用自然语言自动生成并验证代码合规规则，降低安全配置门槛。
ARPaCCino: An Agentic-RAG for Policy as Code Compliance
- 结合大模型与检索增强生成，自动将自然语言转为正式策略规则。
- 在Terraform案例中成功识别违规配置并自动修正，即使使用小模型也有效。
- 适合安全工程师、DevOps团队快速实现自动化合规检查。
Policy as Code（PaC）将安全与合规策略编码为可机器读取的格式，实现在基础设施即代码（IaC）环境中的自动化执行。然而，其应用受限于策略语言的复杂性及配置错误风险。本文提出ARPaCCino，一种融合大型语言模型（LLMs）、检索增强生成（RAG）与工具化验证的智能体系统，可自动完成PaC规则的生成与验证。给定自然语言描述，ARPaCCino能生成正式的Rego规则，评估IaC合规性，并迭代优化配置以确保符合要求。得益于模块化的智能体架构及其与外部工具和知识库的集成，该系统支持多种技术栈的策略验证，涵盖新兴或小众的IaC框架。基于Terraform的实验表明，ARPaCCino能生成语法和语义正确的策略，识别不合规基础设施，并实施修正操作，即便采用较小的开源大模型亦表现良好。结果表明，智能体式RAG架构显著提升了PaC工作流的自动化水平、可靠性与可访问性。
原文摘要 · Abstract (English)
Policy as Code (PaC) is a paradigm that encodes security and compliance policies into machine-readable formats, enabling automated enforcement in Infrastructure as Code (IaC) environments. However, its adoption is hindered by the complexity of policy languages and the risk of misconfigurations. In this work, we present ARPaCCino, an agentic system that combines Large Language Models (LLMs), Retrieval-Augmented-Generation (RAG), and tool-based validation to automate the generation and verification of PaC rules. Given natural language descriptions of the desired policies, ARPaCCino generates formal Rego rules, assesses IaC compliance, and iteratively refines the IaC configurations to ensure conformance. Thanks to its modular agentic architecture and integration with external tools and knowledge bases, ARPaCCino supports policy validation across a wide range of technologies, including niche or emerging IaC frameworks. Experimental evaluation involving a Terraform-based case study demonstrates ARPaCCino's effectiveness in generating syntactically and semantically correct policies, identifying non-compliant infrastructures, and applying corrective modifications, even when using smaller, open-weight LLMs. Our results highlight the potential of agentic RAG architectures to enhance the automation, reliability, and accessibility of PaC workflows.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。