Examkin

Question

Difficulty: MediumAutomating Continuous Deployment Pipelines and Release Strategies

An enterprise organization is automating its continuous deployment pipeline using Google Cloud Deploy to roll out application releases across multiple GKE environments. The architecture team needs to ensure that the infrastructure state files managed by Terraform during pipeline execution are safe from concurrent modification and state corruption, while ensuring the execution service account adheres to the principle of least privilege. Which deployment pipeline configuration should the team implement?

  1. Configure the Terraform pipeline to use a Cloud Storage backend with object versioning and state locking enabled, and assign fine-grained predefined roles to the Cloud Deploy execution service account.Answer
  2. B
    Assign the primitive Owner role to the Cloud Deploy execution service account, and store the Terraform state file in a local directory within the build runner workspace.
  3. C
    Store the Terraform state file in an unversioned local directory within the Cloud Build runner, and grant the execution service account the Service Account Admin role.
  4. D
    Grant the Service Account Admin role to the Cloud Deploy execution service account so it can manage identity bindings during deployment, while keeping state files in local storage.

Answer

Configure the Terraform pipeline to use a Cloud Storage backend with object versioning and state locking enabled, and assign fine-grained predefined roles to the Cloud Deploy execution service account.
Configuring a Cloud Storage backend for Terraform ensures state files are persisted remotely with automatic object locking to prevent concurrent apply conflicts. Combining this with fine-grained predefined IAM roles for the Cloud Deploy execution service account adheres strictly to least-privilege access security controls.

Step-by-Step Solution

1
Evaluate infrastructure state management requirements.
Identify that Cloud Storage remote backends provide distributed locking and versioning for Terraform state.
Prevent concurrent pipeline executions from corrupting the IaC state.
2
Evaluate IAM least-privilege constraints for pipeline service accounts.
Select specific predefined roles for Cloud Deploy target management rather than primitive or administrative roles.
Ensure security compliance by restricting pipeline permissions to only necessary operations.

Key Concept

Continuous Deployment Pipeline Security and IaC State Management
Rate this question

Topics

Automating Continuous Deployment Pipelines and Release Strategies