Examkin

Question

Difficulty: MediumBuilding and Managing Infrastructure as Code (IaC)

An enterprise healthcare technology platform manages multi-tenant infrastructure on Google Cloud using Terraform. During an internal architecture audit, the security operations team discovers that developers execute Terraform configurations directly from local workstations using user accounts with broad Project Editor permissions, while storing state files on local disks. This practice has resulted in concurrent deployment conflicts and compliance violations. You need to establish a centralized, secure Infrastructure as Code governance and deployment framework that enforces least-privilege execution and prevents state file corruption. Which architecture should you implement?

  1. Configure a Google Cloud Storage backend with Object Versioning enabled for remote Terraform state storage, and execute deployments via an automated CI/CD pipeline using Workload Identity Federation with a service account bound to fine-grained IAM roles.Answer
  2. B
    Commit and store Terraform state files inside a private Git repository for centralized access control, and execute Terraform commands locally using a service account assigned the Project Editor primitive role.
  3. C
    Grant developers the Project Owner role on their personal workstations, configure an unversioned Cloud Storage backend for state files, and instruct developers to make manual Cloud Console edits whenever Terraform apply commands fail.
  4. D
    Download service account JSON keys to local developer workstations for Terraform execution, and establish manual developer chat channels to coordinate state locks before running infrastructure updates.

Answer

Configure a Google Cloud Storage backend with Object Versioning enabled for remote Terraform state storage, and execute deployments via an automated CI/CD pipeline using Workload Identity Federation with a service account bound to fine-grained IAM roles.
The solution leveraging a Google Cloud Storage remote backend with Object Versioning and automated CI/CD pipeline execution via Workload Identity Federation represents Google Cloud recommended best practices. Cloud Storage backends provide built-in distributed state locking using Object Generation numbers, while Object Versioning protects against accidental state destruction. Workload Identity Federation eliminates key management overhead by authenticating short-lived tokens for CI/CD pipelines, enforcing strict least-privilege IAM access control.

Step-by-Step Solution

1
Establish secure remote state management
Configured a Google Cloud Storage (GCS) bucket as the Terraform remote backend with Object Versioning enabled.
Centralizing state management in GCS ensures state locking (preventing race conditions) and backup protection against state file loss or corruption.
2
Implement secure automated pipeline authentication
Configured Workload Identity Federation between the external CI/CD provider and Google Cloud.
Workload Identity Federation enables short-lived identity impersonation, avoiding the storage and management of static service account JSON keys.
3
Enforce least-privilege deployment execution
Bound the deployment pipeline service account to specific, fine-grained predefined or custom IAM roles instead of primitive roles.
Restricts IaC deployment authority strictly to the cloud resources managed by the automated pipeline.

Key Concept

Enterprise Infrastructure as Code Governance and Secure Remote State Management
Estimated Time:1m 30s
Rate this question

Topics

Building and Managing Infrastructure as Code (IaC)

More questions from this topic