: IEEE, 2025, pp. 1–8. doi: 10.1109/ICAFT66710.2025.11452870.
E. Damayanti, “Risk Management: In an Overview of Literature Review,” Formosa J. Sci. Technol., vol. 2, pp. 1115–1122, 2023, doi: 10.55927/fjst.v2i4.3837.
R. Azmeera and J. Hyatt, “Software Errors, Product Functionality, and Organizational Cascades: Evidence from Developer-Lived Experience,” Mar. 2026. doi: 10.2139/ssrn.6924439.
S. Sreevathsa, “Bridging Technical Telemetry and Business Decision-Making through Data Product Management,” Univers. Libr. Innov. Res. Stud., vol. 3, no. 3, pp. 32–36, Aug. 2026, doi: 10.70315/uloap.ulirs.2026.0303006.
A. V. S. R. Dantuluri, “Patient-Centric Markov-Chain Framework for Predicting Medication Adherence Using De-Identified Data,” 2026. doi: 10.64898/2026.02.08.26345856.
K. K. Mohammed, “A Survey on Digital Health Care Data Analysis Techniques for Developing Machine Learning Models,” Int. J. Sci. Eng. Technol., vol. 13, no. 5, October, pp. 1–6, 2025, doi: :10.5281/zenodo.17339813.
S. C. L. Koh, S. M. Saad, A. Ahmed, B. Kayis, and S. Amornsawadwatana, “A review of techniques for risk management in projects,” Benchmarking An Int. J., vol. 14, no. 1, pp. 22–36, 2007, doi: 10.1108/14635770710730919.
H. El Bhilat and M. Baaddi, “Artificial intelligence for emotion-aware customer journeys: A systematic literature review,” Multidiscip. Rev., vol. 9, no. 9, 2026, doi: 10.31893/multirev.2026417.
A. War, A. Habib, A. Diallo, J. Klein, and T. F. Bissyandé, “Security Vulnerabilities in Infrastructure as Code: What, How Many, and Who?,” Nov. 2023. doi: 10.21203/rs.3.rs-3600645/v1.
N. Thallapally, “Implementing continuous integration and continuous deployment (CI/CD) pipelines,” Int. J. Sci. Res. Arch., vol. 3, no. 2, pp. 248–253, Oct. 2021, doi: 10.30574/ijsra.2021.3.2.0073.
L. Chen, “Microservices: Architecting for Continuous Delivery and DevOps,” in 2018 IEEE International Conference on Software Architecture (ICSA), IEEE, Apr. 2018, pp. 39–397. doi: 10.1109/ICSA.2018.00013.
R. T. Natarajan, “Journal of Artificial Intelligence , Machine Learning and Data Science Pharmaceutical Manufacturing,” pp. 4–7, 2023.
H. Castro, “Infrastructure as Code (IaC) Security in AWS with DevSecOps,” ResearchGate., 2024.
G. Falazi et al., “Compliance Management of IaC-Based Cloud Deployments During Runtime,” in Proceedings of the IEEE/ACM 16th International Conference on Utility and Cloud Computing, New York, NY, USA: ACM, Dec. 2023, pp. 1–11. doi: 10.1145/3603166.3632135.
B. Teslim, “Error-Free Cloud Deployments: Automated Validation and IaC Best Practices,” 2024.
T. Aven, “Risk assessment and risk management: Review of recent advances on their foundation,” Eur. J. Oper. Res., vol. 253, no. 1, pp. 1–13, Aug. 2016, doi: 10.1016/j.ejor.2015.12.023.
S. Thiebes, S. Lins, and A. Sunyaev, “Trustworthy artificial intelligence,” Electron. Mark., vol. 31, no. 2, pp. 447–464, 2021, doi: 10.1007/s12525-020-00441-4.
J. Alam, R. Haque, T. Akter, and F. Nishi, “Multi-Os Configuration Drift Detection Using Ansible,” no. December, 2022.
S. Yoneda, S. Tanimoto, T. Konosu, H. Sato, and A. Kanai, “Risk Assessment in Cyber-Physical System in Office Environment,” in 2015 18th International Conference on Network-Based Information Systems, IEEE, Sep. 2015, pp. 412–417. doi: 10.1109/NBiS.2015.63.
C. Bilir and E. Yafez, “Project success/failure rates in Turkey,” Int. J. Inf. Syst. Proj. Manag., vol. 9, no. 4, pp. 24–40, 2021, doi: 10.12821/ijispm090402.
B. Stosic, M. Mihic, R. Milutinovic, and S. Isljamovic, “Risk identification in product innovation projects: new perspectives and lessons learned,” Technol. Anal. & Strateg. Manag., vol. 29, no. 2, pp. 133–148, 2017, doi: 10.1080/09537325.2016.1210121.
S. Irfan, “Enhancing Email Security Through Accurate Phishing Detection Using Deep Transformer Models,” in 2026 World Conference on Computational Science and Technology (WcCST), 2026, pp. 239–244. doi: 10.1109/WcCST67302.2026.11495864.
A. A. I. Yanguema and C. Yin, “Real-Time Cyber Monitoring and Threat Detection System with Hybrid AI Analysis,” OALib, vol. 13, no. 01, pp. 1–16, 2026, doi: 10.4236/oalib.1114742.
Z. Wang, “Artificial Intelligence in Cybersecurity Threat Detection,” Int. J. Comput. Sci. Inf. Technol., vol. 4, no. 1, pp. 203–209, 2024, doi: 10.62051/ijcsit.v4n1.24.
S. Chatterjee, “Advanced Malware Detection in Operational Technology: Signature-Based Vs. Behaviour-Based Approaches,” ESP J. Eng. Technol. Adv., vol. 1, 2021, doi: 10.56472/25832646/JETA-V1I2P128.
D. Boinpally, “Generative AI-Powered Infrastructure-as-Code: Automating Cloud Setup with Explainability and Governance,” in 2026 IEEE International Conference on Emerging Computing and Intelligent Technologies (ICoECIT), IEEE, Jan. 2026, pp. 1–7. doi: 10.1109/ICoECIT68303.2026.11497432.
H. Arora, A. Khudlain, N. Mahalwal, and N. Kandhoul, “Security Integrated Modularized Framework for Automated Infrastructure Provisioning in Cloud Environments,” in 2026 IEEE 18th International Conference on Computational Intelligence and Communication Networks (CICN), IEEE, Jun. 2026, pp. 802–807. doi: 10.1109/CICN70047.2026.11594141.
A. Lubis, E. M. Zamzami, A. Candra, and H. Mawengkang, “Application of Infrastructure as Code (IaC) in Multi-Cloud Network Infrastructure Management Using Terraform and Aviatrix on AWS and Azure,” in 2025 13th International Conference on Cyber and IT Service Management (CITSM), IEEE, Sep. 2025, pp. 1–4. doi: 10.1109/CITSM67730.2025.11291297.
V. T. D. Jakkaraju, “AI-Powered Infrastructure as Code (IaC) Security using Graph Neural Networks,” in 2025 3rd International Conference on Sustainable Computing and Data Communication Systems (ICSCDS), IEEE, Aug. 2025, pp. 87–93. doi: 10.1109/ICSCDS65426.2025.11167786.
S. I. Abbas and A. Garg, “Integrating Emerging Technologies with Infrastructure as Code in Distributed Environments,” in 2024 3rd International Conference on Applied Artificial Intelligence and Computing (ICAAIC), IEEE, Jun. 2024, pp. 1138–1144. doi: 10.1109/ICAAIC60222.2024.10575600.
R. Opdebeeck, A. Zerouali, and C. De Roover, “Control and Data Flow in Security Smell Detection for Infrastructure as Code: Is It Worth the Effort?,” in 2023 IEEE/ACM 20th International Conference on Mining Software Repositories (MSR), IEEE, May 2023, pp. 534–545. doi: 10.1109/MSR59073.2023.00079.
P. R. Reddy Konala, V. Kumar, and D. Bainbridge, “SoK: Static Configuration Analysis in Infrastructure as Code Scripts,” in 2023 IEEE International Conference on Cyber Security and Resilience (CSR), IEEE, Jul. 2023, pp. 281–288. doi: 10.1109/CSR57506.2023.10224925.

Most read articles by the same author(s)

1 2 > >> 

Similar Articles

You may also start an advanced similarity search for this article.