Make the repository enforce review on infrastructure changes

applied · 65 min · Objective 5.2

Task

Review is the control the console never had. Build a repository where an infrastructure change cannot reach the main branch without passing automated checks, and where the plan output is attached for a human to read.

Steps

  1. Create a repository holding an IaC template. Add a check that runs format, validate and a policy scan on every proposed change.
  2. Add a check that produces the PLAN output and writes it into the change's record, so a reviewer sees the effect rather than only the diff.
  3. Configure protection so the main branch refuses a direct push and requires the checks to pass. Attempt a direct push and capture the refusal in lab/git/protected.txt.
  4. Propose a change that a policy scan should reject -- an unencrypted volume or a public storage setting -- and capture the failing check in lab/git/policy-fail.txt.
  5. Propose a change whose plan says REPLACE rather than update on a stateful resource. Record in lab/git/review.md what a reviewer should notice, and why that line is the most dangerous one in a plan.

Verify

test -s lab/git/protected.txt && grep -Eci 'reject|denied|protected' lab/git/protected.txt
test -s lab/git/policy-fail.txt && grep -Eci 'fail|violat|denied' lab/git/policy-fail.txt
grep -Eci 'replace' lab/git/review.md
grep -Eci 'plan' lab/git/review.md

Both refusals captured. A protected branch that has never rejected anything has not been shown to protect anything, which is the same standing rule as every other check in this course.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.