Work

Hybrid Fuzzing of Infrastructure as Code Programs (Short Paper)

Year: 2025

Type: conference-paper

Abstract: Infrastructure as Code (IaC) has become a cornerstone of modern cloud and system deployment, enabling automated and repeatable infrastructure provisioning. However, ensuring the correctness of IaC programs remains challenging due to their complexity and dynamic nature. In particular, IaC programs can exhibit different behaviors depending on the state of the resources they manage. Since these resources are deployed on external providers, accounting for their possible states is difficult, making the testing phase particularly challenging. This paper presents HIT, a novel unit-testing framework for IaC programs that effectively tests IaC code using relevant resource states. HIT combines fuzzing and concolic execution, two effective yet previously unexplored techniques for IaC code. Our experiments confirm that HIT achieves better code coverage than state-of-the-art approaches.

Source: ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA)

DOI: 10.1145/3713081.3731721

Authors: Emilio Coppa, Daniel Sokolowski, Guido Salvaneschi

Institutions: Libera Università Internazionale degli Studi Sociali Guido Carli, University of St.Gallen

Language: English

Topic: Software Testing and Debugging Techniques

Subfield: Software

Field: Computer Science

Domain: Physical Sciences

Open Access status: hybrid

Funders: National Science Foundation, European Commission, Schweizerischer Nationalfonds zur Förderung der Wissenschaftlichen Forschung

Awards: European Open Compute Architecture for Powerful Edge, Multitier Programming above the Clouds, Consistency Programming for Local First Software