Examkin

Question

Difficulty: Very hardDeploying Infrastructure using Deployment Manager or Terraform

A cloud engineer is automating multi-tier network provisioning across separated environment projects using Google Cloud Deployment Manager templates. The deployment script runs from a central administrative project named `admin-cicd-runner`. When executing `gcloud deployment-manager deployments create network-prod --config vpc-mesh.yaml --project=prod-vpc-host-1029`, the deployment fails with an error stating that `deploymentmanager.googleapis.com` is disabled. The engineer verifies that the Deployment Manager API is already enabled inside `admin-cicd-runner`. Which statement accurately identifies the root cause of this failure and the necessary corrective action?

  1. The Deployment Manager API must be enabled inside the target project (`prod-vpc-host-1029`) where resources are being provisioned, not just in the initiating administrative project.Answer
  2. B
    The Cloud SDK environment in `admin-cicd-runner` requires re-authentication using a downloaded service account JSON key file passed via the `--credential-file` flag to override target project API checks.
  3. C
    The Deployment Manager API must be enabled in the central administrative project (`admin-cicd-runner`) with the `--global-child-inherit` flag to push API states down the resource hierarchy.
  4. D
    The service account executing the deployment must be granted the Billing Account Administrator role on the billing account to automatically enable APIs across linked projects.

Answer

Enable the Deployment Manager API (`deploymentmanager.googleapis.com`) directly within the target project (`prod-vpc-host-1029`) where the infrastructure resources are designated to be built.
In Google Cloud, API enablements are project-specific. When using infrastructure deployment tools like Cloud Deployment Manager or Terraform from a centralized management project, the target project where infrastructure resources are created must have the relevant API services enabled (`deploymentmanager.googleapis.com` as well as any resource-specific APIs such as `compute.googleapis.com`). Enabling the API only in the administrative project where the CLI command originates does not enable API endpoints in the target project.

Step-by-Step Solution

1
Identify the target project context of the deployment command.
The target project specified in the execution flag is `prod-vpc-host-1029`.
Infrastructure resources declared in Deployment Manager configuration templates are created within the target project scope.
2
Evaluate API enablement scoping rules in Google Cloud.
Realized that service APIs (including `deploymentmanager.googleapis.com` and underlying resource provider APIs like `compute.googleapis.com`) must be enabled on the target host project.
Enabling APIs on a central caller or CI/CD project does not satisfy API activation requirements for remote target projects.
3
Formulate the resolution command.
Execute `gcloud services enable deploymentmanager.googleapis.com --project=prod-vpc-host-1029`.
This directly enables the required API service on the target project where the deployment will reside.

Key Concept

API Enablement Scoping for Multi-Project Infrastructure Deployments
Rate this question

Topics

Deploying Infrastructure using Deployment Manager or Terraform