An organization’s typical network and security review consists of analyzing application transit routes, request handling, and firewall rules. They want to enable their developer teams to deploy new applications without the overhead of this full review. How should you advise this organization?

The goal is to enable developer velocity while maintaining security, which is a core principle of DevSecOps. Mandating Infrastructure as Code (IaC) and integrating static analysis into the CI/CD pipeline "shifts security left." This approach automates the security review by programmatically checking infrastructure configurations against predefined policies before deployment. This prevents non-compliant resources from being created, provides immediate feedback to developers, and removes the bottleneck of manual reviews. The other options describe detective controls (A, C) which are reactive, or a strategy that avoids the problem rather than solving it (D).

A. Using Forseti is a detective control that identifies misconfigurations in production, which is reactive, not preventive as required by the scenario.
C. Routing traffic through managed routers is a network-level detective control for traffic analysis, not a preventive control for deployment configurations.
D. This option avoids deploying to production in GCP, failing to solve the core problem of enabling safe and rapid production deployments.

1. Google Cloud Architecture Framework, "Security, privacy, and compliance design principles", section "Automate security". This document advocates for codifying security policies and integrating them into the CI/CD process to provide fast feedback and prevent insecure configurations.

2. Google Cloud Documentation, "Policy validation with gcloud terraform vet". This tool is a prime example of static analysis for IaC. The documentation states it lets you "test your Terraform plan against organization policies... before you apply the plan," which directly aligns with the described solution.

3. Google Cloud Blog, "Shifting left on security: A new and improved way to secure your GCP environment". This article details the philosophy and benefits of integrating security checks early in the development lifecycle (CI/CD) using IaC.