An organization is building an automated CI/CD pipeline using Terraform to provision core infrastructure in Google Cloud. Which TWO deployment and operational practices should the Cloud Architect mandate for this pipeline? (Select TWO.)
- Configure a remote Google Cloud Storage (GCS) backend with object versioning and state locking enabled.Answer
- Assign specific, minimal predefined IAM roles to the pipeline execution service account following the principle of least privilege.Answer
- CGrant the primitive Owner (roles/owner) role to the deployment service account to ensure unhindered resource creation.
- DStore the state file (terraform.tfstate) on the local disk of the ephemeral CI/CD runner to increase execution speed.
Answer
The deployment pipeline should utilize a remote Google Cloud Storage backend configured with state locking and object versioning, and run under a service account provisioned with least-privilege predefined IAM roles.
Configuring a remote Google Cloud Storage (GCS) backend with state locking and object versioning ensures concurrent operations do not collide and allows rolling back state in case of corruption. Furthermore, restricting the pipeline service account to specific, fine-grained predefined IAM roles adheres to security best practices by limiting access to only what is necessary.
Step-by-Step Solution
Key Concept
Terraform Remote Backend Management and Least-Privilege IAM Integration in GCP