Automated Lifting for Cloud Infrastructure-as-Code Programs

Abstract

Infrastructure-as-code (IaC) is reshaping how cloud resources are managed. IaC users write high-level programs to define their desired infrastructure, and the underlying IaC platforms automatically deploy the constituent resources into the cloud. While proven powerful at creating greenfield deployments (i.e., deployments from scratch), existing IaC platforms provide limited support for managing brownfield infrastructure (i.e., existing, non-IaC deployments). This hampers migration from legacy management approaches to an IaC workflow and hinders wider IaC adoption. Managing brownfield deployments requires techniques to lift low-level cloud states and translate them into corresponding IaC programs - the reversal of the regular deployment process. Existing tools rely heavily on rule-based reverse engineering, which suffers from the lack of automation, limited resource coverage, and prevalence of errors. In this work, we lay out the vision for Lilac, an approach that frees IaC lifting from extensive manual engineering. Lilac brings the best of both worlds: leveraging LLMs to automate lifting rule extraction, coupled with symbolic methods to provide correctness assurance. We envision that Lilac would enable the construction of an automated and provider-agnostic lifting tool with high coverage and accuracy. A prototype of LILAC is available here.