DOML: A new modeling approach to Infrastructure-as-Code

One of the main DevOps practices is the automation of resource provisioning and deployment of complex software. This automation is enabled by the explicit definition of Infrastructure-as-Code (IaC), i.e., a set of scripts, often written in different modelling languages, which defines the infrastructure and applications to be deployed. We introduce the DevOps Modelling Language (DOML), a new Cloud modelling language for infrastructure deployments. DOML is a modelling approach that can be mapped into multiple IaC languages, addressing infrastructure provisioning, application deployment and configuration at once. The idea behind DOML is to use a single modelling paradigm which can help to reduce the need of deep technical expertise in using different specialised IaC languages. We present the DOML’s principles and discuss the related work on IaC languages. We demonstrate the DOML advantages for the end-user in comparison with state-of-the-art IaC languages such as Ansible, Terraform, and Cloudify, and show its effectiveness through an example.

Infrastructure as Code, also named Infrastructure-Aware Software, is one of the roots of modern software deployment tactics in clouds noted by providing high efficiency, measurability and modularity. This paper focuses on AWS Cloud Formation, the transformative and efficient IaC tool that simplifies, scales, and secures software instantiation. As more organizations adopt cloud environments, they experience challenges that arise from cloud infrastructure management. AWS Cloud Formation helps overcome these challenges by presenting a single, declarative, resource-provisioning model. In this paper, you learn the value of AWS Cloud Formation, such as its capacity to create and manage resources, including EC2 instances, VPCs, and load balancers for you. The paper also discusses further recommendations for considerations of AWS Cloud Formation templates in scaling and deploying applications, meeting the requirements of multi-Region applications, as well as the utilization of IAM policies and metadata for encryption into the application. Additionally, we explain use cases of Cloud Formation in different sectors and its use in conjunction with DevOps tools and CI/CD pipelines and the automation tools AWS Code Pipeline and AWS Code Build. In addition to this, we provide a literature review of the development of IaC and a comparison of IaC from different cloud computing platforms, as well as a comparison of how Cloud Formation differs from Terraform and other related tools. Furthermore, we provide best practices in general for Azure ARM and especially refine an already existing guide for AWS cloud formation for an enterprise environment, complemented with real examples. In the results and discussion section, we provide the extent to which Cloud Formation has helped minimize human error, made operations more efficient, and increased security in the cloud environment. Finally, we present a conclusion containing recommendations and possible prospects for the development of Cloud Formation in the context of a rapidly changing base of cloud services. Keywords: Infrastructure as Code (IaC), AWS Cloud Formation, DevOps, Multi-region Deployments, Resource Provisioning.

The current IT market is more and more dominated by the “cloud continuum”. In the “traditional” cloud, computing resources are typically homogeneous in order to facilitate economies of scale. In contrast, in edge computing, computational resources are widely diverse, commonly with scarce capacities and must be managed very efficiently due to battery constraints or other limitations. A combination of resources and services at the edge (edge computing), in the core (cloud computing), and along the data path (fog computing) is needed through a trusted cloud continuum. This requires novel solutions for the creation, optimization, management, and automatic operation of such infrastructure through new approaches such as infrastructure as code (IaC). In this paper, we analyze how artificial intelligence (AI)-based techniques and tools can enhance the operation of complex applications to support the broad and multi-stage heterogeneity of the infrastructural layer in the “computing continuum” through the enhancement of IaC optimization, IaC self-learning, and IaC self-healing. To this extent, the presented work proposes a set of tools, methods, and techniques for applications’ operators to seamlessly select, combine, configure, and adapt computation resources all along the data path and support the complete service lifecycle covering: (1) optimized distributed application deployment over heterogeneous computing resources; (2) monitoring of execution platforms in real time including continuous control and trust of the infrastructural services; (3) application deployment and adaptation while optimizing the execution; and (4) application self-recovery to avoid compromising situations that may lead to an unexpected failure.

This paper presents a systematic review of Infrastructure as Code (IaC) and GitOps, exploring their transformative roles in cloud automation and governance. IaC, an approach that defines and provisions infrastructure using code, automates cloud infrastructure management, offering significant improvements in consistency, scalability, and agility. GitOps, as an extension of IaC, leverages Git repositories as the single source of truth, enabling seamless continuous delivery and deployment (CI/CD) workflows. This review highlights the synergistic benefits of combining IaC and GitOps, including enhanced operational efficiency, faster scaling, and stronger governance. However, the review also identifies key challenges in their implementation, such as toolchain integration, complexity in large-scale environments, and ensuring governance and security across cloud platforms. Case studies and emerging trends, including AI-powered automation and multi-cloud strategies, are discussed to illustrate real-world applications and future opportunities. The paper concludes by identifying areas for future research, including the development of advanced automation tools, multi-cloud governance frameworks, and improved security compliance mechanisms.

The deployment of cloud applications and the correct management of their lifecycle is a colossal task. Infrastructure as Code (IaC) tools make this task easier; however, they require the user to have a deep knowledge of both the IaC language and the characteristics of various cloud services providers. The PIACERE project has developed a DevOps Modelling Language (DOML), aiming at describing cloud applications that are agnostic of the specificities of the different providers and IaC tools used for provisioning, deployment and configuration. DOML provides several modeling perspectives in a multi-layer approach. An application can be described in three layers: application layer, abstract and concrete infrastructure layer. It allows developers to describe how cloud applications are structured in an abstract manner, mapping the different software components to the concrete infrastructure elements, enabling the usage of different concretizations to match one particular deployment. This paper provides an overview of the DOML language: its layers and extension mechanisms, as well as an example to showcase its modeling capabilities.KeywordsInfrastructure as codeDevOps modelling languageMulti-layer approachAbstraction

The advent of 5G technology marks a significant transformation in the telecommunications landscape, promising to deliver ultra-fast data speeds, minimal latency, and widespread connectivity that supports many new services and applications, including IoT, augmented reality, and autonomous systems. However, achieving the full potential of 5G networks involves overcoming substantial infrastructure challenges. Deploying and managing 5G's intricate architecture, encompassing the Radio Access Network (RAN), Core network, and Service-Based Interfaces (SBI)—requires a shift from traditional, labor-intensive methods to more advanced, automated processes. Infrastructure-as-Code (IaC) has emerged as a game-changing methodology that addresses these needs by codifying infrastructure setup and management into programmable scripts. This comprehensive review delves into how IaC facilitates the efficient deployment and management of 5G components, enhancing agility, consistency, and scalability. By automating resource provisioning, configuration, and updates, IaC empowers network operators to rapidly deploy infrastructure that meets the demanding requirements of 5G services. The paper discusses how IaC enables seamless integration and scaling of network functions, improves operational efficiency through reduced human error, and supports consistent infrastructure management across distributed environments. Key tools such as Terraform, Ansible, and Kubernetes are explored, showcasing their applications in orchestrating various layers of the 5G network, from RAN deployment to core network orchestration and SBI configurations. Despite its advantages, adopting IaC in 5G deployment comes with its challenges. These include managing the complexities inherent in multi-vendor environments, ensuring robust security for automated provisioning scripts, and maintaining compliance with regional regulatory standards. The paper explores these obstacles in-depth, offering insights into best practices and potential solutions to navigate these hurdles. This review highlights emerging trends and research opportunities, such as the potential for zero-touch automation, which leverages IaC for autonomous network operations with minimal human intervention. It also discusses the role of artificial intelligence (AI) and machine learning (ML) in predictive resource management and automated fault detection, proposing a future where AI-enhanced IaC can revolutionize the deployment and operation of 5G networks. By examining these elements, the review aims to provide a holistic view of the current state and future trajectory of IaC in 5G RAN, Core, and SBI deployment, setting the stage for ongoing innovation and development in the field.

Cloud technologies quickly evolve and require efficient ways to process and deploy data for high operational performance and low cost. This study looks at code-driven automation applied to cloud infrastructure, with a focus on Terraform, Jenkins, and Kubernetes. Automating infrastructure provisioning and application deployments, these tools minimize human intervention and potential human error, thus optimizing operational effectiveness. The findings indicate that code-driven automation not only accelerates deployments but also provides scalability and dependability among many cloud environments, thus ensuring fast and efficient delivery of cloud services. With this strategy, organizations can optimize their cloud operations and resource utilization needs. The research helps to understand how effective automation of processes would improve cloud infrastructure management and service delivery in very dynamic technological times. Keywords—Cloud Infrastructure Management, Code-Driven Automation, Infrastructure as Code (IaC), Automated Deployment, Cloud Efficiency, Resource Utilization, CI/CD Pipelines, Kubernetes.

The rapid pace of software development and deployment in today's digital world demands an integrated approach to security, particularly in Continuous Integration/Continuous Deployment (CI/CD) pipelines. Traditional approaches to security, where it is added at the end of the development lifecycle, have proven inadequate in addressing the complexities and vulnerabilities introduced by fast-moving development cycles. DevSecOps (Development, Security, and Operations) represents an evolution of the DevOps culture that integrates security as an essential component throughout the development process, rather than as an afterthought. This paper explores the role of DevSecOps in ensuring continuous security integration within CI/CD pipelines, focusing on its principles, practices, and impact on both security and development efficiency. DevSecOps emphasizes the shift-left approach, where security is integrated early in the software development lifecycle (SDLC) to identify and mitigate vulnerabilities before they reach production. By embedding security practices into CI/CD workflows, organizations can achieve continuous security validation and testing in tandem with software development activities. Key components of a successful DevSecOps implementation include automated security testing, real-time vulnerability scanning, infrastructure as code (IaC) security, and threat intelligence integration. Through the use of tools like static application security testing (SAST), dynamic application security testing (DAST), and software composition analysis (SCA), DevSecOps facilitates the continuous monitoring of code, configurations, and infrastructure for security issues. This paper also examines the cultural shift required to adopt DevSecOps within development teams. It highlights the importance of fostering collaboration between development, security, and operations teams to ensure seamless integration of security practices into the CI/CD pipeline. By aligning security teams with development and operations, DevSecOps fosters a culture of shared responsibility for security, breaking down silos that traditionally hinder effective security integration.

The adoption of DevOps has significantly reshaped modern software engineering by tightly integrating development and operations activities to achieve faster, more reliable, and scalable software delivery. Despite widespread industry adoption, empirical research on the quantifiable impact of DevOps practices remains fragmented. This study aims to investigate how contemporary DevOps practices influence software quality, delivery speed, and team productivity in real-world environments. A mixed-method approach was employed, combining a multi-case study across four mid-to-large enterprises with a controlled simulation of key DevOps performance metrics. Data were collected from interviews, DevOps telemetry tools (e.g., Jenkins, GitLab CI/CD, Docker, and Kubernetes), and automated system logs. The findings indicate that mature DevOps adoption is associated with a 45% increase in deployment frequency, a 38% reduction in lead time for changes, and a 32% decrease in change failure rates. Nonetheless, organizations face persistent challenges in integrating security (DevSecOps), managing technical debt, and fostering cultural alignment across siloed teams. The results confirm the strategic importance of Infrastructure as Code (IaC), continuous monitoring, and automated testing in optimizing DevOps outcomes. For practitioners, this study offers a practical roadmap for scalable and sustainable DevOps transformation. For researchers, it identifies critical gaps in socio-technical integration and intelligent automation that warrant further investigation. This research contributes to bridging empirical evidence and theoretical frameworks in the evolving field of DevOps in software engineering.

This chapter aims to explore a DevOps-driven approach to enhancing cybersecurity in Cyber-Physical Systems with a focus on safe and secure control across their operational lifecycle. Target groups include cybersecurity researchers, DevOps professionals, software engineers, and stakeholders managing CPS in sectors such as energy, transportation, and manufacturing. The methodology integrates DevSecOps principles—(CI/CD, and Infrastructure as Code (IaC)—within CPS architectures to ensure continuous threat monitoring, vulnerability mitigation, and adaptive incident response. Key findings highlight the effectiveness of embedding security throughout the SSDLC, supported by tools like SonarQube, OWASP ZAP, and Snyk. Case studies on Smart Grids, Industrial Control Systems, and Autonomous Vehicles illustrate real-world applications. The chapter concludes that adopting DevOps in CPS enhances system resilience, supports regulatory compliance, and offers scalable solutions to emerging threats, emphasizing the need for cultural shifts and future research on AI and Blockchain-enabled security.

The healthcare industry is increasingly vulnerable to cyberattacks, with sensitive patient data and critical operations becoming prime targets for malicious actors. In response, healthcare organizations are embracing the Zero Trust security model, which operates on the principle of "never trust, always verify." This model assumes that threats can emerge both outside and within the network and requires strict identity verification for every user and device attempting to access resources, regardless of their location. When combined with DevOps practices, Zero Trust strengthens security while maintaining the speed and agility necessary for modern healthcare systems. By embedding security into every phase of the development lifecycle, DevOps enables healthcare organizations to continuously monitor, test, and update their systems, ensuring that security measures evolve alongside emerging threats. Infrastructure as Code (IaC) plays a key role in this integration, automating the deployment and management of secure, scalable infrastructure, while continuous integration/continuous delivery (CI/CD) pipelines ensure that updates are deployed swiftly and securely. The synergy between Zero Trust and DevOps transforms healthcare IT operations, enabling real-time monitoring, dynamic threat response, and better protection of sensitive patient data. This article explores how healthcare providers are adopting this approach to meet compliance requirements, improve system resilience, and safeguard patient privacy, all while maintaining the operational efficiency and innovation required in today?s fast-paced digital landscape. With Zero Trust and DevOps working hand in hand, healthcare organizations can build a more secure, agile, and future-proof foundation for their digital transformation initiatives.

In 2021, the National Institute for Nuclear Physics (INFN) launched the INFN Cloud Orchestration system to support Italy’s largest research and academic distributed infrastructure. The INFN Cloud orchestration system is an open-source middleware designed to seamlessly federate heterogeneous computing environments, including public and private resource providers, container platforms, and more. It provides a customizable service portfolio, crafted to suit the distinct needs of specific communities. It supports standard Infrastructure as a Service (IaaS) options, advanced Platform as a Service (PaaS) configurations and useful Software as a Service (SaaS) solutions, such as Jupyter Hub, Kubernetes, Spark, and HTCondor clusters. Its primary function resides in orchestrating the deployment of virtual infrastructures, ranging from simple to intricate setups, providing users with convenient access and operational control. The INFN Cloud platform’s federation middleware is composed of several interconnected open-source microservices. At the core of the orchestration system lies the INDIGO PaaS Orchestrator a Java-based REST API that handles high-level deployment requests across federated cloud providers. The other microservices of the federation middleware play an essential role in the selection of the most suitable federated provider and managing communication within the distributed environment. The most recent software upgrades can be understood as the first steps toward the definition of a new architecture based on message exchange between micro-services and exploiting Machine Learning for the optimal resource provider selection. In this context, a plan to replace the existing micro-services, exploiting newer and modern technologies, is in the making and will be adopted in the next period. In particular, the AI-ranker, devoted to the smart choice of the best provider, and the Federation-Registry, devoted to collect different information from the federated providers, will replace and evolve the in-use services offering limited features. Following a similar approach, new components will be introduced to enable advanced features, including the use of open-source Infrastructure as Code (IaC) tools to support interaction with containerized platforms such as Kubernetes. Additionally, as part of the system renovation, the Kafka queue mechanism will be adopted to manage PaaS deployments and to deliver deployment details to the INDIGO PaaS Orchestrator microservices. Finally, with the continuous growth of the number and quality of micro-services, a reliable and automated procedure aimed at securing and simplifying the deployment procedure of the core services is under definition.

Modern cloud applications increasingly depend on Infrastructure-as-Code (IaC) practices for infrastructure automation to help manage the complexity of deploying large-scale architectures. Additionally, the deployment of cloud applications is commonly subject to compliance rules. Moreover, designing compliant IaC-based cloud deployments is not enough since runtime changes to the infrastructure or the configuration of individual components may introduce compliance violations. Often, the process of checking and fixing such violations is done manually, which is time-consuming and error-prone. Therefore, this work aims to define and implement a method for runtime IaC compliance management that reduces the complexity, effort, and uncertainty of checking and enforcing compliance rules against IaC-based cloud deployments at runtime. To this end, we follow the design-science research methodology to design and implement (i) the Runtime IaC Compliance Management (RICMa) method and (ii) the IaC Compliance Management Framework (IaCMF) that supports the execution of the RICMa method. We prototypically implement IaCMF and evaluate it using a qualitative interview study with industry experts.

As enterprises increasingly adopt Azure DevOps for continuous integration and continuous deployment (CI/CD), ensuring robust security and compliance in cloud-based DevOps pipelines has become a critical challenge. This article explores the complex landscape of security and compliance within Azure DevOps, focusing on the hurdles faced by organizations during deployment and operation at scale. We delve into common security risks, such as unauthorized access, data breaches, and configuration vulnerabilities, while also addressing the complexities of adhering to industry-specific compliance frameworks, including GDPR, HIPAA, and SOC 2. The study reviews current best practices for integrating security into the DevOps pipeline, emphasizing the importance of Infrastructure as Code (IaC), identity and access management (IAM), automated security testing, and monitoring tools. Additionally, the article evaluates how Azure DevOps tools, such as Azure Security Center, Azure Policy, and Azure Blueprints, can help streamline compliance management and mitigate risks. Through real-world case studies and expert interviews, this article provides practical solutions for enterprises seeking to enhance their security posture while ensuring compliance within their Azure DevOps workflows. The findings highlight the importance of automated security checks, compliance automation, and the need for a culture of security across DevOps teams to address the challenges of scaling enterprise deployments securely and efficiently.

An ontology based approach for operational process modeling