A software architecture team is analyzing their release management lifecycle for microservices running on Cloud Run. To align their continuous integration and continuous deployment (CI/CD) pipelines with security and governance best practices, they must establish appropriate permission boundaries for automated build processes. Which pipeline identity configuration follows Google Cloud recommended practices?
- Attach a dedicated service account to Cloud Build with minimal, predefined roles scoped only to the required deployment actions.Answer
- BAssign the primitive Owner role to the build service account to guarantee build steps never run into permission errors.
- CGrant application developers the Service Account Admin role on the build pipeline service account so they can manage credentials during runs.
- DPersist deployment state tracking files exclusively on local container disk space during pipeline execution.
Answer
Attach a dedicated service account to Cloud Build with minimal, predefined roles scoped only to the required deployment actions.
Configuring dedicated service accounts with fine-grained, predefined roles tailored to specific deployment targets adheres to Google Cloud security best practices by implementing the principle of least privilege.
Step-by-Step Solution
Key Concept
Least Privilege Identity Management in CI/CD Pipelines