Examkin

Question

Difficulty: HardAnalyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines

An enterprise architecture team is conducting an operational and security audit of their automated deployment pipeline. The current system utilizes Cloud Build to execute Terraform scripts for infrastructure provisioning and deploy microservices to Google Kubernetes Engine (GKE) clusters. The audit revealed that build executions currently rely on broad primitive roles, pipeline state is maintained locally on temporary build agent disks leading to state corruption, and team members use exported long-lived service account JSON keys to authenticate pipeline triggers from external developer environments. Which TWO architectural modifications should be implemented to align the software delivery lifecycle with Google Cloud security and operational best practices?

  1. Configure a dedicated user-managed service account for Cloud Build restricted to fine-grained predefined roles, and implement Workload Identity Federation for authenticating external developer triggers.Answer
  2. Migrate the Terraform state storage to a Cloud Storage backend configured with object versioning and state locking enabled.Answer
  3. C
    Assign the primitive Owner role to the Cloud Build service account across the organization hierarchy to ensure uninterrupted resource provisioning.
  4. D
    Store Terraform state files within the local ephemeral disk cache of the build worker instances to maximize pipeline execution performance.
  5. E
    Grant developers the Service Account Admin role so they can generate fresh short-lived JSON keys locally whenever triggering pipeline builds.

Answer

The pipeline should be remediated by creating a dedicated user-managed service account for Cloud Build with least-privilege roles alongside Workload Identity Federation for keyless authentication, and storing Terraform state in a Cloud Storage backend with object versioning and state locking.
Secure and resilient CI/CD pipelines in Google Cloud require establishing least-privilege identity access using dedicated user-managed service accounts paired with Workload Identity Federation to eliminate service account keys. Additionally, managing Infrastructure as Code requires remote state storage in Cloud Storage featuring object versioning and state locking to guarantee state integrity and concurrent build execution.

Step-by-Step Solution

1
Analyze pipeline security and authentication mechanisms.
Identified reliance on primitive roles and exported JSON service account keys.
Exporting service account keys poses high exfiltration risk; keyless authentication via Workload Identity Federation coupled with a dedicated user-managed service account enforces security best practices.
2
Evaluate Infrastructure as Code state management requirements.
Identified local ephemeral storage of Terraform state as a single point of corruption and concurrency failure.
Centralizing state in Cloud Storage with versioning and state locking ensures data persistence, concurrency protection, and disaster recovery capability.

Key Concept

Continuous Integration & Delivery Pipeline Security and IaC State Management
Rate this question

Topics

Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines