An online learning platform automates its Google Cloud infrastructure deployments using Terraform executed within a continuous integration and continuous delivery (CI/CD) pipeline. The Lead Cloud Architect must establish a secure governance model for deployment pipeline authentication, permission scoping, and Terraform state management following Google Cloud best practices. Which design strategy should the architect implement?
- AGenerate a service account JSON key file, grant the service account the primitive Owner role, store the key in the CI/CD secret manager, and configure a Cloud Storage remote state backend.
- Authenticate the CI/CD pipeline using Workload Identity Federation, grant minimal predefined IAM roles to the deployment service account, and store state files in a Cloud Storage bucket with object versioning and state locking enabled.Answer
- CAuthenticate the pipeline using Workload Identity Federation, grant fine-grained IAM roles to the pipeline, and store Terraform state files on the local persistent disk of the dedicated CI/CD build runner.
- DAuthenticate the pipeline using service account impersonation, and instruct operators to manually modify infrastructure in the Cloud Console during operational incidents before running terraform refresh in the pipeline.
Answer
Authenticate the CI/CD pipeline using Workload Identity Federation, grant minimal predefined IAM roles to the deployment service account, and store state files in a Cloud Storage bucket with object versioning and state locking enabled.
Google Cloud best practices for Infrastructure as Code (IaC) pipelines require keyless authentication via Workload Identity Federation, strict scoping of deployment service accounts using fine-grained predefined IAM roles, and centralized remote state management in Cloud Storage with state locking and versioning enabled.
Step-by-Step Solution
Key Concept
IaC Security Governance and Remote State Management