Open-Source Cloud Security Compliance Based on Policy Evidence Graphs

Abstract

Cloud infrastructure security depends on continuous monitoring of identity permissions, configuration baselines, runtime behavior, and infrastructure-as-code compliance. However, fragmented tools often make it difficult for security teams to connect policy violations with operational evidence. This article proposes an open-source cloud security compliance framework based on policy evidence graphs. The framework organizes cloud assets, identities, vulnerabilities, runtime alerts, and remediation actions into a graph-based structure. Policy engines evaluate infrastructure configurations against security baselines, while runtime monitoring tools detect suspicious activities in containerized environments. The evidence graph enables analysts to trace each security finding back to affected resources, violated policies, and recommended remediation steps. The article emphasizes open-source extensibility, multi-cloud adaptability, and explainable compliance reporting. By transforming fragmented security signals into structured policy evidence, the proposed approach improves audit readiness, remediation prioritization, and cloud governance transparency.