A team's Terraform modules have repeatedly created cloud storage buckets with public read access, and each time the problem is found only after deployment by a posture tool. The team wants these misconfigurations caught before any resource exists. What should it add?
Select an answer to reveal the explanation.
Short Explanation
It's cheaper to fix a typo in the blueprint than to tear down the wall. IaC scanning reads your Terraform before it runs and fails the build when it spots a public bucket. The trap is a faster posture scan — quicker detection is still detection after the bucket exists.
Full Explanation
Infrastructure as Code scanning applies security policy checks to templates such as Terraform, CloudFormation and Kubernetes manifests before they are applied. Integrated into pull request checks or a CI stage, the scanner parses the planned resources, detects settings such as public access on storage, missing encryption or overly permissive security groups, and fails the build so the change never reaches the cloud. Because the requirement is to catch the misconfiguration before the resource exists, the control must operate on code, not on deployed infrastructure. An hourly posture scan of production accounts is still detective and post-deployment; it shortens exposure time but cannot prevent a public bucket from being created. Dynamic application security testing probes a running application for flaws such as injection; it does not examine storage configuration or infrastructure definitions. A runtime agent on compute instances watches process behavior and cannot see the storage service's access settings, and storage buckets are not compute instances at all. Exam caveat: IaC scanning complements posture management; drift and console changes made outside the pipeline still need runtime posture checks. Operational check: open a test pull request that sets public read on a bucket and confirm the pipeline fails with a clear policy finding before any plan is applied.