Analyzing and optimizing technical and business processes1 / 5
A platform team manages VPCs, buckets, and service accounts with Terraform. Security wants a pull request to fail with a report naming the specific resources that would violate the organization's security requirements, before anything is created, and wants the same constraint definitions reused when auditing already-deployed resources. Which approach meets this?
CorrectIncorrect
Alex
This is testing and validation applied to infrastructure rather than application code: the Terraform plan is the artifact under test, and the constraint library is the test suite. The value of validating the plan is feedback at review time, where a violation costs a comment rather than an incident, and the same constraints can then be applied to already-deployed resources so that drift and pre-existing violations surface too. Preventative controls at apply time and detective controls after deployment remain useful, but neither gives a reviewer a per-resource verdict before the change is made.
Sourcedocs.cloud.google.com
Follow-up answers are available in the app. Create a free account — no credit card required.
Question 1 of 5
Create a free account