Examkin

Question

Difficulty: HardAssessing and Mitigating Technical Debt in Cloud Architectures

A healthcare analytics platform rapidly migrated its legacy workloads to Google Cloud. An architectural audit revealed significant technical debt causing operational fragility and security risks: infrastructure changes are applied ad-hoc from developer workstations using unversioned local Terraform state files, and application service accounts rely on project-level primitive `roles/editor` permissions to access Google Cloud Storage and BigQuery datasets. The lead cloud architect must formulate a remediation plan to eliminate this technical debt while enforcing governance and least-privilege security. Which TWO actions should the architect recommend? (Select TWO.)

  1. Migrate local Terraform state files to a Google Cloud Storage bucket backend with object versioning and state locking enabled, and enforce automated deployment pipelines.Answer
  2. Replace project-level primitive `roles/editor` grants on service accounts with fine-grained, predefined least-privilege IAM roles scoped strictly to required resources.Answer
  3. C
    Grant developers the Service Account Admin (`roles/iam.serviceAccountAdmin`) role to allow them to create and manage service account keys directly on their workstations for deployment automation.
  4. D
    Migrate all stateless application workloads to a Google Kubernetes Engine (GKE) cluster to handle infrastructure deployment state management using custom Kubernetes operators.

Answer

The architect should recommend migrating local Terraform state files to a versioned Google Cloud Storage backend bucket with state locking enabled alongside CI/CD automation, and replacing primitive `roles/editor` grants on service accounts with fine-grained predefined least-privilege IAM roles.
Remediating technical debt requires fixing both configuration management processes and identity security vulnerabilities. Storing Terraform state in a Cloud Storage backend bucket with object versioning and state locking enforces state consistency, enables concurrency control, and supports automated CI/CD pipelines. Concurrently, replacing primitive Editor roles on service accounts with resource-scoped predefined roles ensures strict adherence to least-privilege security standards.

Step-by-Step Solution

1
Analyze the technical debt risks associated with local IaC state management and primitive IAM roles.
Identified risks include potential state corruption, lack of deployment auditability, concurrency collisions, and excessive privilege exposure across Cloud Storage and BigQuery resources.
Technical debt remediation requires addressing both operational state management hazards and identity security anti-patterns.
2
Select the Google Cloud recommended practice for Infrastructure as Code state management.
Configuring a Cloud Storage remote backend with state locking (via Cloud Storage object locking) and object versioning ensures state consistency and enables CI/CD integration.
Remote state backends prevent configuration drift and local workstation dependency.
3
Select the Google Cloud recommended practice for service account IAM security.
Replacing broad primitive roles (`roles/editor`) with specific predefined roles (e.g., Cloud Storage Object Viewer/Creator, BigQuery Data Editor) scoped to target resources restores least-privilege compliance.
Primitive roles grant blanket edit permissions across almost all GCP services, violating enterprise compliance.

Key Concept

Mitigating architectural technical debt by standardizing IaC state backends and enforcing least-privilege IAM roles.
Rate this question

Topics

Assessing and Mitigating Technical Debt in Cloud Architectures