Policy-as-Code Validation for Enterprise Storage Automation: A Fault-Injection Study of Configuration Errors and Recovery Behaviour
Abstract
Policy-as-code provides a mechanism for testing infrastructure changes before deployment, but its effectiveness depends on whether policy rules detect operationally meaningful faults rather than only syntax violations. A fault-injection experiment evaluated a policy-validation layer across 420 automated storage changes involving capacity, replication, access control, snapshot, and encryption settings. Forty-two predefined fault classes were introduced at configuration, dependency, and runtime stages. Detection rate, false-positive rate, downstream configuration error, and recovery time were compared with conventional pre-deployment checks. The policy layer identified 89.5% of injected high-severity faults before execution and reduced downstream configuration errors from 12.1% to 4.4%. False positives remained low at 3.6%, although rule performance was weaker for context-dependent dependency failures. Median recovery time following an escaped fault was 27 minutes with policy validation and 41 minutes under the standard workflow. Rules linked to access control and replication safety generated the greatest reduction in operational risk. The results suggest that policy-as-code can materially strengthen storage automation when policies are written around failure consequences and system dependencies rather than static configuration conformance alone.
References
1. Nazir M. Automating enterprise storage provisioning with PowerShell and Python: effects on deployment time and configuration errors. Journal of Multidisciplinary Research and Integrated Sciences. 2021;1(1). Available from: https://jmris.com/index.php/jmris/article/view/2021P1V6
2. Rahman A, Mahdavi-Hezaveh R, Williams L. A systematic mapping study of infrastructure as code research. Inf Softw Technol. 2019;108:65-77. doi:10.1016/j.infsof.2018.12.004.
3. Sharma T, Fragkoulis M, Spinellis D. Does your configuration code smell?. In: Proceedings of the 13th Working Conference on Mining Software Repositories. 2016. p. 189-200. doi:10.1145/2901739.2901761.
4. Rahman A, Williams L. Source code properties of defective infrastructure as code scripts. Inf Softw Technol. 2019;112:148-163. doi:10.1016/j.infsof.2019.04.013.
5. Hanappi O, Hummer W, Dustdar S. Asserting reliable convergence for configuration management scripts. In: Proceedings of the 2016 ACM SIGPLAN International Conference on Object-Oriented Programming, Systems, Languages, and Applications. 2016. p. 328-343. doi:10.1145/2983990.2984000.
6. Rahman A, Elder S, Shezan FH, Frost V, Stallings J, Williams L. Bugs in infrastructure as code. arXiv [Preprint]. 2018. doi:10.48550/arXiv.1809.07937.
7. Rahman A, Farhana E, Williams L. The 'as code' activities: development anti-patterns for infrastructure as code. arXiv [Preprint]. 2020. doi:10.48550/arXiv.2006.00177.
8. Mytkowicz T, Diwan A, Hauswirth M, Sweeney PF. Producing wrong data without doing anything obviously wrong. In: Proceedings of the 14th International Conference on Architectural Support for Programming Languages and Operating Systems. 2009. p. 265-276. doi:10.1145/1508244.1508275.
9. Kalibera T, Jones R. Rigorous benchmarking in reasonable time. In: Proceedings of the 2013 International Symposium on Memory Management. 2013. p. 63-74. doi:10.1145/2464157.2464160.
10. Dean J, Barroso LA. The tail at scale. Commun ACM. 2013;56(2):74-80. doi:10.1145/2408776.2408794.
11. Rose S, Borchert O, Mitchell S, Connelly S. Zero trust architecture. Gaithersburg (MD): National Institute of Standards and Technology. 2020;NIST SP 800-207. doi:10.6028/NIST.SP.800-207.
12. Swanson M, Bowen P, Phillips AW, Gallup D, Lynes D. Contingency planning guide for federal information systems. Gaithersburg (MD): National Institute of Standards and Technology. 2010;NIST SP 800-34 Rev. 1. doi:10.6028/NIST.SP.800-34r1.
13. Lakens D. Sample size justification. Collabra Psychol. 2022;8(1):33267. doi:10.1525/collabra.33267.
14. Nosek BA, Ebersole CR, DeHaven AC, Mellor DT. The preregistration revolution. Proc Natl Acad Sci U S A. 2018;115(11):2600-2606. doi:10.1073/pnas.1708274114.
15. Wilkinson MD, Dumontier M, Aalbersberg IJ, Appleton G, Axton M, Baak A, et al. The FAIR Guiding Principles for scientific data management and stewardship. Sci Data. 2016;3:160018. doi:10.1038/sdata.2016.18.
16. Lakens D. Calculating and reporting effect sizes to facilitate cumulative science: a practical primer for t-tests and ANOVAs. Front Psychol. 2013;4:863. doi:10.3389/fpsyg.2013.00863.
17. Efron B. Bootstrap methods: another look at the jackknife. Ann Stat. 1979;7(1):1-26. doi:10.1214/aos/1176344552.
18. Benjamini Y, Hochberg Y. Controlling the false discovery rate: a practical and powerful approach to multiple testing. J R Stat Soc Series B Stat Methodol. 1995;57(1):289-300. doi:10.1111/j.2517-6161.1995.tb02031.x.
Published
Issue
Section
License
Authors retain copyright. Articles published under the Creative Commons Attribution 4.0 International licence (CC BY 4.0) may be shared and adapted for any purpose, including commercially, provided appropriate credit is given, a link to the licence is supplied, and changes are indicated. No additional legal or technological restrictions may be imposed. Third-party material is included only where its credit line permits. Licence: https://creativecommons.org/licenses/by/4.0/. Earlier publications remain subject to their stated licence and author agreements unless the rights holder authorizes a change.
