A. ISSN (O) 2278-1021, ISSN (P) 2319-5940IJARCCE XplainGuard: Dynamic Policy Enforcement in Cloud Infrastructure as Code: Integrating Generative AI for Auto-Remediation and Explainability

Abstract: Infrastructure as Code (IaC) concentrates cloud security posture into text files, where one misconfigured attribute propagates to every environment where it is applied. Four gaps persist in prior tooling: static scanners such as Checkov and Trivy detect misconfigurations but generate no corrective code, leaving a detection-to-repair gap; generative repair methods report incorrect-code rates as high as 20.4%, precluding unattended use; automated fixes carry no security rationale, so practitioners cannot judge why a change is needed; and existing tools evaluate misconfigurations in isolation, missing compound attack paths formed by co-located resources. This paper presents XplainGuard, a command-line Terraform auditor that targets all four directly: model output is constrained to a strict JSON schema; every generated patch passes through a self-verification guardrail that executes terraform validate before the developer sees it, with one bounded correction attempt; each finding carries a structured four-element rationale (resource and attribute, attack vector, compound-risk context, compliance control). Across 21 runs on a seven-file fixture, every response parsed as valid JSON, and the guardrail reduced the observed incorrect code rate from 6.7% to 0%. Detection coverage was 100% on isolated vulnerabilities and 91.7% overall, and locally executed scans show Trivy 0.72.0 missing two of the four target categories that Checkov 3.3.8 detects, illustrating the specific gaps this work addresses across prior tooling rather than uniform superiority over any single tool. The evaluation is small; its statistical limits are stated explicitly.

Keywords: Infrastructure as Code, Terraform, dynamic policy enforcement, generative AI, large language models, auto- remediation, explainable AI, cloud security, self-verification.