Securing Cloud Infrastructure Through Ancestry Tracking in Machine Images

Cloud infrastructure has become the backbone of modern digital services, offering on-demand scalability, flexibility, and automation. As enterprises accelerate their migration to cloud platforms, ensuring the security and integrity of virtualized resources becomes paramount. Among these, machine images—such as Amazon Machine Images (AMIs), Azure Managed Images, and Google Cloud VM templates—play a foundational role by encapsulating operating systems, applications, configurations, and runtime environments into reusable components. However, the reuse and propagation of these images across teams and organizations often occur without visibility into their origin, integrity, or vulnerability history. This lack of transparency introduces a hidden attack vector for adversaries, who may exploit vulnerable or malicious images to compromise entire cloud workloads. This paper introduces a novel approach to strengthening cloud infrastructure security through ancestry tracking in machine images. Ancestry tracking involves capturing the complete lineage of an image, including its base, all intermediate modifications, and associated security scans. By integrating cryptographic signatures, policy enforcement, and immutable logging into the image lifecycle, our proposed framework—Ancestry-Aware Machine Image Security (AAMIS)—provides a robust mechanism for verifying image authenticity and preventing unauthorized deployments. The implementation of AAMIS is designed to work seamlessly with existing DevOps pipelines and CI/CD tooling, ensuring minimal performance overhead. Through experimental validation in AWS and Azure environments, we demonstrate that ancestry tracking significantly enhances traceability, enforces compliance, and reduces the propagation of vulnerabilities. Moreover, we explore the integration of this framework with industry standards like SLSA (Supply Chain Levels for Software Artifacts), SBOMs (Software Bill of Materials), and Zero Trust Architecture principles to extend its utility across container and hybrid cloud ecosystems