Cloud-Agnostic Self-Correcting Compliance-as-Code Framework Using AI Agents, OPA, and Terraform for HIPAA/GDPR/PCI-DSS Enforcement

Kariyavula, Vikram (2025) Cloud-Agnostic Self-Correcting Compliance-as-Code Framework Using AI Agents, OPA, and Terraform for HIPAA/GDPR/PCI-DSS Enforcement. Masters thesis, Dublin, National College of Ireland.

Preview	PDF (Master of Science) Download (1MB) | Preview
Preview	PDF (Configuration Manual) Download (1MB) | Preview

Abstract

Cloud infrastructure compliance to regulatory frameworks like HIPAA, GDPR and PCI-DSS is a major challenge for organizations implementing Infrastructure-as-Code practices, where compliance verification is manually verified which is increasingly impractical at scale. This research explored how self-corrective cloud-agnostic AI agents using Agent Development Kit, Open Policy Agent, and Terraform can be used to automate regulatory compliance enforcement on AWS infrastructure and increase security posture. An integrated system was built, which combined an OPA validation pipeline for the policy-based compliance detection and an ADK-powered compliance-healing agent that is able to automate the remediation of infrastructure violations. Comprehensive experimental evaluation through five experiments showed that the system proved to have 97.4% policy detection accuracy, 85% regulatory coverage through HIPAA achieving perfect compliance and GDPR at 80% and PCI-DSS at 80%, and 62.8% time reduction compared to manual resolution. The self-healing agent was able to remediate 80% self-sufficiently, with 100% success rates for routine configurations such as S3 encryption and EC2 tagging, 94.6% cost savings with $0.26 vs. $4.80 per violation. A 15-day monitoring of the operational performance demonstrated positive learning curves with automated fix success rates increasing from 72.2% to 90.0%. The results confirm that the presence of declarative policy languages and remediation based on the LLM provides a feasible model of sustained compliance automation in cloud-native environments, which reduces the economic and operational viability of production deployment.

Item Type:	Thesis (Masters)
Supervisors:	Name Email Jaswal, Shivani UNSPECIFIED
Uncontrolled Keywords:	Cloud Compliance Automation; Compliance-as-Code; Infrastructure-as-Code; Open Policy Agent; Agent Development Kit; Compliance-Healing Systems
Subjects:	Q Science > QH Natural history > QH301 Biology > Methods of research. Technique. Experimental biology > Data processing. Bioinformatics > Artificial intelligence Q Science > Q Science (General) > Self-organizing systems. Conscious automata > Artificial intelligence T Technology > T Technology (General) > Information Technology > Cloud computing
Divisions:	School of Computing > Master of Science in Cloud Computing
Depositing User:	Ciara O'Brien
Date Deposited:	31 Aug 2026 15:17
Last Modified:	31 Aug 2026 15:17
URI:	https://norma.ncirl.ie/id/eprint/9711

Actions (login required)

View Item