A Cloud Engineer is setting up an automated Google Cloud infrastructure deployment process using Terraform. To follow Google Cloud security and operational best practices, the engineer must ensure that team members can collaborate without state file conflicts and that deployment processes do not rely on static, long-lived authentication keys. Which two actions should the engineer take to achieve this configuration?
- Configure a `backend "gcs"` block in the Terraform configuration to store the state file in a central Cloud Storage bucket with object versioning enabled.Answer
- Configure the automated CI/CD pipeline to use IAM Service Account Impersonation or Workload Identity Federation for authenticating Terraform commands.Answer
- CCommit and push the local `terraform.tfstate` file into the shared source control repository so all developers have access to state changes.
- DEnable all required resource APIs in the organization billing project rather than enabling them in the target infrastructure project.
Answer
The correct configuration requires defining a Cloud Storage remote backend (`backend "gcs"`) with object versioning enabled for state locking and backup, and configuring authentication using IAM Service Account Impersonation or Workload Identity Federation instead of static service account keys.
Configuring the `backend "gcs"` block allows Terraform to manage state centrally in a Cloud Storage bucket with locking and versioning. Authenticating using IAM Service Account Impersonation or Workload Identity Federation ensures zero long-lived key storage, aligning with GCP security principles.
Step-by-Step Solution
Key Concept
Terraform Remote Backend and IAM Authentication Best Practices in GCP