iac-security-checklistlisted

## Purpose A fast, consistent pass over an infrastructure change to catch the invariant violations that are easy to miss in a large plan or diff — before it ever reaches the point of asking a human to approve an apply. This is a gate before that request, not a substitute for it. ## When to use it Run this against every nontrivial IaC change (new resources, modified network/identity/access configuration) before handing it off for review or requesting apply approval. For a trivial change (a tag fix, a variable rename with no resource impact), a quick skim is enough — don't perform ceremony for its own sake. ## Checklist Mark each item PASS, FAIL, or N/A. Every FAIL needs either a fix or a documented exception (see the `exception-documentation` skill) before the change moves forward. ### Network exposure - [ ] No resource has a public IP, public endpoint, or `0.0.0.0/0`-equivalent ingress rule unless it's a documented exception. - [ ] Any newly-public surface is scoped as narrowly as possible (specific ports, specific source ranges) rather than wide-open. - [ ] Inter-service traffic that could stay on a private network/VPC/VNet does. ### Identity and secrets - [ ] Service-to-service auth uses managed/workload identity wherever the provider supports it, not a static key or connection string. - [ ] No plaintext secret, API key, connection string, or credential appears in any `.tf`/`.bicep`/template file, in a committed tfvars/parameter file, or hardcoded in a module defau