An infrastructure agent generates a Terraform plan before applying changes. The security team wants to automatically validate that no planned action will open inbound traffic from 0.0.0.0/0 on any port before the plan is executed. What is the prerequisite that makes this automated safety check possible?
Select an answer to reveal the explanation.
Short Explanation
You can't automate a policy check on human-readable text — you need structured data. Machine-parseable JSON plan output is what lets automated tools parse and evaluate each planned action before execution. Human review, post-execution scanning, and blanket permission restriction are either slower, too late, or too restrictive.
Full Explanation
Automated policy gates between plan and execution are a core security pattern in infrastructure-as-code workflows. The pattern depends entirely on the plan being in a machine-readable, structured format — not just human-readable text.
Why the structured JSON plan output choice is correct: Terraform's native terraform plan -out=plan.tfplan and terraform show -json plan.tfplan produce structured JSON that contains every planned resource action: resource type, resource name, action type (create/update/delete), before/after attribute values. Policy tooling can traverse this JSON, find all aws_security_group_rule or aws_vpc_security_group_ingress_rule resources with action 'create' or 'update', and check whether any cidr_ipv4 value is 0.0.0.0/0. This is the foundation of the Conftest and Open Policy Agent ecosystem. Without structured output, automated parsing is fragile regex over human text — brittle and unreliable.
Why the human security engineer review choice is wrong: Human review of the human-readable Terraform plan output before every execution is a valid control, but the question asks what enables automated validation. Human review doesn't scale — it introduces variable latency, is error-prone at volume, and cannot run inside a continuous integration and delivery pipeline as a blocking gate without human scheduling. For a security check as specific and repeatable as 'no 0.0.0.0/0 rules', automation is clearly superior.
Why the post-execution security scanning choice is wrong: Post-execution scanning is a compensating control, not a preventive one. By the time scanning detects the 0.0.0.0/0 security group rule, the infrastructure is already deployed and the network is already open. Rollback is possible but introduces additional risk — partially applied Terraform configurations may leave infrastructure in an inconsistent state. Shift-left security means catching violations before execution, not after.
Why the read-only Terraform permissions choice is wrong: Restricting the agent to read-only Terraform permissions would prevent it from making any infrastructure changes at all, including creating security group rules, which defeats its purpose. The goal is to allow legitimate infrastructure changes while preventing specifically non-compliant ones. Blanket capability removal is not a substitute for targeted policy enforcement against a specific class of violation.