Question

A DevSecOps team wants to catch insecure infrastructure configurations, such as publicly exposed storage buckets and overly permissive security group rules, BEFORE any resources are provisioned in the cloud. The team already scans container images and runs unit tests in the pipeline. Which addition to the CI/CD pipeline BEST meets this requirement?

Accepted Answer

Add a static analysis (IaC scanning) stage that evaluates the Terraform/CloudFormation templates against policy rules before the apply step

Answer

Enable cloud provider runtime monitoring to detect misconfigured resources after deployment and trigger remediation

Answer

Schedule a nightly vulnerability scan of the running infrastructure and open tickets for any findings

Answer

Require manual peer review of every pull request before the deployment is approved