Examkin

Question

Difficulty: Very hardAssessing and Mitigating Technical Debt in Cloud Architectures

A financial clearing platform on Google Cloud has accumulated significant technical debt following consecutive rapid feature releases. An architectural audit identifies two primary vulnerabilities: operational risk from manual Cloud Console modifications that cause severe configuration drift against infrastructure code, and security risk from application service accounts assigned primitive roles/editor permissions. You are tasked with establishing a technical debt remediation framework that enforces strict infrastructure governance and least-privilege security without disrupting service uptime. Which combination of architectural actions should you recommend?

  1. Automate Terraform deployments through a CI/CD pipeline, mandate drift detection to review and import out-of-band changes, restrict manual write access to the Cloud Console, and refactor service accounts to use minimal predefined roles.Answer
  2. B
    Configure a scheduled background job to execute automated terraform apply runs that overwrite uncommitted Cloud Console changes without state reconciliation, and assign roles/iam.serviceAccountAdmin to developer identities.
  3. C
    Retain primitive roles/editor permissions on existing application service accounts to avoid application access failures, while deploying VPC Service Controls security perimeters to block Console administrative operations.
  4. D
    Store Terraform state files inside local Git repositories across developer build environments to track history, and grant roles/owner to application service accounts to streamline deployment authorization across newly added GCP services.

Answer

Automate Terraform deployments through a CI/CD pipeline, mandate drift detection to review and import out-of-band changes, restrict manual write access to the Cloud Console, and refactor service accounts to use minimal predefined roles.
The optimal strategy to resolve IaC technical debt and IAM privilege creep is to centralize IaC execution within automated pipelines, restrict direct manual Console write permissions, reconcile state drift systematically, and downgrade primitive roles to fine-grained predefined roles.

Step-by-Step Solution

1
Analyze identified technical debt anti-patterns.
Identified manual infrastructure mutation (IaC drift) and over-privileged service accounts (primitive roles) as core risks.
Technical debt remediation requires addressing both operational governance and security posture.
2
Establish declarative infrastructure state governance.
Enforce central remote state backends (Cloud Storage with versioning), mandate CI/CD execution for Terraform apply operations, and audit/import drift using terraform plan/import.
Preventing uncommitted Console edits ensures environment reproducibility and prevents state file corruption.
3
Refactor identity permissions to least privilege.
Audit permissions using IAM Recommender and replace primitive roles (Editor/Owner) with specific predefined or custom IAM roles tailored to service functions.
Primitive roles grant excessive broad permissions across all resources, violating GCP security standards.

Key Concept

Assessing and Mitigating Technical Debt in Cloud Architectures
Rate this question

Topics

Assessing and Mitigating Technical Debt in Cloud Architectures