Document Open Access Logo

Tools for Detecting Security Issues in Infrastructure-As-Code: A Focused Literature Review

Authors Mohamed Haady Tiemtore , Frédéric Loulergue

PDF

File

Thumbnail PDF
PDF
LIPIcs.ESEM.2026.55.pdf
  • Filesize: 0.7 MB
  • 14 pages

Document Identifiers

Subject Classification

ACM Subject Classification
  • Security and privacy → Software security engineering
  • Software and its engineering → Software verification and validation
Keywords
  • Infrastructure-as-Code
  • security tooling
  • misconfiguration detection
  • static analysis
  • empirical software engineering
  • focused literature review

Metrics

Abstract

Infrastructure-as-Code (IaC) artefacts such as Puppet manifests, Ansible playbooks, Kubernetes manifests, Helm charts, Terraform configurations, and CloudFormation templates are increasingly used to manage critical infrastructures. Security defects in these artefacts may therefore be propagated rapidly through automated deployment pipelines. This paper reports emerging results from a focused literature review of tools for detecting security issues in IaC artefacts. The current review protocol covers the ACM Digital Library and IEEE Xplore and includes 23 primary studies. We identify the main families of tools captured by this protocol, classify their detection approaches, and analyse how they are evaluated. The review corpus includes rule-based linters, deeper static analyses, graph- and model-based approaches, comparative scanner studies, deployment-oriented analyses, and recent machine-learning and LLM techniques.

Cite As Get BibTex

Mohamed Haady Tiemtore and Frédéric Loulergue. Tools for Detecting Security Issues in Infrastructure-As-Code: A Focused Literature Review. In 20th International Symposium on Empirical Software Engineering and Measurement (ESEM 2026). Leibniz International Proceedings in Informatics (LIPIcs), Volume 394, pp. 55:1-55:14, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2026) https://doi.org/10.4230/LIPIcs.ESEM.2026.55

Author Details

Mohamed Haady Tiemtore
  • Université d'Orléans, INSA CVL, LIFO UR 4022, Orléans, France
Frédéric Loulergue
  • Université d'Orléans, INSA CVL, LIFO UR 4022, Orléans, France

Funding

partly by For-CoaLa, a project funded by the French National Research Agency (ANR-24-CE25-3158)

Supplementary Materials

References

  1. Agathe Blaise and Filippo Rebecchi. Stay at the Helm: Secure Kubernetes deployments via graph generation and attack reconstruction. In IEEE International Conference on Cloud Computing (CLOUD), pages 59-69. IEEE, 2022. URL: https://doi.org/10.1109/CLOUD55607.2022.00022.
  2. Matija Cankar, Nenad Petrovic, Joao Pita Costa, Ales Cernivec, Jan Antic, Tomaz Martincic, and Dejan Stepec. Security in DevSecOps: Applying tools and machine learning to verification and monitoring steps. In ACM/SPEC International Conference on Performance Engineering Companion (ICPE Companion), pages 201-205. ACM, 2023. URL: https://doi.org/10.1145/3578245.3584943.
  3. Michele Chiari, Michele De Pascalis, and Matteo Pradella. Static analysis of infrastructure as code: A survey. In 19th IEEE International Conference on Software Architecture Companion (ICSA-C). IEEE, 2022. URL: https://doi.org/10.1109/ICSA-C54293.2022.00049.
  4. Ting Dai, Alexei Karve, Grzegorz Koper, and Sai Zeng. Automatically detecting risky scripts in infrastructure code. In 11th ACM Symposium on Cloud Computing (SoCC), pages 358-371. ACM, 2020. URL: https://doi.org/10.1145/3419111.3421303.
  5. Ryo Hase, Ye Wang, Toshiaki Koike-Akino, Jing Liu, Kieran Parsons, and Jumpei Hato. Evaluating security policy compliance in infrastructure as code generated by large language models. In International Symposium on Digital Forensics and Security (ISDFS), pages 1-6. IEEE, 2026. URL: https://doi.org/10.1109/ISDFS69419.2026.11458930.
  6. Kacper Kamieniarz and Wojciech Mazurczyk. A comparative study on the security of Kubernetes deployments. In International Wireless Communications and Mobile Computing (IWCMC), pages 718-723. IEEE, 2024. URL: https://doi.org/10.1109/IWCMC61514.2024.10592468.
  7. Ioanna Angeliki Kapetanidou, Alexandros Nizamis, and Konstantinos Votis. An evaluation of commonly used Kubernetes security scanning tools. In 2nd International Workshop on MetaOS for the Cloud-Edge-IoT Continuum (MECC), pages 20-25. ACM, 2025. URL: https://doi.org/10.1145/3721889.3721924.
  8. Francesco Minna, Agathe Blaise, Katja Tuma, and Fabio Massacci. Automated analysis of security policy violations in Helm charts. IEEE Trans. Dependable Secure Comput., 23(2):2519-2533, 2026. URL: https://doi.org/10.1109/TDSC.2025.3628213.
  9. Akshay Mittal and Vivek Venkatesan. Practical integration of large language models into enterprise CI/CD pipelines for security policy validation: An industry-focused evaluation. In IEEE International Conference on Service-Oriented System Engineering (SOSE), pages 197-203. IEEE, 2025. URL: https://doi.org/10.1109/SOSE67019.2025.00027.
  10. Evangelos Ntentos, Uwe Zdun, Ghareeb Falazi, Uwe Breitenbücher, and Frank Leymann. Assessing architecture conformance to security-related practices in infrastructure as code based deployments. In IEEE International Conference on Services Computing (SCC), pages 123-133. IEEE, 2022. URL: https://doi.org/10.1109/SCC55611.2022.00029.
  11. Ruben Opdebeeck, Valeria Pontillo, Camilo Velázquez-Rodríguez, Wolfgang De Meuter, and Coen De Roover. Smelling secrets: Leveraging machine learning and language models for sensitive parameter detection in Ansible security analysis. In IEEE International Conference on Source Code Analysis and Manipulation (SCAM), pages 66-77. IEEE, 2025. URL: https://doi.org/10.1109/SCAM67354.2025.00014.
  12. Ruben Opdebeeck, Ahmed Zerouali, and Coen De Roover. Control and data flow in security smell detection for infrastructure as code: Is it worth the effort? In IEEE/ACM International Conference on Mining Software Repositories (MSR), pages 534-545. IEEE, 2023. URL: https://doi.org/10.1109/MSR59073.2023.00079.
  13. Claus Pahl, Övgüm Can Sezen, and Florian Hofer. Artificial intelligence for infrastructure-as-code - a systematic literature review. Electronics, 15(4), 2026. URL: https://doi.org/10.3390/ELECTRONICS15040755.
  14. Kai Petersen, Sairam Vakkalanka, and Ludwik Kuzniarz. Guidelines for conducting systematic mapping studies in software engineering: An update. Inf. Softw. Technol., 64:1-18, 2015. URL: https://doi.org/10.1016/J.INFSOF.2015.03.007.
  15. Akond Rahman, Rezvan Mahdavi-Hezaveh, and Laurie Williams. A systematic mapping study of infrastructure as code research. Inf. Softw. Technol., 108:65-77, 2019. URL: https://doi.org/10.1016/J.INFSOF.2018.12.004.
  16. Akond Rahman and Chris Parnin. Detecting and characterizing propagation of security weaknesses in Puppet-based infrastructure management. IEEE Trans. Softw. Eng., 49(6):3536-3553, 2023. URL: https://doi.org/10.1109/TSE.2023.3265962.
  17. Akond Rahman, Chris Parnin, and Laurie Williams. The seven sins: Security smells in infrastructure as code scripts. In 41st International Conference on Software Engineering (ICSE), pages 164-175. IEEE, 2019. URL: https://doi.org/10.1109/ICSE.2019.00033.
  18. Akond Rahman, Md Rayhanur Rahman, Chris Parnin, and Laurie Williams. Security smells in Ansible and Chef scripts: A replication study. ACM Trans. Softw. Eng. Methodol., 30(1), 2021. URL: https://doi.org/10.1145/3408897.
  19. Akond Rahman, Shazibul Islam Shamim, Dibyendu Brinto Bose, and Rahul Pandita. Security misconfigurations in open source Kubernetes manifests: An empirical study. ACM Trans. Softw. Eng. Methodol., 32(4), 2023. URL: https://doi.org/10.1145/3579639.
  20. Sofia Reis, Rui Abreu, Marcelo d'Amorim, and Daniel Fortunato. Leveraging practitioners' feedback to improve a security linter. In 37th IEEE/ACM International Conference on Automated Software Engineering (ASE). ACM, 2023. URL: https://doi.org/10.1145/3551349.3560419.
  21. Nuno Saavedra and João F. Ferreira. GLITCH: Automated polyglot security smell detection in infrastructure as code. In 37th IEEE/ACM International Conference on Automated Software Engineering (ASE). ACM, 2023. URL: https://doi.org/10.1145/3551349.3556945.
  22. Shazibul Islam Shamim, Hanyang Hu, and Akond Rahman. Dynamic application security testing for Kubernetes deployment: An experience report from industry. In ACM International Conference on the Foundations of Software Engineering Companion (FSE Companion), pages 514-519. ACM, 2025. URL: https://doi.org/10.1145/3696630.3728573.
  23. Shazibul Islam Shamim, Hanyang Hu, and Akond Rahman. On prescription or off prescription? an empirical study of community-prescribed security configurations for Kubernetes. In 47th IEEE/ACM International Conference on Software Engineering (ICSE), pages 2432-2444. IEEE, 2025. URL: https://doi.org/10.1109/ICSE55347.2025.00170.
  24. Rashika Singh, Abel Yeboah-Ofori, Saurabh Kumar, and Aishat Ganiyu. Fortifying cloud DevSecOps security using Terraform infrastructure as code analysis tools. In International Conference on Electrical and Computer Engineering Researches (ICECER), pages 1-6. IEEE, 2024. URL: https://doi.org/10.1109/ICECER62944.2024.10920371.
  25. Dheer Toprani and Vijay K. Madisetti. LLM agentic workflow for automated vulnerability detection and remediation in infrastructure-as-code. IEEE Access, 13:69175-69181, 2025. URL: https://doi.org/10.1109/ACCESS.2025.3560911.
  26. Anh-Duy Tran, Laurens Sion, Koen Yskout, and Wouter Joosen. TerrARA: Automated security threat modeling for infrastructure as code. In 15th ACM Conference on Data and Application Security and Privacy (CODASPY), pages 269-280. ACM, 2025. URL: https://doi.org/10.1145/3714393.3726494.
  27. Gabriele De Vito, Fabio Palomba, and Filomena Ferrucci. SecLLM: Enhancing security smell detection in IaC with large language models. IEEE Access, 13:204480-204498, 2025. URL: https://doi.org/10.1109/ACCESS.2025.3637505.
Any Issues?
X

Feedback on the Current Page

CAPTCHA

Thanks for your feedback!

Feedback submitted to Dagstuhl Publishing

Could not send message

Please try again later or send an E-mail
© 2023-2026 Schloss Dagstuhl – LZI GmbH Schloss Dagstuhl – LZI GmbH About DROPS Imprint Privacy Contact