Examkin

Question

Difficulty: MediumBuilding and Managing Infrastructure as Code (IaC)

A media publishing enterprise needs to onboard existing, manually provisioned Google Cloud infrastructure—specifically Cloud Storage buckets and Compute Engine instances—into a managed Terraform workflow backed by a secure remote state. What is the correct sequence of operational steps to safely import these resources and ensure configuration alignment?

  1. 1Provision a dedicated Google Cloud Storage bucket with object versioning and uniform bucket-level access to serve as the remote backend.
  2. 2Configure the GCS backend block in the main Terraform configuration and execute `terraform init` to establish remote state locking.
  3. 3Write matching declarative resource definitions in Terraform HCL for the existing Cloud Storage buckets and Compute Engine instances.
  4. 4Execute `terraform import` commands mapping each GCP resource ID to its corresponding Terraform resource address.
  5. 5Run `terraform plan` to validate that the resource configurations match the imported state with zero proposed changes.

Answer

The correct operational sequence begins with provisioning the remote GCS backend bucket with versioning and uniform access, followed by configuring the backend and running `terraform init`. Next, matching declarative Terraform HCL resource blocks are defined, after which `terraform import` binds the live GCP resources to state addresses. Finally, `terraform plan` is executed to confirm zero configuration drift.
Safely incorporating existing (brownfield) Google Cloud infrastructure into Terraform requires establishing the infrastructure state lifecycle in a precise sequence. First, the GCS bucket for remote backend state must be created with state protection features (versioning and uniform bucket-level access). Second, `terraform init` initializes the workspace to connect to this remote backend. Third, HCL resource definitions are written to provide the schema target. Fourth, `terraform import` maps the existing live infrastructure IDs into the remote state file. Finally, `terraform plan` validates that no unintended drift or destructive actions will occur when managing the resources declaratively going forward.

Step-by-Step Solution

1
Provision remote state bucket in GCS
A secure GCS bucket with versioning and uniform bucket-level access is available for state storage.
Remote state backend storage must be provisioned before Terraform can use it to maintain state and lock state during operations.
2
Configure backend and initialize Terraform
Terraform working directory is initialized and linked to the GCS remote backend.
Initializing Terraform establishes remote state management and locks access to prevent concurrent state modifications.
3
Define target resource HCL blocks
Declarative resource code blocks exist in Terraform files corresponding to live infrastructure.
`terraform import` requires target resource addresses defined in HCL prior to binding existing live infrastructure.
4
Import existing GCP resources into Terraform state
The Terraform state file is updated with attribute metadata from live GCP resources.
Importing binds existing infrastructure instances to Terraform state without destroying or recreating them.
5
Validate synchronization with terraform plan
Verification confirms that zero infrastructure changes or destructions are pending.
Running a plan immediately after import verifies that the declarative HCL matches the imported live state.

Key Concept

Brownfield resource import into Terraform state using secure GCS remote backend governance
Rate this question

Topics

Building and Managing Infrastructure as Code (IaC)

More questions from this topic