A fintech company is setting up an automated provisioning pipeline using Infrastructure as Code (IaC) to deploy a regional, highly available relational database system on Google Cloud. The system must meet strict compliance standards requiring customer-managed encryption keys for data at rest and continuous protection against state file corruption during automated IaC deployments. Which TWO deployment and provisioning actions should the cloud architect implement to fulfill these requirements?
- Configure a Cloud Storage bucket with Object Versioning and state locking enabled to store the Terraform remote state files securely.Answer
- Provision a Cloud SQL instance with regional High Availability enabled and configure it to use a Customer-Managed Encryption Key (CMEK) hosted in Cloud KMS.Answer
- CStore the Terraform state files in a local Git repository with pre-commit hooks to handle lock synchronization across concurrent pipeline runs.
- DProvision a globally distributed Cloud Spanner instance configured with Customer-Supplied Encryption Keys (CSEK) passed via raw keys during creation.
Answer
The architect must configure a Cloud Storage bucket with Object Versioning and state locking for Terraform remote state storage, and provision a Cloud SQL instance with regional High Availability encrypted using a Customer-Managed Encryption Key (CMEK) from Cloud KMS.
Provisioning a Cloud SQL instance with regional High Availability using Cloud KMS Customer-Managed Encryption Keys (CMEK) meets both the availability and compliance requirements for a regional relational database. Storing the Terraform state file in a remote Cloud Storage bucket with Object Versioning and state locking ensures concurrency protection and resilience against state corruption.
Step-by-Step Solution
Key Concept
Provisioning highly available relational databases with CMEK and securing IaC state management in Google Cloud