Examkin

Question

Difficulty: HardDeploying Infrastructure using Deployment Manager or Terraform

A Cloud Engineer is using Google Cloud Deployment Manager templates stored in a central administrative project named `admin-ops-project` to provision VPC networks and Compute Engine instances into a newly created target project named `finance-workload-prod`. The engineer executes the following command from the Google Cloud CLI:

`gcloud deployment-manager deployments create workload-deployment --config=vpc_vm.yaml --project=finance-workload-prod`

The command fails with an error stating that `deploymentmanager.googleapis.com` is disabled or has not been used in project `finance-workload-prod`. The engineer confirms that the Cloud Deployment Manager API is already enabled in `admin-ops-project`. What should the engineer do to resolve this issue?

  1. Enable the Cloud Deployment Manager API in the target project finance-workload-prod.Answer
  2. B
    Re-run the command with the --project flag set to admin-ops-project so Deployment Manager consumes the API enabled in that project.
  3. C
    Grant the primitive Owner role to the Deployment Manager service account at the parent Folder level so API enablement is inherited.
  4. D
    Append the --enable-apis flag to the gcloud deployment-manager deployments create command to automatically enable missing APIs during deployment execution.

Answer

Enable the Cloud Deployment Manager API in the target project finance-workload-prod.
In Google Cloud, API enablement is scoped strictly to the specific project where operations occur and resources are created. When deploying infrastructure via Deployment Manager into `finance-workload-prod`, the `deploymentmanager.googleapis.com` API must be enabled directly within `finance-workload-prod`, even if templates or deployment scripts are hosted in `admin-ops-project`.

Step-by-Step Solution

1
Identify the project context where resources are being created.
The target project specified by the `--project` flag is `finance-workload-prod`.
Google Cloud API services execute within the context of the resource destination project.
2
Analyze API enablement rules across Google Cloud projects.
Enabling an API in `admin-ops-project` does not enable it in `finance-workload-prod`.
API enablement is scoped strictly per project and is neither shared across independent projects nor inherited from resource hierarchy folders.
3
Select the correct remediation step.
Enable `deploymentmanager.googleapis.com` in `finance-workload-prod` using `gcloud services enable deploymentmanager.googleapis.com --project=finance-workload-prod`.
This satisfies the requirement for the target project to host active Deployment Manager service endpoints.

Key Concept

Target Project API Enablement Scope for Infrastructure as Code
Rate this question

Topics

Deploying Infrastructure using Deployment Manager or Terraform