A security team wants to guarantee that no Terraform template can create a publicly readable storage bucket. Violations must be stopped before anything is deployed, not reported afterward. Which control meets this requirement?
Select an answer to reveal the explanation.
Short Explanation
Want to stop a mistake before it ships? Put the rule right in the pipeline, so a bad template fails the build like a broken unit test. Everything else here finds the problem after it's already live, and that's exactly what you were told not to accept.
Full Explanation
Policy as code expresses security rules in machine-readable form and evaluates infrastructure-as-code templates automatically, typically as a pipeline stage or pre-merge check. A rule stating that storage resources must not grant public read access causes the pipeline to fail when a template violates it, so the change is never applied. That makes it a preventive guardrail operating before deployment, which is exactly the stated requirement. Posture management scanning is detective: it finds the public bucket after it exists, so even a short delay leaves a window of exposure, and the requirement explicitly rejects after-the-fact reporting. Object access logging with alerts notifies the team only after someone has accessed the data, which is even later than discovering the misconfiguration. A quarterly manual review can leave a public bucket exposed for months and depends on human diligence rather than automated enforcement. Exam caveat: pipeline checks only cover changes that go through the pipeline, so combine them with cloud-side preventive policies that deny public access at the account level and with posture monitoring for manual changes. Operational check: add the policy check to the pipeline, submit a test template that defines a public bucket, confirm the pipeline fails with a clear message, and confirm a compliant template passes and deploys.