13.7Interview Talking Point

"I believe infrastructure testing should follow the same pyramid as application testing: cheap static analysis at the base, plan-time assertions in the middle, and real-infrastructure integration tests at the top. In my experience, the highest-value practice is ephemeral environments per PR, where you spin up a complete infrastructure copy using Terraform workspaces or Pulumi stacks, run the full test suite against it, and destroy it on merge. This catches issues that static analysis cannot -- like IAM policies that are syntactically valid but operationally broken. I also integrate AI agents into the review process: they analyze the Terraform plan JSON alongside Checkov and tfsec results and post a structured review comment on the PR that summarizes what will change, flags security risks, and estimates cost impact."