A single misconfigured resource can ship a public S3 bucket to thousands of machines in seconds. Scan IaC before it applies.