Examkin

Question

Difficulty: Very hardBuilding and Managing Infrastructure as Code (IaC)

A global logistics enterprise manages its multi-tenant Google Cloud architecture using Terraform within Cloud Build continuous integration pipelines across separate development, staging, and production GCP organizations. The lead cloud architect must design an Infrastructure as Code (IaC) execution and security framework that satisfies four critical requirements:
1. CI/CD pipeline runners must authenticate without storing long-lived service account JSON keys in repositories or build secrets.
2. Terraform execution across environments must isolate state files to prevent concurrent state locks and accidental cross-environment modifications.
3. Automated pipeline service accounts must enforce least-privilege security scoping tailored to each environment.
4. Unsanctioned configuration changes made directly through the Cloud Console or gcloud CLI must be automatically detected and safely aligned with declared IaC configurations.

Which architecture meets all requirements while following Google Cloud recommended best practices?

  1. Authenticate Cloud Build using Workload Identity Federation to eliminate service account keys. Store state in distinct Cloud Storage buckets per environment configured with Object Versioning and state locking. Grant environment-specific fine-grained IAM roles to dedicated pipeline service accounts, and run scheduled automated terraform plan checks alongside Cloud Asset Inventory feeds to detect and reconcile configuration drift.Answer
  2. B
    Authenticate Cloud Build using Workload Identity Federation. Store all backend state files in a centralized Cloud Storage bucket with Object Versioning enabled. Assign the IAM Owner role to a single global CI/CD service account to streamline resource provisioning across all environments, and rely on manual weekly Cloud Shell audits to identify infrastructure drift.
  3. C
    Generate JSON service account keys for each environment and store them as encrypted variables in Cloud Build. Persist Terraform state files locally inside the ephemeral storage of the Cloud Build container runner to avoid Cloud Storage API latency, and run terraform refresh before every build to overwrite manual infrastructure modifications.
  4. D
    Authenticate Cloud Build runners using short-lived access tokens generated by a master service account. Store state in a single shared Cloud Storage bucket. When manual infrastructure drift occurs in production, edit the remote terraform.tfstate file directly in the bucket using a JSON editor to match the live infrastructure state.

Answer

The optimal solution uses Workload Identity Federation for keyless authentication, distinct Cloud Storage buckets per environment with Object Versioning and state locking, fine-grained IAM roles assigned to dedicated service accounts, and scheduled automated terraform plan runs paired with Cloud Asset Inventory feeds to detect and remediate drift.
The solution leveraging Workload Identity Federation, isolated Cloud Storage state buckets with versioning/locking, fine-grained per-environment IAM roles, and automated drift monitoring via scheduled plans fully addresses all four enterprise requirements while strictly adhering to Google Cloud architecture standards.

Step-by-Step Solution

1
Evaluate authentication and credential management requirements
Identify Workload Identity Federation as the Google Cloud recommended method to authenticate CI/CD runners without long-lived service account JSON keys.
Storing static service account keys in build runners introduces risk of key exposure and management overhead.
2
Establish secure remote state storage and environment isolation
Configure separate Cloud Storage buckets per environment with Object Versioning enabled for state history and locking mechanisms to prevent concurrent writes.
Isolating environments into separate buckets prevents cross-environment blast radius and accidental state lock contention.
3
Define IAM privilege scoping for pipeline execution
Assign fine-grained, predefined or custom IAM roles (e.g., Compute Network Admin, Storage Admin) specific to each environment's dedicated service account.
Avoids primitive roles like Owner or Editor, ensuring compliance with the principle of least privilege.
4
Implement automated drift detection and remediation
Schedule periodic terraform plan pipelines and leverage Cloud Asset Inventory real-time notification feeds to detect live infrastructure differences against declared IaC files.
Allows automated pipeline remediation (terraform apply) to realign infrastructure without manual state tampering or manual audit delays.

Key Concept

Enterprise IaC Governance: Keyless CI/CD Authentication, Remote State Isolation, Least Privilege IAM, and Automated Drift Detection
Rate this question

Topics

Building and Managing Infrastructure as Code (IaC)

More questions from this topic