Question

A development team manages all production infrastructure with Terraform, but recent outages were traced to manual changes made directly in the Google Cloud Console that were later overwritten by an automated pipeline. As the cloud architect, you must advise the team on a process that both prevents unreviewed changes from reaching production and surfaces any out-of-band modifications before they cause conflicts. Which recommendation best addresses this?

Accepted Answer

Require that every change be submitted as a pull request that runs `terraform plan` in CI, block merges without approval, and schedule a periodic `terraform plan` job to detect drift from the actual state.

Answer

Grant developers only read-only Console access and require all changes to be made exclusively through the gcloud CLI.

Answer

Enable an organization policy that disables the Google Cloud Console entirely for the production project.

Answer

Increase the frequency of the automated `terraform apply` pipeline so manual changes are corrected faster.