Enforce a cloud resource compliance policy

WHAT THIS TESTS This assesses whether you think in layered governance, preventive plus detective plus corrective controls, rather than periodic manual audits, for enforcing a security policy at scale.

A GOOD ANSWER COVERS Use defense in depth. Preventive controls stop violations at creation: organization policy constraints or Service Control Policies can deny launching a VM with a public IP, and policy-as-code such as OPA or a cloud-native admission check evaluates the request against the tag rule before the resource exists, ideally also enforced in the IaC pipeline so a non-compliant plan never applies. Detective controls catch what slips through or predates the policy: a continuous configuration scanner such as AWS Config rules, asset inventory, or Azure Policy evaluates every resource against the rule and produces compliance findings. Corrective controls remediate automatically: a triggered function can detach the public IP, move the resource into a restricted subnet, or tag and notify the owner, depending on risk appetite. Combine the three so violations are mostly prevented, anything that appears is detected quickly, and remediation is automatic and auditable.

COMMON WRONG ANSWERS Relying solely on manual or quarterly audits, which miss violations for weeks. Only preventing while ignoring resources that existed before the policy. Auto-deleting resources with no owner notification or grace period, risking outages. Having no central reporting. Trusting humans to simply remember the rule.

LIKELY FOLLOW-UPS How do you enforce this in the IaC pipeline? When is auto-remediation too risky for production? How do you handle pre-existing non-compliant resources? What exactly is policy-as-code?

ONE CONCRETE EXAMPLE A Service Control Policy denies launching public-IP VMs without the public-access tag. An AWS Config rule continuously flags any that already exist; a remediation function detaches the IP and notifies the owning team, while the IaC pipeline rejects non-compliant plans before deploy, so the policy is enforced before, during, and after resource creation.