Automating a no-public-IP governance rule

WHAT THIS TESTS The interviewer wants to see that you reach for preventive, centrally enforced policy-as-code rather than relying on humans to notice and undo violations, and that you apply it organization-wide.

A GOOD ANSWER COVERS The strongest control is preventive: stop the public IP from ever being attached. Each major cloud has a native mechanism. AWS uses Service Control Policies in Organizations to deny the relevant actions across every member account; you can deny running an instance that associates a public IP. Azure uses Azure Policy with a deny effect targeting the public IP resource or the NIC property, scoped at a management group so it cascades to all subscriptions. GCP uses Organization Policy constraints, such as the constraint that restricts external IPs on VM instances, applied at the org node. Applying the policy at the highest scope means new accounts and subscriptions inherit it automatically, so coverage does not depend on per-team discipline. Because preventive policies can have gaps or exceptions, pair them with detective controls: a continuous compliance scanner like AWS Config rules or Azure Policy audit effect flags any noncompliant resource, and an automated remediation can detach the IP or alert. Defining all of this as code in your infrastructure pipeline makes it reviewable, versioned, and consistently deployed.

COMMON WRONG ANSWERS Relying solely on a detective scan and manual cleanup, which leaves a window where the VM is publicly exposed. Enforcing the rule per-account by hand, which drifts as accounts grow. Using IAM permissions alone, which is harder to express as a resource-shape rule.

LIKELY FOLLOW-UPS What is the difference between a preventive and detective control? How do you handle legitimate exceptions? How does the policy inherit to new accounts?

ONE CONCRETE EXAMPLE An SCP attached to the organization root denies ec2:RunInstances when the request associates a public IP, so any team in any account is blocked at creation time, while an AWS Config rule audits for drift as a second layer.