A DevOps engineering team is evaluating their CI/CD pipeline in Google Cloud to ensure secure deployments to Google Kubernetes Engine (GKE). Which of the following security practices should the team incorporate into their software development lifecycle and Cloud Build pipeline? (Select TWO.)
- Configure Cloud Build triggers to execute using a dedicated user-managed service account granted only the specific IAM roles required for the build and deployment tasks.Answer
- Enable automated container image vulnerability scanning in Artifact Registry to detect security issues prior to deployment.Answer
- CGrant the primitive Owner role to the default Cloud Build service account to prevent permission failures during automated infrastructure deployment steps.
- DDownload and commit a service account JSON private key directly into the application Git repository to authenticate Cloud Build steps.
- EAssign the Service Account Admin role to developers so they can impersonate the build service account during pipeline runs.
Answer
The team should configure Cloud Build to use a dedicated user-managed service account with minimal necessary permissions and enable container image vulnerability scanning in Artifact Registry.
Configuring Cloud Build to execute using a dedicated user-managed service account adhering to least privilege minimizes security exposure. Additionally, integrating automated container vulnerability scanning in Artifact Registry identifies security vulnerabilities early in the CI/CD pipeline.
Step-by-Step Solution
Key Concept
Securing CI/CD pipelines with least privilege service accounts and automated vulnerability scanning