Question

Difficulty: MediumBuilding and Managing Infrastructure as Code (IaC)

An online learning platform automates its Google Cloud infrastructure deployments using Terraform executed within a continuous integration and continuous delivery (CI/CD) pipeline. The Lead Cloud Architect must establish a secure governance model for deployment pipeline authentication, permission scoping, and Terraform state management following Google Cloud best practices. Which design strategy should the architect implement?

  1. A
    Generate a service account JSON key file, grant the service account the primitive Owner role, store the key in the CI/CD secret manager, and configure a Cloud Storage remote state backend.
  2. Authenticate the CI/CD pipeline using Workload Identity Federation, grant minimal predefined IAM roles to the deployment service account, and store state files in a Cloud Storage bucket with object versioning and state locking enabled.Answer
  3. C
    Authenticate the pipeline using Workload Identity Federation, grant fine-grained IAM roles to the pipeline, and store Terraform state files on the local persistent disk of the dedicated CI/CD build runner.
  4. D
    Authenticate the pipeline using service account impersonation, and instruct operators to manually modify infrastructure in the Cloud Console during operational incidents before running terraform refresh in the pipeline.

Answer

Authenticate the CI/CD pipeline using Workload Identity Federation, grant minimal predefined IAM roles to the deployment service account, and store state files in a Cloud Storage bucket with object versioning and state locking enabled.
Google Cloud best practices for Infrastructure as Code (IaC) pipelines require keyless authentication via Workload Identity Federation, strict scoping of deployment service accounts using fine-grained predefined IAM roles, and centralized remote state management in Cloud Storage with state locking and versioning enabled.

Step-by-Step Solution

1
Configure pipeline authentication without service account keys
Workload Identity Federation allows external CI/CD workloads to exchange short-lived tokens for GCP IAM credentials securely.
Eliminating exportable JSON keys prevents credential exfiltration and management toil.
2
Enforce the principle of least privilege for deployment permissions
Assign specific, predefined IAM roles required only for the target resources managed by the pipeline.
Avoids over-privileged primitive roles like Owner or Editor that create broad security risks.
3
Configure a centralized, secure remote state backend
Store Terraform state in a Cloud Storage bucket configured with state locking and object versioning.
Prevents concurrent execution state corruption and enables recovery from bad state updates.

Key Concept

IaC Security Governance and Remote State Management
Rate this question