Ntentos, EvangelosEvangelosNtentosHörner, NicoleNicoleHörnerSimhandl, GeorgGeorgSimhandlZdun, UweUweZdunSchneider, Simon MalteSimon MalteSchneiderScandariato, RiccardoRiccardoScandariatoDíaz Ferreyra, NicolásNicolásDíaz Ferreyra2025-01-082025-01-082024-12-26ACM transactions on software engineering and methodology 34 (1): 6 (2024-12-26)https://tore.tuhh.de/handle/11420/52812Infrastructure as Code (IaC) automates IT infrastructure deployment, which is particularly beneficial for continuous releases, for instance, in the context of microservices and cloud systems. Despite its flexibility in application architecture, neglecting security can lead to vulnerabilities. The lack of comprehensive architectural security guidelines for IaC poses challenges in adhering to best practices. We studied how developers interpret IaC scripts (source code) in two IaC technologies, Ansible and Terraform, compared to semi-formal IaC deployment architecture models and metrics regarding design-level security understanding. In a controlled experiment involving ninety-four participants, we assessed the understandability of IaC-based deployment architectures through source code inspection compared to semi-formal representations in models and metrics. We hypothesized that providing semi-formal IaC deployment architecture models and metrics as supplementary material would significantly improve the comprehension of IaC security-related practices, as measured by task correctness. Our findings suggest that semi-formal IaC deployment architecture models and metrics as supplementary material enhance the understandability of IaC security-related practices without significantly increasing duration. We also observed a significant correlation between task correctness and duration when models and metrics were provided.en1049-331X20241Association for Computing Machinery (ACM)https://creativecommons.org/licenses/by/4.0/Infrastructure as codemodelingbest practicescontrolled experimentempirical software engineeringComputer Science, Information and General Works::005: Computer Programming, Programs, Data and SecurityJournal Articlehttps://doi.org/10.15480/882.14169https://doi.org/10.15480/882.1416910.1145/369163010.15480/882.1416910.15480/882.14169Journal Article