Policy-as-Code and Event-Driven State Reconciliation for Automated Multi-Cloud Security

Abstract

Multi-cloud workloads inherit a different identity model, resource defaults, and audit interface from each provider, so a security control is enforced unevenly, and a change made outside the deployment pipeline leaves a resource exposed until someone notices. This paper presents a framework that closes this exposure window at both ends. Security policy is written in Rego and evaluated against the Terraform plan inside the CI/CD pipeline, so a violating definition fails the build before apply. At runtime, AWS CloudTrail and Azure Activity Log events are normalised into a provider-neutral record and compared attribute by attribute against a signed, Git-backed baseline. A change made by a principal other than the pipeline deployment identity is reverted through a scoped provider API call, subject to rate limits, change-freeze windows, and a dry-run mode. The prototype was evaluated on a synthetic AWS and Azure testbed with eight scenarios: six injected drift scenarios, one approved pipeline deployment used as a false-positive control, and one insecure definition submitted for pre-deployment rejection. Of the nine system components, five were exercised by live scenarios, and four were implemented without scenario-level testing. Accuracy, precision, recall, F1, detection and remediation times, exposure window, rollback success, policy-gate effectiveness, and false-positive rate are defined in the Evaluation Metrics subsection, but measured values are not yet reported, so this abstract makes no quantitative performance claim. The evaluation is limited to a synthetic environment with two providers, and the protection is only as sound as the policy set it enforces.