Examkin

Question

Difficulty: MediumAnalyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines

An enterprise logistics company is analyzing its continuous integration and continuous delivery (CI/CD) pipelines used to manage Google Cloud infrastructure with Terraform and Cloud Build. During a pipeline security and operational analysis, the Cloud Architect identifies two significant vulnerabilities: concurrent pipeline executions corrupt local Terraform state files, and the Cloud Build service account has been granted primitive Project Editor privileges along with broad administrative rights over project service accounts. Which TWO actions should the architecture team implement to remediate these issues while adhering to Google Cloud best practices? (Select TWO)

  1. Migrate the Terraform state storage backend to a Cloud Storage bucket with object versioning and state locking enabled.Answer
  2. Replace primitive Editor roles on the Cloud Build service account with minimal predefined roles and grant 'roles/iam.serviceAccountUser' on specific deployment service accounts.Answer
  3. C
    Store Terraform state files on ephemeral local disk storage allocated to individual Cloud Build worker instances to bypass remote locking overhead.
  4. D
    Grant the primitive Owner role to the Cloud Build service account across all target environment projects to streamline resource deployment capabilities.
  5. E
    Assign the Service Account Admin role to the Cloud Build service account to allow dynamic service account creation during build executions.

Answer

The team must migrate the Terraform state storage backend to a Cloud Storage bucket with object versioning and state locking enabled, and replace primitive Editor roles on the Cloud Build service account with minimal predefined roles while granting 'roles/iam.serviceAccountUser' on specific target service accounts.
To fix state corruption and enforce operational stability, Terraform state must be stored in a centralized Cloud Storage bucket configured with versioning and state locking. To secure the pipeline according to GCP least privilege practices, primitive Editor roles must be removed from the build service account and replaced with minimal predefined roles, combined with 'roles/iam.serviceAccountUser' granted specifically on deployment identities.

Step-by-Step Solution

1
Analyze the state management flaw in the CI/CD pipeline.
Identified that local unversioned state storage causes state corruption under concurrent pipeline executions.
Cloud Storage backends provide distributed state locking and object versioning to safeguard state integrity.
2
Analyze the Identity and Access Management (IAM) permissions flaw.
Identified excessive permissions from primitive Project Editor roles and administrative identity privileges.
Replacing primitive roles with fine-grained predefined roles and scoped Service Account User bindings enforces least privilege.

Key Concept

CI/CD Pipeline Security and Infrastructure as Code State Management
Rate this question

Topics

Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines