I-Corps: A Learned Cloud Infrastructure-as-Code (IaC) Linter

这个I-Corps项目更广泛的影响/商业潜力是开发一种用于编排云计算资源的工具。 它专为云提供商设计，使他们的服务更容易访问，并为云租户将其工作负载迁移到云。 现有的工具是从低级云应用程序编程接口（API）规范派生的，这些规范无法捕捉云资源之间交互的完整画面。因此，他们可能会犯错误，或者在部署运行之前未检测到问题。 所提出的技术是一种基础设施即代码（IaC）工具，可提高IaC云资源部署的可靠性。它有可能检测到许多类型的错误和错误配置，以减少实际部署中的错误和安全漏洞的数量。这项技术可以提前检测各种云部署问题，并帮助提出修复建议。这可能会改变人们如何管理和部署公共云基础设施的现状，并可能减少云租户开发和部署生命周期所需的人力。这个I-Corps项目是基于一个学习的云基础设施即代码（IaC）linter的开发，它可以自动提取云提供商的需求，并将其形式化为配置检查。 这是一个端到端的工具链，用于从各种来源提取云提供商的需求，正式验证其正确性，并将其转化为针对用户编写的IaC配置的有效检查。虽然以前的IaC链接器可以根据手动编写的规则检查安全性或策略合规性，但所提出的技术将自动提取的提供商一致性规则作为第一级目标。这项技术是一项长期研究奋进的一部分，旨在通过基础设施的清晰度来简化云管理。其目标是弥合云提供商的内部物流与各种云租户的意图之间的沟通差距，这阻碍了公共云服务的采用。为了缓解这个问题，所提出的技术利用了跨学科技术的独特组合，包括程序分析、形式推理和软件测试等成熟的概念，以及大型语言模型等快速发展的技术。 这个工具可以帮助用户在错误配置和安全问题出现之前就发现它们，从而节省修复问题所需的时间、人力和金钱。这个奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The broader impact/commercial potential of this I-Corps project is the development of a tool for orchestrating cloud computing resources. It is designed for cloud providers to make their service easier to access, and for cloud tenants for migrating their workloads to the cloud. Existing tools are derived from low-level cloud application programming interface (API) specifications, which fail to capture a complete picture of the interactions between cloud resources. Therefore, they can make mistakes or leave problems undetected until the deployment is run. The proposed technology is an infrastructure-as-code (IaC) tool that increases the reliability of IaC cloud resource deployment. It has the potential to detect many classes of bugs and misconfigurations to reduce the number of errors and security vulnerabilities in the actual deployment. The proposed technology may be able to detect a variety of cloud deployment problems in advance and help suggest repairs. This may change the status-quo on how people manage and deploy public cloud infrastructure, and may reduce manpower needed for the development and deployment life cycle of cloud tenants.This I-Corps project is based on the development of a learned cloud infrastructure-as-code (IaC) linter that enables extracting cloud provider requirements automatically and formalizes them as configuration checks. This is an end-to-end tool chain to extract cloud provider requirements from various sources, formally validate their correctness, and turn them into efficient checks against user-written IaC configurations. While previous IaC linters could check against security or policy compliance based on manually written rules, the proposed technology takes automatically extracted provider conformance rules as the first-class objective. This technology is part of a long-term research endeavor that aims at simplifying cloud management with infrastructure clarity. The goal is to bridge the communication gap between the internal logistics of cloud providers and the intent from various cloud tenants, which hampers the adoption of public cloud services. To mitigate this problem, the proposed technology leverages a unique combination of interdisciplinary techniques, including well-established concepts such as program analysis, formal reasoning, and software testing, as well as fast-growing technologies such as large language models. This tool may help users detect misconfigurations and security problems before they manifest, saving time, manpower and money required to fix problems.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.