Examkin

Question

Difficulty: MediumInfrastructure as Code and Environment Provisioning

An enterprise architecture team is implementing an automated Infrastructure as Code (IaC) pipeline using Cloud Build and Terraform to provision Google Cloud environments across multiple projects. The pipeline must securely handle state management, prevent state file corruption during concurrent executions, and enforce the principle of least privilege for automated deployments. Which TWO actions should the team implement to satisfy these requirements?

  1. Configure a Google Cloud Storage bucket backend for Terraform state with Object Versioning enabled to support native state locking and state restoration.Answer
  2. Grant the Cloud Build service account specific predefined roles required for the target resources, along with the Service Account User role (roles/iam.serviceAccountUser) on designated runtime service accounts.Answer
  3. C
    Store the Terraform state (.tfstate) files directly in the Git repository alongside configuration files to track state history and prevent concurrency conflicts.
  4. D
    Grant the Cloud Build service account the Service Account Admin role (roles/iam.serviceAccountAdmin) to ensure it can manage and assign service account credentials across all workload projects.
  5. E
    Assign the primitive Owner role (roles/owner) to the Cloud Build service account at the folder level to prevent permission errors during environment provisioning.

Answer

Configure a Cloud Storage bucket backend with Object Versioning for state locking, and grant the Cloud Build service account specific predefined resource roles with roles/iam.serviceAccountUser on target service accounts.
Centralizing Terraform state storage in Google Cloud Storage with versioning ensures state consistency, encryption, and locking mechanism support across concurrent Cloud Build runs. Furthermore, restricting the Cloud Build service account to fine-grained predefined roles and granting roles/iam.serviceAccountUser specifically on required service accounts enforces least privilege while enabling successful compute resource attachment.

Step-by-Step Solution

1
Establish secure and robust Terraform remote state storage.
Configuring a Cloud Storage backend with Object Versioning enables centralized remote state with native locking capabilities to prevent race conditions during automated deployments.
Remote state in Cloud Storage ensures consistency, encryption at rest, access control via IAM, and concurrency management.
2
Configure CI/CD IAM permissions following the principle of least privilege.
Assign fine-grained predefined roles for provisioned infrastructure and grant roles/iam.serviceAccountUser on specific compute service accounts.
This grants the Cloud Build service account only the privileges necessary to create resources and attach service accounts, avoiding excessive administrative access.

Key Concept

Terraform remote state management with GCS and least-privilege IAM configuration for CI/CD automation pipelines.
Estimated Time:2m 0s
Rate this question

Topics

Infrastructure as Code and Environment Provisioning