Check Terraform infrastructure settings for least-privilege CIDR blocks, storage encryption at rest, and pinned provider versions.