Examkin

Question

Difficulty: HardAssessing and Mitigating Technical Debt in Cloud Architectures

An enterprise telematics provider completed a rapid lift-and-shift migration of its vehicle tracking platform to Google Cloud. A technical debt assessment revealed two major operational risks: infrastructure configuration changes are frequently made directly in the Google Cloud console by engineers holding project-level Editor roles, and Terraform state files are stored locally on individual developer workstations. Which strategy should the cloud architect recommend to mitigate this technical debt while enforcing least privilege and automated governance?

  1. Migrate Terraform state to a remote Cloud Storage bucket with object versioning and state locking enabled, restrict console access by replacing project-level Editor roles with fine-grained IAM roles, and automate infrastructure deployments via Cloud Build service accounts.Answer
  2. B
    Commit all local Terraform state files into a private source control repository, grant developers the project-level Owner role to prevent permission errors during deployments, and establish a policy requiring pull request approvals prior to manual local execution.
  3. C
    Refactor all workload compute resources to Google Kubernetes Engine (GKE) clusters to handle infrastructure state, while maintaining project-level Editor roles for development teams to streamline emergency console fixes.
  4. D
    Replace the underlying Cloud SQL relational database with Cloud Spanner to ensure global consistency, while continuing to allow local Terraform state storage with periodic manual Cloud Storage sync backups.

Answer

Migrate Terraform state to a remote Cloud Storage bucket with object versioning and state locking enabled, restrict console access by replacing project-level Editor roles with fine-grained IAM roles, and automate infrastructure deployments via Cloud Build service accounts.
Centralizing Terraform state management into a Cloud Storage backend with object versioning and locking resolves state drift and prevents concurrent execution corruption. Eliminating broad primitive Editor roles in favor of least-privilege predefined roles and routing changes through Cloud Build pipelines enforces strict infrastructure-as-code governance and eliminates manual console modifications.

Step-by-Step Solution

1
Assess the IaC state management technical debt
Identified local state storage as a high-risk anti-pattern causing concurrency conflicts and potential data loss.
Storing state files locally prevents collaboration, lacks object locking, and exposes infrastructure secrets.
2
Remediate IaC state management
Configure a Google Cloud Storage backend for Terraform with object versioning and state locking.
Cloud Storage backends provide secure, centralized, version-controlled state management with locking via Cloud KMS/GCS native mechanisms.
3
Assess and remediate IAM and configuration drift technical debt
Replace project-level Editor roles with least-privilege predefined or custom roles, and enforce deployment through automated CI/CD pipelines (Cloud Build).
Manual Cloud console modifications by Editor-level accounts cause untracked configuration drift. Automating deployments via dedicated service accounts prevents out-of-band changes.

Key Concept

Mitigating IaC State Drift and IAM Technical Debt
Estimated Time:2m 0s
Rate this question

Topics

Assessing and Mitigating Technical Debt in Cloud Architectures