Zero-Trust DevSecOps Framework for Event-Driven Microservices across Multi-Cloud Environments
DOI:
https://doi.org/10.63282/3117-5481/AIJCST-V8I4P106Keywords:
Zero Trust, DevSecOps, Event-Driven Architecture, Microservices Security, Multi-Cloud Computing, Software Supply Chain Security, Policy-as-Code, Workload Identity, Continuous Security Monitoring, Cloud-Native SecurityAbstract
The rapid adoption of event-driven microservices and multi-cloud computing has transformed enterprise software development by enabling scalable services, asynchronous communication, continuous delivery, and flexible infrastructure deployment. However, these architectural advantages introduce security challenges associated with distributed identities, dynamic workloads, message-broker access, cross-cloud communication, software supply chains, and inconsistent security policies. Traditional perimeter-based security and isolated development-stage security testing are insufficient for environments in which applications, services, and workloads continuously change across heterogeneous cloud platforms. This paper proposes a Zero-Trust DevSecOps Framework for Event-Driven Microservices across Multi-Cloud Environments that integrates identity-centric access control, continuous security validation, event-level protection, software supply-chain assurance, and runtime threat detection throughout the software development lifecycle. The proposed framework combines zero-trust principles with automated security gates, workload identity, policy-as-code, mutual Transport Layer Security (mTLS), event-schema validation, secrets management, container security, and distributed observability. Its architecture is organized into five interconnected layers: secure development and software supply-chain management, identity and policy governance, event-driven communication protection, multi-cloud deployment and orchestration, and continuous runtime monitoring. A design-oriented research methodology is employed to develop the framework and evaluate its conceptual suitability against conventional DevSecOps, perimeter-oriented security, and partially integrated zero-trust approaches. Two comparative tables and two conceptual figures describe the architecture, security controls, evaluation dimensions, and expected operational trade-offs. The discussion indicates that integrating security policies across development, deployment, messaging, and runtime operations can improve security consistency, traceability, and incident containment, although these benefits require empirical validation. The framework contributes a unified architectural approach for organizations seeking to secure asynchronous microservices without unnecessarily compromising deployment agility or distributed-system scalability.
References
[1] The following references use APA 7th edition style and provide foundational sources for zero trust, secure software development, microservices, continuous delivery, and cloud security governance.
[2] Cloud Security Alliance. (2021). Cloud Controls Matrix (CCM) v4.0. https://cloudsecurityalliance.org/research/cloud-controls-matrix
[3] Arora, A. S., Yachamaneni, T., & Kotadiya, U. (2023). Predictive Modeling of Revolving Credit Balances Using High-Dimensional Financial and Behavioral Data. International Journal of AI, BigData, Computational and Management Studies, 4(1), 98-107.
[4] Virendra Jangid. (2023). AI-Driven Optimization of Regulatory Reporting Systems in Global Banking. International Journal of Science and Applied Technology, 14(4). https://www.ijsat.org/papers/2023/4/11259.pdf
[5] Marella, B. C. C. (2025). AI and XR in Supply Chain: Revolutionizing Sustainable Practices for a Better Tomorrow. In Exploring the Impact of Extended Reality (XR) Technologies on Promoting Environmental Sustainability (pp. 83-98). Cham: Springer Nature Switzerland.
[6] Hosahalli Seenappa, V. K. (2025). Next-generation intelligent multi-cloud enterprise networking: Integrating secure architecture, AI-optimized traffic engineering, and LLM-driven autonomous network operations. International Journal of Leading Research Publication (IJLRP), 6(12), 1–11.
[7] Vegineni, G. C. (2025). Sustainable Tech Development: Integrating AI, XR, and CI/CD Pipelines for a Greener Future. In Exploring the Impact of Extended Reality (XR) Technologies on Promoting Environmental Sustainability (pp. 267-293). Cham: Springer Nature Switzerland.
[8] Hevner, A. R., March, S. T., Park, J., & Ram, S. (2004). Design science in information systems research. MIS Quarterly, 28(1), 75–105. https://doi.org/10.2307/25148625
[9] Marella, B. C. C. (2022). Driving Business Success: Harnessing Data Normalization and Aggregation for Strategic Decision-Making. International Journal of Intelligent Systems and Applications in Engineering, 10(2), 308-317.
[10] Gajula, S., & Margam, M. (2026, February). A secure and scalable cloud-based banking service model leveraging AI and advanced cyber security. In 2026 IEEE 5th International Conference on AI in Cybersecurity (ICAIC) (pp. 1-5). IEEE.
[11] Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero trust architecture (NIST Special Publication 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207
[12] Yachamaneni, T., Arora, A. S., & Kotadiya, U. (2025, August). Reinforcement Learning (RL) for Dynamic Credit Limits Using Java and Cloud-Based AI Services. In International Conference on Computing and Communication Networks (pp. 434-453). Cham: Springer Nature Switzerland.
[13] Kumar, A., Sridhar, R., Dhenia, R. N. K., & Kanani, I. J. K. (2025, July). Advancing Security: Novel Attack Detection Techniques for Industrial Internet of Things Datasets. In 2025 3rd World Conference on Communication & Computing (WCONF) (pp. 1-5). IEEE.
[14] Shahin, M., Babar, M. A., & Zhu, L. (2017). Continuous integration, delivery and deployment: A systematic review on approaches, tools, challenges and practices. IEEE Access, 5, 3909–3943. https://doi.org/10.1109/ACCESS.2017.2685629
[15] Virendra Jangid. (2024). Cloud-Native Financial Data Platforms for Risk and Compliance Management. International Journal of Intelligent Systems and Applications in Engineering, 12(23s), 4389 –. Retrieved from https://ijisae.org/index.php/IJISAE/article/view/8349
[16] Gajula, S. (2025). Federated intelligence in financial ecosystems: A privacy-preserving AI framework for cross-border risk analysis. Journal of Information Systems Engineering and Management, 10(60s).
[17] Vasantha Kumar Hosahalli Seenappa. (2025). Predictive Configuration Governance for AI-Assisted Network Automation in Hyperscale MPLS/IP Backbone Networks. International Journal of Intelligent Systems and Applications in Engineering, 13(2s), 352–358. Retrieved from https://ijisae.org/index.php/IJISAE/article/view/8534
[18] Souppaya, M., Scarfone, K., & Dodson, D. (2022). Secure software development framework (SSDF) version 1.1: Recommendations for mitigating the risk of software vulnerabilities (NIST Special Publication 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218
[19] Verma, A., Madan, J., Sridhar, R., Grover, V., Singh, K., & Shrivastav, N. (2025, September). Influence of Temperature and Layer Thickness on the Photovoltaic Efficiency of (FA) 2 BiCuI 6-Based Perovskite Solar Cells. In 2025 2nd International Conference on Circuits, Power and Intelligent Systems (CCPIS) (pp. 1-5). IEEE.
[20] Burns, B., Grant, B., Oppenheimer, D., Brewer, E., & Wilkes, J. (2016). Borg, Omega, and Kubernetes. ACM Queue, 14(1), 70–93. https://doi.org/10.1145/2898442.2898444
[21] Marella, B. C. C. (2023). Scalable Generative AI Solutions for Boosting Organizational Productivity and Fraud Management. International Journal of Intelligent Systems and Applications in Engineering, 11(10), 1013-1023.
[22] Gadam, H., Yadava, A. K., Arora, A. S., Yachamaneni, T., & Kotadiya, U. (2025, July). Revolutionizing Wealth Management with Temporal Attention Mechanism Based Convolutional Network for Algorithmic Stock Trading Strategies. In 2025 3rd International Conference on Data Science and Network Security (ICDSNS) (pp. 1-4). IEEE.
[23] Virendra Jangid. (2025). AI-Powered Cross-Border Securities Processing and ADR Platform Optimization. International Journal of Leading Research Publication, 6(11). https://doi.org/10.70528/IJLRP.v6.i11.2233
[24] Verma, A., Madan, J., Singh, K., Gothwal, S., Shrivastav, N., & Sridhar, R. (2025, September). Toward Clean Energy: Carrier Density Optimization in FAMASnGeI 3-Based Perovskite Solar Cells. In 2025 2nd International Conference on Circuits, Power and Intelligent Systems (CCPIS) (pp. 1-5). IEEE.
[25] OWASP Foundation. (2023). OWASP API security top 10—2023. https://owasp.org/API-Security/
[26] Vegineni, G. C. (2025, October). Interactive Design Playbook: Visual Guides and Component Libraries for Adaptive Web Portals. In International Conference on Artificial Intelligence and Networking (pp. 534-544). Cham: Springer Nature Switzerland.
[27] Hosahalli Seenappa, V. K. (2026). Machine learning based computer device for cloud computing security (UK Registered Design No. 6538224). UK Intellectual Property Office.
