Examkin

Question

Difficulty: HardBuilding and Managing Infrastructure as Code (IaC)

A multinational e-commerce company manages its core infrastructure across multiple Google Cloud projects using Terraform executed through an automated CI/CD pipeline. Following a recent operational incident, an engineer manually updated Cloud Storage bucket IAM policies and Compute Engine instance metadata via the Google Cloud Console to restore connectivity. This manual intervention created configuration drift between the actual running resources and the version-controlled Terraform state. To enforce strict IaC governance, the lead cloud architect needs an automated strategy to continuously detect configuration drift, restrict manual resource modifications going forward, and safely re-align the environment with the canonical Terraform definitions. Which operational design best achieves this objective while adhering to Google Cloud recommended best practices?

  1. Schedule recurring non-destructive pipeline jobs running `terraform plan -detailed-exitcode` to detect drift, enforce Organization Policies and IAM fine-grained role boundaries to block direct Console modifications, and reconcile verified drift by updating Terraform code or executing automated `terraform apply` pipelines.Answer
  2. B
    Instruct emergency operators to run `terraform refresh` locally to overwrite the existing Cloud Storage remote state file with current live resource configurations, then upload the updated state without modifying the core Terraform codebase.
  3. C
    Download the Cloud Storage state file to local runner storage during pipeline execution, perform raw JSON edits to account for manual changes, and disable backend state locking during deployment to accelerate reconciliation.
  4. D
    Assign the primitive Owner role (`roles/owner`) to the CI/CD pipeline service account across all projects to ensure `terraform apply` automatically overrides any console changes without requiring pre-execution validation plans.

Answer

Schedule recurring non-destructive pipeline jobs running `terraform plan -detailed-exitcode` to detect drift, enforce Organization Policies and IAM fine-grained role boundaries to block direct Console modifications, and reconcile verified drift by updating Terraform code or executing automated `terraform apply` pipelines.
The correct option establishes automated drift detection using `terraform plan -detailed-exitcode` in a non-destructive continuous integration step while securing the environment using IAM least privilege and Organization Policies. Reconciling infrastructure via audited code updates preserves Terraform as the single source of truth and prevents unapproved manual modifications.

Step-by-Step Solution

1
Establish Continuous Drift Detection
Configured automated CI/CD jobs executing `terraform plan -detailed-exitcode` to periodically evaluate deployed infrastructure against canonical state without modifying running resources.
Detecting drift early ensures that manual interventions or out-of-band updates are flagged automatically before causing deployment failures.
2
Enforce Administrative Console Restrictions
Applied restrictive IAM permissions (removing broad write roles) and Organization Policies to restrict engineers from modifying production resources directly via Console or gcloud.
Preventing manual modifications forces all operational changes through audited, version-controlled Infrastructure as Code pipelines.
3
Reconcile State and Infrastructure
Remediated detected drift by incorporating required manual configuration changes into HCL code templates or executing `terraform apply` to overwrite unapproved changes.
Ensures the Terraform configuration remains the single source of truth for all Google Cloud infrastructure components.

Key Concept

Automated Drift Detection and Infrastructure Governance
Rate this question

Topics

Building and Managing Infrastructure as Code (IaC)

More questions from this topic