Examkin

Question

Difficulty: Very hardImplementing Infrastructure as Code using Terraform and Deployment Manager

A Lead Cloud Architect is transitioning an enterprise infrastructure automation platform from Google Cloud Deployment Manager to Terraform within Cloud Build CI/CD pipelines. The new deployment pipeline must support multi-developer concurrent executions without state corruption, maintain recoverable state history, and strictly observe GCP least-privilege identity access controls during resource provisioning. Which TWO configurations must the architect implement to satisfy these security and operational requirements?

  1. Configure a remote Google Cloud Storage (GCS) backend for Terraform state files with object versioning enabled.Answer
  2. Grant the Cloud Build service account the roles/iam.serviceAccountUser role on specific target provisioning service accounts.Answer
  3. C
    Store state files in local storage on the Cloud Build runner and sync them to an unversioned bucket post-execution.
  4. D
    Assign the primitive roles/owner role to the Cloud Build service account at the Google Cloud organization node.

Answer

The architect must configure a remote Google Cloud Storage backend with object versioning enabled and grant the Cloud Build service account the Service Account User role on fine-grained target provisioning service accounts.
Configuring a Google Cloud Storage backend with object versioning ensures state locking during execution and retains state backup history. Combining this with granting the Service Account User role on specific target service accounts enforces least-privilege impersonation for Cloud Build deployments.

Step-by-Step Solution

1
Analyze Terraform remote state management requirements for enterprise CI/CD workflows.
Identified that native GCS backends provide automatic object locking and object versioning to protect against concurrent modification and state loss.
Remote state backends prevent race conditions when multiple deployment pipelines run simultaneously.
2
Evaluate IAM least-privilege requirements for automated deployment agents.
Determined that Cloud Build service accounts should use service account impersonation by holding the Service Account User role on dedicated target provisioning service accounts.
Impersonation eliminates the need for primitive roles or static long-lived service account keys.

Key Concept

Enterprise Terraform state backend configuration and secure service account impersonation in Google Cloud.
Rate this question

Topics

Implementing Infrastructure as Code using Terraform and Deployment Manager

More questions from this topic