Infrastructure as code (IaC) scanner for infrastructure component security

Patent metadata

Field	Value
Publication number	US-12598208-B2
Application number	US-202318461181-A
Country	US
Kind code	B2
Filing date	Sep 5, 2023
Priority date	Jul 20, 2023
Publication date	Apr 7, 2026
Grant date	Apr 7, 2026

Abstract

Systems and methods for an Infrastructure as Code (IaC) scanner for infrastructure component security. Various embodiments include steps of receiving one or more files for security scanning; extracting and parsing one or more resources from the one or more files; evaluating one or more policies for each of the one or more resources thereby ensures that underlying infrastructure components are configured securely; and displaying findings and details associated with the evaluating of the one or more resources.

First claim

What is claimed is:

1 . A method comprising steps of:
receiving one or more Infrastructure as Code (IaC) files for security scanning from a user, the receiving including authenticating the user via a posture control platform to obtain an authorization token; extracting and parsing, by an IaC parser, one or more resources from the one or more IaC files, the extracting including recursively evaluating functions within template files; storing the extracted resources in a database created at the start of the scanning, wherein the database is locally maintained on a developer machine, evaluating, by a policy engine, one or more policies for each of the one or more resources, the policies being maintained as Structured Query Language (SQL) expressions compiled from universal policy definition retrieved from the posture control platform; persisting results of the evaluating in the database; and displaying findings and details associated with the evaluating of the one or more resources, the findings including recommended remedial procedures, and uploading the findings and the one or more resources to the posture control platform for further processing and graphical visualization.

2 . The method of claim 1 , wherein the authenticating includes storing an authorization token in secure operating system storage.

3 . The method of claim 1 , wherein resources are stored in a database prior to the evaluating.

4 . The method of claim 3 , wherein the database is created when the one or more files are received.

5 . The method of claim 1 , wherein the one or more policies are maintained as Structured Query Language (SQL) expressions in a database, the SQL expressions being automatically compiled from a universal source policy language into SQLite-compatible queries for local execution on a developer machine.

6 . The method of claim 5 , wherein the SQL expressions are derived from policy definitions retrieved from a posture control platform in a cloud-based system.

7 . The method of claim 1 , wherein results of the evaluating are persisted in a database.

8 . The method of claim 1 , wherein the findings and resources are uploaded to a posture control platform for display and further processing, including correlation with multi-cloud configuration management databases (CMDBs) to identify misconfigurations, excessive permissions, or correlated risks across build-time and run-time environments.

9 . The method of claim 1 , wherein the findings include security issues associated with the one or more resources, and the details include recommended and remedial procedures for the security issues.

10 . A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:
receiving one or more Infrastructure as Code (IaC) files for security scanning from a user, the receiving including authenticating the user via a posture control platform to obtain an authorization token; extracting and parsing, by an IaC parser, one or more resources from the one or more IaC files, the extracting including recursively evaluating functions within template files; storing the extracted resources in a database created at the start of the scanning, wherein the database is locally maintained on a developer machine; evaluating. by a policy engine, one or more policies for each of the one or more resources, the policies being maintained as Structured Query Language (SQL) expressions compiled from universal policy definitions retrieved from the posture control platform; persisting results of the evaluating in the database; and displaying findings and details associated with the evaluating of the one or more resources, the findings including recommended remedial procedures, and uploading the findings and the one or more resources to the posture control platform for further processing and graphical visualization.

11 . The non-transitory computer-readable medium of claim 10 , wherein the authenticating includes storing an authorization token in secure operating system storage.

12 . The non-transitory computer-readable medium of claim 10 , wherein resources are stored in a database prior to the evaluating.

13 . The non-transitory computer-readable medium of claim 12 , wherein the database is created when the one or more files are received.

14 . The non-transitory computer-readable medium of claim 10 , wherein the one or more policies are maintained as Structured Query Language (SQL) expressions in a database, the SQL expressions being automatically compiled from a universal source policy language into SQLite-compatible queries for local execution on a developer machine.

15 . The non-transitory computer-readable medium of claim 14 , wherein the SQL expressions are derived from policy definitions retrieved from a posture control platform in a cloud-based system.

16 . The non-transitory computer-readable medium of claim 10 , wherein results of the evaluating are persisted in a database.

17 . The non-transitory computer-readable medium of claim 10 , wherein the findings and resources are uploaded to a posture control platform for display and further processing, including correlation with multi-cloud configuration management databases (CMDBs) to identify misconfigurations, excessive permissions, or correlated risks across build-time and run-time environments.

18 . The non-transitory computer-readable medium of claim 10 , wherein the findings include security issues associated with the one or more resources, and the details include recommended and remedial procedures for the security issues.

Assignees

• Zscaler Inc

Inventors

• Ragula Jeevan Reddy
• Rawat Abhijeet Singh
• Baitmangalkar Shyam
• Saripaka Aparna
• Valek Robert
• Stetsyk Oleksii

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title