AN AUTOMATED GOLDEN-IMAGE LIFECYCLE MANAGEMENT SYSTEM AS A MEANS OF REDUCING PUBLIC-CLOUD INFRASTRUCTURE VULNERABILITIES
DOI:
https://doi.org/10.28925/2663-4023.2026.35.1447Keywords:
public cloud; golden image; machine image; immutable infrastructure; DevSecOps; HashiCorp Packer; vulnerability scanning; AWS AMI; Azure Compute Gallery; GCE Custom Images; VMware vSphere; image governance; shift-left.Abstract
A large share of public-cloud security research and practice focuses on individual runtime instances, while organizational processes for managing machine images remain neglected. This study treats golden-image lifecycle management as a distinct security-control layer for monolithic applications deployed on virtual machines across VMware vSphere, Google Compute Engine, AWS, and Microsoft Azure. Containerized microservice delivery and Kubernetes admission controls are outside the primary scope because they use a different deployment artifact and lifecycle.
The scientific novelty of this work lies in integrating an immutable image-build pipeline based on HashiCorp Packer and Ansible with Jenkins/Tekton orchestration, automated vulnerability scanning, a policy gate, evidence storage, runtime monitoring, and an ITSM approval workflow. Supporting corporate services are described as interchangeable logical functions rather than research targets, reducing unnecessary vendor coupling.
The paper presents an integrated provisioning diagram, a compact architectural vision, six detailed stage diagrams, and a controlled local experiment with four historical Ubuntu 24.04 cloud images. Under one signed APT snapshot and one frozen Trivy database, ordinary full-upgrade reduced unique fixable HIGH/CRITICAL CVEs from 1,680 to 1,605, corresponding to 4.46% coverage. After boot verification and exact removal of 22 obsolete versioned kernel packages, the observed fixable HIGH/CRITICAL count fell to zero while all functional and hardening tests passed. Policy decisions changed from BLOCK to REVIEW because five CRITICAL CVEs without an available fixed version remained in every cleaned image.
Downloads
References
Orca Security. (2025). 2025 state of cloud security report. https://orca.security/resources/state-of-cloud-security/
Wiz. (2025). Cloud data security snapshot 2025. https://www.wiz.io/reports/cloud-data-security-report-2025
IBM Security, & Ponemon Institute. (2025). Cost of a data breach report 2025. IBM. https://www.ibm.com/reports/data-breach
Palo Alto Networks, Unit 42. (2023). Cloud threat report: Volume 7. https://unit42.paloaltonetworks.com/cloud-threat-report/
Sysdig. (2025). 2025 cloud-native security and usage report. https://www.sysdig.com/resources/reports/2025-cloud-native-security-and-usage-report
Cloud Security Alliance. (2024). Top threats to cloud computing 2024. https://cloudsecurityalliance.org/artifacts/top-threats-to-cloud-computing-2024
Datadog Security Labs. (2025). whoAMI: A cloud image name confusion attack. https://securitylabs.datadoghq.com/articles/whoami-a-cloud-image-name-confusion-attack/
Amazon Web Services. (2024). Allowed AMIs: Account-level guardrail for approved Amazon Machine Images. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-allowed-amis.html
HashiCorp. (2024). Build a golden image pipeline with HCP Packer. HashiCorp Developer. https://developer.hashicorp.com/packer/tutorials/cloud-production/golden-image-with-hcp-packer
Center for Internet Security. (2024). CIS Hardened Images and CIS Benchmarks. https://www.cisecurity.org/cis-hardened-images
Mohammed, K. I., Shanmugam, B., & El-Den, J. (2025). Evolution of DevSecOps and its influence on application security: A systematic literature review. Technologies, 13(12), Article 548. https://doi.org/10.3390/technologies13120548
Rangnau, T., van Buijtenen, R., Fransen, F., & Turkmen, F. (2020). Continuous security testing: A case study on integrating dynamic security testing tools in CI/CD pipelines. In Proceedings of the 2020 IEEE 24th International Enterprise Distributed Object Computing Conference (EDOC) (pp. 145–154). https://doi.org/10.1109/EDOC49727.2020.00026
Chornii, V., Martseniuk, Y., Partyka, A., & Harasymchuk, O. (2025). Information security risks associated with the uncontrolled storage of secrets in source code. CEUR Workshop Proceedings, 4042, 250–271. https://ceur-ws.org/Vol-4042/
Sapsai, O., Martseniuk, Y., Partyka, A., & Harasymchuk, O. (2025). Research on automated security incident management in public cloud environments. CEUR Workshop Proceedings, 4042, 226–249. https://ceur-ws.org/Vol-4042/
Vakhula, O., Opirskyy, I., Vorobets, P., Bobko, O., & Kulinich, O. (2025). Research on policy-as-code for implementation of role-based and attribute-based access control. CEUR Workshop Proceedings, 3991, 139–157. https://ceur-ws.org/Vol-3991/
Vakhula, O., & Opirskyy, I. (2024). Research on security-as-code approach for cloud-native applications based on Kubernetes clusters. CEUR Workshop Proceedings, 3800, 58–69. https://ceur-ws.org/Vol-3800/
Sysdig. (2024). 2024 cloud-native security and usage report. https://www.sysdig.com/2024-cloud-native-security-and-usage-report
Sysdig. (2026). 2026 cloud-native security and usage report. https://www.sysdig.com/press-releases/2026-usage-report
Amazon Web Services. (n.d.). What is EC2 Image Builder? AWS Documentation. https://docs.aws.amazon.com/imagebuilder/latest/userguide/what-is-image-builder.html
Microsoft. (n.d.). Azure VM Image Builder overview. Microsoft Learn. https://learn.microsoft.com/en-us/azure/virtual-machines/image-builder-overview
Google Cloud. (n.d.). Setting up trusted image policies. Google Cloud Documentation. https://cloud.google.com/compute/docs/images/restricting-image-access
Broadcom. (n.d.). Manage VM templates in a content library. VMware vSphere 8.0 Documentation. https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere-8-0/vsphere-virtual-machine-administration/using-content-librariesvsphere-vm-admin/manage-vm-templates-in-a-content-libraryvsphere-vm-admin.html
Harbor. (2025). Vulnerability scanning (Harbor 2.13.0 documentation). https://goharbor.io/docs/2.13.0/administration/vulnerability-scanning/
National Institute of Standards and Technology. (2022). Secure Software Development Framework (SSDF), version 1.1 (NIST SP 800-218). https://doi.org/10.6028/NIST.SP.800-218
Supply-chain Levels for Software Artifacts. (2026). SLSA specification, version 1.2. https://slsa.dev/spec/v1.2/
Verizon. (2026). 2026 data breach investigations report. Verizon Business. https://www.verizon.com/business/resources/reports/dbir/
National Institute of Standards and Technology. (2012). Guide for conducting risk assessments (NIST SP 800-30 Rev. 1). https://doi.org/10.6028/NIST.SP.800-30r1
FIRST. (2023). Common Vulnerability Scoring System version 4.0: Specification document. https://www.first.org/cvss/v4.0/specification-document
FIRST. (n.d.). Exploit Prediction Scoring System (EPSS): Model and documentation. https://www.first.org/epss/
Cybersecurity and Infrastructure Security Agency. (n.d.). Stakeholder-Specific Vulnerability Categorization (SSVC). https://www.cisa.gov/resources-tools/resources/stakeholder-specific-vulnerability-categorization-ssvc
Cybersecurity and Infrastructure Security Agency. (n.d.). Known Exploited Vulnerabilities catalog. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Canonical. (n.d.). Ubuntu cloud images. https://cloud-images.ubuntu.com/
Canonical. (n.d.). Ubuntu Snapshot Service. https://snapshot.ubuntu.com/; https://ubuntu.com/server/docs/how-to/software/snapshot-service/
Aqua Security. (n.d.). Trivy documentation. https://trivy.dev/docs/
HashiCorp. (n.d.). QEMU builder for Packer. HashiCorp Developer. https://developer.hashicorp.com/packer/integrations/hashicorp/qemu/latest/components/builder/qemu
War, A., Diallo, A., Habib, A., Klein, J., & Bissyandé, T. F. (2025). Vulnerabilities in infrastructure as code: What, how many, and who? Empirical Software Engineering, 30(5), Article 120. https://doi.org/10.1007/s10664-025-10672-8
Kumar, R., & Goyal, R. (2020). Modeling continuous security: A conceptual model for automated DevSecOps using open-source software over cloud (ADOC). Computers & Security, 97, Article 101967. https://doi.org/10.1016/j.cose.2020.101967
Rajapakse, R. N., Zahedi, M., Babar, M. A., & Shen, H. (2022). Challenges and solutions when adopting DevSecOps: A systematic review. Information and Software Technology, 141, Article 106700. https://doi.org/10.1016/j.infsof.2021.106700
Paul, A., Manoj, R., & Udhayakumar, S. (2024). Amazon Web Services cloud compliance automation with Open Policy Agent. In Proceedings of the 2024 International Conference on Expert Clouds and Applications (ICOECA) (pp. 313–317). https://doi.org/10.1109/ICOECA62351.2024.00063
Diaz-De-Arcaya, J., Osaba, E., Benguria, G., Etxaniz, I., Lobo, J. L., Alonso, J., Torre-Bastida, A. I., & Almeida, A. (2023). IEM: A unified lifecycle orchestrator for multilingual IaC deployments. In Companion of the 2023 ACM/SPEC International Conference on Performance Engineering (pp. 195–199). https://doi.org/10.1145/3578245.3584938
Morales, J. A., Hamed, J., Reynolds, D., Shepard, D., Antunes, L., Yankel, J., & Yasar, H. (2023). Experiences with secure pipelines in highly regulated environments. In Proceedings of the 18th International Conference on Availability, Reliability and Security (ARES 2023), Article 57. https://doi.org/10.1145/3600160.3605466
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Євгеній Марценюк, Богдан Маньковський , Олег Дейнека
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
