Security-Integrated Test Framework for FedRAMP-Ready Cloud Applications

Abstract

As the modern SaaS architecture has complex and dynamic nature, it is a challenge to ensure FedRAMP compliance related to the cloud-native environments. The paper entails a framework of a security-integrated test automation that can be used to test important FedRAMP controls namely access management, enforcement of encryption, and audit logging accross multicloud environments. The framework takes advantage of the Policy-as-Code principles and reinforcements IaC scanners, such as the tfsec and Regula, the admission controllers in the Kubernetes area, such as the Gatekeeper and behavior monitoring based on SIEM-compatible logs. The CI/CD workflows include tests that can support the continuous security between the code and the runtime. The Terraform and Kubernetes configurations were deployed on the AWS, Azure, and GCP platforms through implementation of policies before and after the deployment on the platforms. Its performance indicates significant increase in the policy detection rates (up to 98 percent) and the speed at which it mitigates (less than 6 minutes) and very low false positive rates. It was also a portable framework, which was demonstrated to work on such DevOps platforms as GitHub Actions, Jenkins, and Azure DevOps. This will automate security checks and checks, and integrate those with current development pipelines, decreasing manual work, problems of compliance drifting as well as aligning the cloud development with the strict FedRAMP requirements. The framework proposed therefore amounts to a feasible, manageable and policy-based ready solution to cloud applications facing governments bridging the disparity between agility in operation and government security regulations.