An enterprise financial organization manages its Google Cloud infrastructure using Terraform within an automated CI/CD pipeline. Multiple autonomous feature teams frequently provision and update resources across shared VPC networks. Recently, a CI/CD deployment failed during a Terraform apply phase because an operational team manually modified firewall rules and updated subnets directly via the Cloud Console to mitigate an active security incident. Furthermore, state locks were intermittently failing during concurrent CI/CD pipeline executions due to misconfigured remote state storage. What architecture and operational strategy should the Lead Cloud Architect implement to secure state management and prevent uncoordinated configuration drift in accordance with Google Cloud best practices?
- Configure a central Cloud Storage backend with object versioning and state locking enabled, enforce IaC updates exclusively through a CI/CD pipeline executing with a dedicated service account assigned fine-grained predefined roles, and run scheduled automated plan workflows to detect configuration drift.Answer
- BAssign the IAM Owner role to the CI/CD pipeline service account across all target projects to prevent permission failures during provisioning, and instruct team members to run local terraform refresh commands prior to executing console modifications.
- CMaintain state files in local git repositories alongside application source code to allow concurrent branch tracking, and run manual gcloud commands to sync infrastructure state whenever console edits occur during incidents.
- DImplement manual console deployment procedures for urgent infrastructure changes, followed by manual updates to Terraform resource blocks after the incident resolves, relying on pipeline quota increases to handle concurrent state operations.