Examkin

Question

Difficulty: MediumProvisioning Compute Engine and Kubernetes Engine Clusters

A DevOps team is setting up an automated Infrastructure as Code (IaC) pipeline using Terraform to provision Compute Engine resources and service accounts for a new analytics platform. The team must ensure secure state management and adhere to the principle of least privilege for the deployment pipeline's service account. Which two actions should the team take to meet these security and operational requirements?

  1. Configure a Cloud Storage backend with object versioning enabled to store the Terraform state file securely.Answer
  2. Grant the deployment pipeline service account the Service Account User role (roles/iam.serviceAccountUser) on the target workload service account.Answer
  3. C
    Store the Terraform state file in unversioned local storage on the ephemeral CI/CD runner host.
  4. D
    Assign the primitive Editor role (roles/editor) to the deployment pipeline service account at the project level.
  5. E
    Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the deployment pipeline service account so it can bind to instances.

Answer

The correct architectural decisions are configuring a Cloud Storage backend with object versioning for storing the Terraform state file, and granting the deployment pipeline service account the Service Account User role (roles/iam.serviceAccountUser) on the target workload service account.
To safely provision compute resources in an automated pipeline, remote state management using Cloud Storage with versioning prevents state loss and race conditions. Furthermore, following least privilege requires assigning `roles/iam.serviceAccountUser` to the deployment service account so it can attach the target identity to virtual machines without granting administrative power over the service account lifecycle or broad project resources.

Step-by-Step Solution

1
Evaluate state storage strategy for Infrastructure as Code (IaC).
Using a Cloud Storage bucket backend with object versioning ensures state durability, concurrency locking, and auditability across team and CI/CD runs.
Local unversioned storage on CI/CD nodes leads to state corruption, drift, and lost state files.
2
Evaluate IAM permissions for the deployment pipeline service account to attach workload service accounts to Compute Engine instances.
Granting `roles/iam.serviceAccountUser` allows impersonation/attachment without administrative modification rights.
Assigning primitive roles like Editor or administrative roles like Service Account Admin violates least privilege and exposes security vulnerabilities.

Key Concept

Provisioning Compute Infrastructure using IaC Best Practices and IAM Least Privilege
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic