Question

A cloud engineering team enforces that every resource deployed via their Terraform pipeline must include a 'cost-center' and 'data-classification' tag. Recently, several untagged resources reached production despite peer code reviews. The team wants an automated, non-bypassable control that rejects non-compliant infrastructure definitions before they are provisioned, without relying on human reviewers. Which approach best meets this requirement?

Accepted Answer

Add a policy-as-code check (e.g., OPA/Sentinel) to the pipeline that evaluates the plan and fails the build when required tags are missing

Answer

Create a scheduled script that scans deployed resources nightly and emails a report of any missing tags

Answer

Require an additional senior engineer to approve every pull request that modifies infrastructure code

Answer

Enable drift detection on the state file to alert when deployed resources differ from the code