I-Corps: A Learned Cloud Infrastructure-as-Code (IaC) Linter

这个i-Corps项目的更广泛的影响/商业潜力是开发一个用于协调云计算资源的工具。它旨在让云提供商更容易访问他们的服务，并让云租户将其工作负载迁移到云中。现有的工具源自底层的云应用程序编程接口(API)规范，无法捕获云资源之间交互的完整画面。因此，他们可能会出错或在部署运行之前未检测到问题。建议的技术是一种基础设施即代码(IAC)工具，可提高IAC云资源部署的可靠性。它有可能检测到许多类别的错误和错误配置，以减少实际部署中的错误和安全漏洞的数量。拟议的技术可能能够提前检测到各种云部署问题，并帮助提出修复建议。这可能会改变人们如何管理和部署公共云基础设施的现状，并可能减少云租户开发和部署生命周期所需的人力。该i-Corps项目基于学习的云基础设施即代码(IAC)Linterer的开发，该Linterer能够自动提取云提供商的需求，并将其作为配置检查正式化。这是一个端到端的工具链，用于从各种来源提取云提供商的需求，正式验证其正确性，并将其转化为针对用户编写的IAC配置的高效检查。以前的IAC LINTER可以基于手动编写的规则检查安全性或策略合规性，而所提出的技术将自动提取的提供商一致性规则作为首要目标。这项技术是一项长期研究工作的一部分，旨在通过基础设施的清晰度来简化云管理。其目标是弥合云提供商的内部物流与各种云租户意图之间的沟通鸿沟，这阻碍了公共云服务的采用。为了缓解这一问题，拟议的技术利用了独特的跨学科技术组合，包括程序分析、形式推理和软件测试等成熟的概念，以及大型语言模型等快速增长的技术。该工具可以帮助用户在错误配置和安全问题显现之前发现它们，从而节省修复问题所需的时间、人力和金钱。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The broader impact/commercial potential of this I-Corps project is the development of a tool for orchestrating cloud computing resources. It is designed for cloud providers to make their service easier to access, and for cloud tenants for migrating their workloads to the cloud. Existing tools are derived from low-level cloud application programming interface (API) specifications, which fail to capture a complete picture of the interactions between cloud resources. Therefore, they can make mistakes or leave problems undetected until the deployment is run. The proposed technology is an infrastructure-as-code (IaC) tool that increases the reliability of IaC cloud resource deployment. It has the potential to detect many classes of bugs and misconfigurations to reduce the number of errors and security vulnerabilities in the actual deployment. The proposed technology may be able to detect a variety of cloud deployment problems in advance and help suggest repairs. This may change the status-quo on how people manage and deploy public cloud infrastructure, and may reduce manpower needed for the development and deployment life cycle of cloud tenants.This I-Corps project is based on the development of a learned cloud infrastructure-as-code (IaC) linter that enables extracting cloud provider requirements automatically and formalizes them as configuration checks. This is an end-to-end tool chain to extract cloud provider requirements from various sources, formally validate their correctness, and turn them into efficient checks against user-written IaC configurations. While previous IaC linters could check against security or policy compliance based on manually written rules, the proposed technology takes automatically extracted provider conformance rules as the first-class objective. This technology is part of a long-term research endeavor that aims at simplifying cloud management with infrastructure clarity. The goal is to bridge the communication gap between the internal logistics of cloud providers and the intent from various cloud tenants, which hampers the adoption of public cloud services. To mitigate this problem, the proposed technology leverages a unique combination of interdisciplinary techniques, including well-established concepts such as program analysis, formal reasoning, and software testing, as well as fast-growing technologies such as large language models. This tool may help users detect misconfigurations and security problems before they manifest, saving time, manpower and money required to fix problems.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.