Back to glossary
Deployment-stage enforcement
Validating and enforcing a change against policy before the requested resource creation or modification takes effect in the cloud environment.
Frequently Asked Questions
How do you block AWS misconfigurations before deployment?
Blocking a misconfiguration before deployment means the check happens at the point the API request is made to AWS, using preventive controls such as SCPs or RCPs that AWS evaluates and enforces natively at the control plane. Because enforcement happens at the cloud control plane, the same misconfiguration is blocked regardless of whether it was attempted through Terraform, the console, the CLI, or an AI agent.
What are the trade-offs of enforcing at the cloud layer instead of earlier in the pipeline?
Feedback happens at the point a change reaches the cloud, rather than earlier in a developer's local workflow. When a change is blocked, Aryon provides context on which policy was violated. That's why pairing Aryon with IaC scanning gives teams the earliest possible feedback loop, alongside consistent enforcement everywhere else.