Pre-Deployment Security Assessment for Cloud Services through Semantic Reasoning
Paper in proceeding, 2021

Over the past ten years, the adoption of cloud services has grown rapidly, leading to the introduction of automated deployment tools to address the scale and complexity of the infrastructure companies and users deploy. Without the aid of automation, ensuring the security of an ever-increasing number of deployments becomes more and more challenging. To the best of our knowledge, no formal automated technique currently exists to verify cloud deployments during the design phase. In this case study, we show that Description Logic modeling and inference capabilities can be used to improve the safety of cloud configurations. We focus on the Amazon Web Services proprietary declarative language, CloudFormation, and develop a tool to encode template files into logic. We query the resulting models with properties related to security posture and report on our findings. By extending the models with dataflow-specific knowledge we use more comprehensive semantic reasoning to further support security reviews. When applying the developed toolchain to publicly available deployment files we find numerous violations of widely-recognized security best practices, which suggests that streamlining the methodologies developed for this case study would be beneficial.

Author

Claudia Cauli

University of Gothenburg

Chalmers, Computer Science and Engineering (Chalmers), Formal methods

Meng Li

Amazon

Nir Piterman

University of Gothenburg

Chalmers, Computer Science and Engineering (Chalmers), Formal methods

Oksana Tkachuk

Amazon

Lecture Notes in Computer Science

0302-9743 (ISSN) 1611-3349 (eISSN)

Vol. 12759 LNCS 767 -780
978-303081684-1 (ISBN)

33rd International Conference on Computer Aided Verification, CAV 2021
Virtual, Online, ,

Subject Categories (SSIF 2025)

Computer Sciences

DOI

10.1007/978-3-030-81685-8_36

More information

Latest update

11/27/2025