Examkin

Question

Difficulty: MediumBuilding and Managing Infrastructure as Code (IaC)

A financial analytics firm provisions its multi-environment Google Cloud infrastructure using Terraform executed via Cloud Build CI/CD pipelines. The lead cloud architect must establish a centralized Infrastructure as Code (IaC) governance model that prevents concurrent state updates, protects state file integrity, and adheres to the principle of least privilege. Which strategy should the architect implement?

  1. Configure a remote Terraform backend using a Cloud Storage bucket with Object Versioning enabled, and execute Cloud Build pipelines using a dedicated service account granted fine-grained, predefined IAM roles.Answer
  2. B
    Store state files directly within the source control repository using encrypted local backends, allowing Cloud Build triggers to commit updated state files after each deployment run.
  3. C
    Configure a remote Cloud Storage backend for state storage, and grant the Cloud Build service account the primitive Editor role across all targeted Google Cloud projects to streamline provisioning.
  4. D
    Configure a remote Cloud Storage backend for Terraform state, but instruct operations engineers to make urgent infrastructure changes directly via the Google Cloud Console during system outages.

Answer

Configure a remote Terraform backend using a Cloud Storage bucket with Object Versioning enabled, and execute Cloud Build pipelines using a dedicated service account granted fine-grained, predefined IAM roles.
The correct solution configures a Cloud Storage remote backend with Object Versioning enabled to provide distributed state locking and state historical backup. Combining this backend with a dedicated Cloud Build service account assigned fine-grained predefined IAM roles follows Google Cloud recommended architectural practices for secure, scalable Infrastructure as Code deployment.

Step-by-Step Solution

1
Establish secure remote state management.
Configuring Google Cloud Storage (GCS) as a remote backend provides built-in state locking and object versioning to protect against race conditions and concurrent modifications.
Remote state centralization prevents local state divergence and guards against corrupting environment definitions.
2
Scope permissions according to least privilege.
Assign fine-grained predefined roles (or custom roles) to the Cloud Build service account managing the infrastructure execution.
Avoid using primitive roles like Editor or Owner to minimize the blast radius of automated pipeline operations.
3
Enforce strict deployment workflow controls.
Ensure all modifications pass through automated CI/CD code reviews and plan/apply pipelines rather than manual operator edits.
Prevents configuration drift between actual cloud resources and the declarative code state.

Key Concept

Terraform Remote Backend & IAM Least Privilege Governance
Estimated Time:1m 30s
Rate this question

Topics

Building and Managing Infrastructure as Code (IaC)

More questions from this topic