Examkin

Question

Difficulty: HardDeploying Infrastructure using Deployment Manager or Terraform

An organization is configuring an automated CI/CD pipeline to deploy infrastructure in Google Cloud using Terraform. The pipeline must store the Terraform state file in a central Google Cloud Storage (GCS) bucket named `corp-tf-state-prod` located within the project `proj-prod-infra`. The pipeline service account will execute `terraform plan` and `terraform apply`. Which TWO configurations or operational steps are required to establish a secure and resilient remote backend implementation according to Google Cloud best practices?

  1. Configure the Terraform backend block using the `gcs` provider referencing `corp-tf-state-prod` and ensure Object Versioning is enabled on the bucket.Answer
  2. Authenticate the CI/CD pipeline execution using Workload Identity Federation or short-lived Service Account Impersonation instead of exporting long-lived JSON service account keys.Answer
  3. C
    Grant the primitive `roles/owner` role to the pipeline service account at the Organization level to guarantee state lock acquiring permissions across all projects.
  4. D
    Enable the Google Cloud Deployment Manager API within the Organization's primary billing account to process backend locking requests.

Answer

The two correct requirements are configuring the Terraform backend block with the `gcs` provider while ensuring Object Versioning is enabled on the GCS state bucket, and authenticating the deployment pipeline using Workload Identity Federation or Service Account Impersonation rather than downloading long-lived service account keys.
Configuring the Terraform `gcs` backend provider alongside GCS Object Versioning establishes native state locking and disaster recovery capabilities. Authenticating the deployment pipeline via Workload Identity Federation or IAM Service Account Impersonation avoids long-lived credentials, aligning directly with Google Cloud security benchmarks for automated infrastructure deployment.

Step-by-Step Solution

1
Identify the proper backend configuration and state preservation mechanism for Terraform on Google Cloud.
Terraform uses the `gcs` backend type for Google Cloud Storage, which automatically provides native object locking. Object Versioning on the bucket ensures state state history is retained for disaster recovery.
Remote state files are critical assets; versioning prevents permanent data loss during concurrent or failed updates.
2
Select the secure authentication strategy for automated pipeline service accounts.
Workload Identity Federation allows short-lived token generation for external CI/CD systems without managing physical JSON key files.
Google Cloud security best practices explicitly advise against exporting long-lived service account keys.
3
Evaluate distractor options regarding IAM privilege scope and API requirements.
Over-privileged primitive roles and enabling unrelated APIs in billing accounts are incorrect operational procedures.
Least privilege access must be enforced using granular predefined roles scoped to specific resources.

Key Concept

Terraform GCS Remote Backend Architecture & Secure Service Account Authentication
Rate this question

Topics

Deploying Infrastructure using Deployment Manager or Terraform