Question

A DevOps team deploys cloud infrastructure using Terraform templates through a CI/CD pipeline. The security team discovers that several production S3 buckets were provisioned with public read access and unencrypted storage, and that these same misconfigurations keep reappearing after being manually fixed. Which approach would MOST effectively prevent these vulnerabilities from reaching production in the future?

Accepted Answer

Integrate infrastructure-as-code (IaC) configuration scanning into the CI/CD pipeline to fail builds that contain insecure template definitions before deployment

Answer

Schedule weekly authenticated vulnerability scans of the production cloud environment and remediate findings as they are reported

Answer

Enable cloud provider logging to alert the SOC whenever a bucket is created with public access so an analyst can revert it

Answer

Add a compensating control that places a web application firewall in front of the exposed S3 buckets