The automated provisioning of complex composite Cloud applications is a major issue and of vital importance in Cloud computing. It is key to enable Cloud properties such as pay-as-you-go pricing, on-demand self-service, and elasticity. The functional aspects of provisioning such as instantiating virtual machines or installing software components are covered by several technologies on different technical levels: some are targeted to a pretty high level such as Amazon’s Cloud Formation, some deal with deep technical issues based on scripts such as Chef or Puppet. However, the currently available solutions are tightly coupled to individual technologies without being able to consider non-functional security requirements in a non-proprietary and interoperable way. In this paper, we present a concept and framework extension enabling the integration of heterogeneous provisioning technologies under compliance with non-functional aspects defined by policies.