You are advising a development and operations team on best practices for securing CI/CD deployment pipelines and managing Google Cloud infrastructure. The team currently authenticates external deployment agents using long-lived service account keys saved in git repositories and grants primitive Owner roles to build scripts. Which TWO architectural recommendations should you provide to improve security and compliance? (Select TWO.)
- Configure Workload Identity Federation for external CI/CD pipelines to eliminate the need for downloadable long-lived service account keys.Answer
- Grant fine-grained, predefined or custom IAM roles adhering strictly to the principle of least privilege instead of primitive roles.Answer
- CStore Terraform infrastructure state files on local build agent storage without remote versioning to speed up pipeline execution times.
- DAssign the Service Account Admin role to the deployment pipeline service account so it can elevate permissions dynamically during build steps.
- EEmbed JSON service account private keys inside base container images so applications can authenticate automatically across all staging environments.
Answer
The team should implement Workload Identity Federation to remove long-lived service account keys from pipelines, and assign fine-grained, predefined IAM roles following the principle of least privilege instead of broad primitive roles.
Advising operations teams on cloud best practices requires establishing secure deployment foundations. Utilizing Workload Identity Federation allows CI/CD systems to exchange external identity tokens for short-lived Google Cloud credentials without storing persistent keys. Combining this with fine-grained, least-privilege IAM roles ensures build scripts can perform required deployment tasks without exposing broad administrative permissions.
Step-by-Step Solution
Key Concept
Credential-less authentication via Workload Identity Federation and least-privilege IAM configuration for dev/ops automation.