An enterprise organization relies on Cloud Build CI/CD pipelines and Terraform to manage and provision production Google Cloud environments across multiple regions. During recent deployments, the engineering team experienced state file lock failures during concurrent pipeline runs, as well as configuration drift caused by emergency manual console modifications. To establish operational reliability and enforce automated environment provisioning standards, which TWO strategies should the team implement?
- Configure a Google Cloud Storage bucket with Object Versioning enabled as the remote Terraform backend and rely on native backend state locking.Answer
- Implement automated scheduled pipelines that execute terraform plan with detailed exit codes to detect drift, while restricting infrastructure write permissions exclusively to the CI/CD service account.Answer
- CStore Terraform state files on a persistent NFS volume attached to Cloud Build custom worker pools to maintain fast filesystem-level locks.
- DGrant the primitive Owner role to the CI/CD service account at the organization level to automatically bypass project quota checks during automated scaling events.
Answer
The team should configure Google Cloud Storage with Object Versioning as the remote Terraform backend for state locking, and establish automated scheduled drift detection via terraform plan while restricting infrastructure update permissions strictly to the CI/CD service account.
To maintain environment provisioning reliability, IaC state must be protected using a Cloud Storage remote backend with Object Versioning and native locking enabled to prevent race conditions. Furthermore, operational drift must be controlled by removing direct write access from human users—forcing all changes through CI/CD—and running automated scheduled plan checks to identify drift quickly.
Step-by-Step Solution
Key Concept
Reliable Infrastructure as Code State Management and Drift Governance