Developing an ontology-mediated semantic control method for improving the reliability of LLM-generated Infrastructure-as-Code

Abstract

The object of research is an LLM-assisted process of Infrastructure-as-Code (IaC) generation for cloud deployment. The problem is that large language models can convert user requests into syntactically valid IaC, but such generated IaC fails deployment. This occurs because such artefacts often omit required cloud relations or violate policy constraints, inaccurately interpret user intent, or lack rollback logic. As a result, the research proposes a Semantic Infrastructure-as-Code (SIaC) pipeline, where instead of a final IaC, the LLM first generates a candidate infrastructure graph. Further, this graph is completed and validated using ontology reasoning, SHACL/SPARQL validation, and other formal procedures before the generation of the final backend artifact. According to the 60 AWS ECS/Fargate-oriented scenarios that were tested in a LocalStack-based AWS emulation environment, Full SIaC achieved 74.4% sandbox deployment success, compared with 43.6% for direct LLM-to-IaC and 59.0% for LLM+RAG-to-IaC. Compared with the baselines, SIaC improved semantic intent coverage, dependency completeness, and policy compliance. It also reduced invalid dependencies and the need for manual corrections. This improvement is achieved because reliability is checked through an inspectable knowledge graph, not only through prompts and generated text. This graph supports the detection and correction of dependencies, placements, policies, and safety issues before deployment. In addition to higher deployment success, SIaC also provides a more controllable and manageable transformation path from natural-language intent to executable infrastructure.

This method is suitable if the user's requirements can be mapped to the maintained provider ontologies and if the additional time spent on analysis is considered a acceptable trade-off for improved reliability, auditability, and reduced maintenance.