Helios Media is building a DevSecOps pipeline in AWS CodePipeline/CodeBuild. The security team must enforce infrastructure policy-as-code before deployment and add static application security checks on each pull request, failing the build if high-severity issues are found. Which two actions should the team implement? (Choose two.)

The problem requires enforcing infrastructure policy-as-code before deployment and performing static application security checks on each pull request. Adding a CodeBuild stage running cfn-guard (CloudFormation Guard) directly addresses the infrastructure policy-as-code requirement. cfn-guard evaluates CloudFormation templates against defined rules before deployment, failing the build if violations are found, thus preventing non-compliant infrastructure from being provisioned. Integrating AWS CodeGuru Security into the pipeline to scan application code on each PR/commit and failing on critical findings directly addresses the static application security checks requirement. CodeGuru Security is designed for this purpose, providing automated code reviews for security vulnerabilities. Amazon Inspector primarily scans running EC2 instances, containers, and Lambda functions, not source code during a build or pull request. AWS Config conformance packs and CloudFormation Stack Policies enforce compliance after or during deployment, not before deployment as required for policy-as-code in the pipeline.