arXiv:2510.20211cs.SEcs.AI2025-10被引 6

用AI自动同步云配置,防止手动修改导致的系统混乱。

Automated Cloud Infrastructure-as-Code Reconciliation with AI Agents

  • 通过分析云接口调用记录,自动发现非代码管理的变更
  • 在372个真实场景中准确率提升至97%,效率提高1.47倍
  • 适合运维团队、DevOps工程师使用,尤其适用于大型云项目

云基础设施通常通过控制台、命令行或SDK等多类接口管理。近年来,IaC(如Terraform)因其将基础设施定义为“源代码”而迅速普及,可自动部署、更新或销毁资源以对齐配置。然而,当与外部工具共用时,IaC无法感知非代码路径的修改,导致配置漂移,后续操作可能误删有效变更或引发错误。本文提出NSync系统,利用云API调用痕迹检测漂移并反向同步到IaC配置。其核心思想是:所有基础设施变更最终都通过云API执行。NSync采用智能体架构,借助大模型从杂乱的API序列中推断高阶意图,结合专用工具生成精准的IaC更新,并通过历史重构知识库持续优化。我们还构建了新型评估流程,在五个真实Terraform项目中注入372种真实漂移场景,实验显示其准确率从0.71提升至0.97(pass@3),token效率提升1.47倍。

原文摘要 · Abstract (English)

Cloud infrastructure is managed through a mix of interfaces -- traditionally, cloud consoles, command-line interfaces (CLI), and SDKs are the tools of choice. Recently, Infrastructure-as-Code/IaC frameworks (e.g., Terraform) have quickly gained popularity. Unlike conventional tools, IaC~frameworks encode the infrastructure in a "source-of-truth" configuration. They are capable of automatically carrying out modifications to the cloud -- deploying, updating, or destroying resources -- to bring the actual infrastructure into alignment with the IaC configuration. However, when IaC is used alongside consoles, CLIs, or SDKs, it loses visibility into external changes, causing infrastructure drift, where the configuration becomes outdated, and later IaC operations may undo valid updates or trigger errors. We present NSync, an automated system for IaC reconciliation that propagates out-of-band changes back into the IaC program. Our key insight is that infrastructure changes eventually all occur via cloud API invocations -- the lowest layer for cloud management operations. NSync gleans insights from API traces to detect drift (i.e., non-IaC changes) and reconcile it (i.e., update the IaC configuration to capture the changes). It employs an agentic architecture that leverages LLMs to infer high-level intents from noisy API sequences, synthesize targeted IaC updates using specialized tools, and continually improve through a self-evolving knowledge base of past reconciliations. We further introduce a novel evaluation pipeline for injecting realistic drifts into cloud infrastructure and assessing reconciliation performance. Experiments across five real-world Terraform projects and 372 drift scenarios show that NSync outperforms the baseline both in terms of accuracy (from 0.71 to 0.97 pass@3) and token efficiency (1.47$\times$ improvement).

云安全自动化运维AI AgentIaC

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。