An infrastructure engineering team is establishing an automated deployment pipeline to execute Terraform configurations across multiple Google Cloud production projects. The architecture must enforce secure state management and strictly adhere to identity access management least-privilege guidelines. Which TWO configuration choices should the team implement?
- Configure a Cloud Storage remote backend with object versioning enabled and utilize short-lived Service Account impersonation for pipeline authentication.Answer
- BGrant the primitive Editor role to the CI/CD service account across all target projects to avoid permission errors during complex resource provisioning.
- Enable native state locking on the backend storage bucket to prevent concurrent execution runs from causing state corruption.Answer
- DStore Terraform state files within the pipeline's version-controlled Git repository to maintain zero-latency local state reads.
Answer
The team should configure a Cloud Storage remote backend with object versioning enabled while utilizing short-lived Service Account impersonation for pipeline authentication, and enable native state locking on the backend storage bucket to prevent concurrent execution runs from causing state corruption.
Production enterprise deployments using Terraform on Google Cloud require a central remote state backend using Cloud Storage equipped with state locking and object versioning to protect against concurrent modification and state corruption. Additionally, authentication for automated pipelines must leverage short-lived credentials via service account impersonation rather than primitive IAM role assignments or static key files.
Step-by-Step Solution
Key Concept
Terraform Remote State Locking & Service Account Impersonation