A business analyst owns review for Copilot-drafted Terraform for a demo portal seeded with sample customer records. Policy requires reviewers to catch leaked secrets, insecure defaults, and over-permissive access before merge. Which human-review control best addresses Copilot security considerations?

The correct control is right because it enforces human accountability for all three policy risks in AI-generated infrastructure as code while adding automation to compensate for Copilot limitations, with an explicit checklist for leaked secrets and least-privilege ports to block over-permissive access, combined with Copilot code review and code scanning to surface insecure defaults, hardcoded credentials, overly broad IAM, and open security groups, all gated before merge so defects cannot reach the demo portal. The manual-only checklist without code scanning fails on defense-in-depth because human review alone inconsistently detects embedded secrets, misconfigured defaults, and subtle Terraform permission errors that automated scanning reliably flags, especially important since Copilot can confidently reproduce insecure patterns from training data. The after-deployment review fails on shift-left timing because a control applied after deployment approval is detective rather than preventive, allowing leaked secrets to be logged, insecure defaults to be exploited, and over-permissive ports to be probed before remediation, violating the explicit before-merge requirement. The insecure-defaults-and-ports-only checklist fails on secret management because sample customer records do not eliminate secret risk, as Copilot-drafted Terraform can still contain hardcoded access keys, tokens, or connection strings that leak if merged, so omitting secrets leaves a direct policy gap. As an exam caveat, distinguish preventive merge gates with both human review and automated scanning from valid but mistimed or manual-only practices that look secure but miss timing or coverage. As a practical check, inspect the pull request for cleared scanning alerts, absence of plaintext credentials, security groups without unrestricted ingress, and documented reviewer sign-off before allowing merge.