Trying to connect cloud architecture (CAF / Zero Trust) with IaC validation

Illya Kryushenko — Sun, 26 Apr 2026 00:17:54 +0000

Trying to connect cloud architecture (CAF / Zero Trust) with IaC validation

We often say that architecture defines intent, while Infrastructure as Code (IaC) defines implementation.

But in practice, they drift apart very quickly.

Architecture lives in documents (CAF, Zero Trust, internal HLDs)
IaC reflects what is actually deployed
There is no reliable way to verify that one matches the other

The problem

IaC gives us precision, but not meaning.

Architecture gives us meaning, but not verification.

So we end up in a situation where:

a system is “correctly deployed”
but architecturally wrong

And we only discover that during reviews, audits, or incidents.

A small experiment

I built a small PoC to explore whether architecture can be represented as a structured model and validated against Terraform state.

The idea is simple:

Risk → Control → Constraint → Implementation → Validation

Instead of validating individual resources, the model allows you to evaluate architecture at multiple levels:

Mapping level

PASS – resource matches expected configuration
FAIL – resource exists but is misconfigured
MISSING – resource is not present

Control level

FAILED – at least one mapping fails
INCOMPLETE – partially implemented
MISSING – not implemented at all

Risk level

EXPOSED – controls are not fully implemented

Example

In the demo scenario:

one control fails because of parameter mismatch
another is only partially implemented
another fails due to tag mismatch
another is completely missing

The validator aggregates this into:

FAILED control → EXPOSED risk

So instead of asking:

"Is this resource compliant?"

you can ask:

"Is this architectural risk exposed?"

What this tries to explore

This is not about replacing IaC or policy engines.

It’s about introducing an additional layer:

linking architectural intent (risk / control)
to implementation (Terraform)
and verifying that link continuously

Open questions

I’m still exploring whether this makes sense outside my own use case.

Some questions I’m interested in:

Does this model actually help in real environments?
Is “control-level” validation useful, or is it overengineering?
How would this scale in large architectures?
Where would this break?

Repo

I’ve put together a small working PoC with:

a simple architecture model (YAML)
a validator against Terraform state
a demo showing different failure modes

👉 https://github.com/Illya-Kryushenko/architecture-as-code

Happy to hear thoughts, especially from people working with Terraform, Azure, or security architecture.

DEV Community: Illya Kryushenko

Trying to connect cloud architecture (CAF / Zero Trust) with IaC validation