A telemetry platform team operating a global IoT data ingestion service on Google Cloud is restructuring their deployment pipeline and environment governance. Currently, engineers perform manual infrastructure modifications through the Cloud Console and authenticate CI/CD jobs using long-lived service account keys saved locally. As a Principal Cloud Architect, you are advising the development and operations teams on implementing GCP best practices for automation, security, and state management. Which TWO practices should you recommend? (Select TWO.)
- Authenticate external CI/CD deployment pipelines using Workload Identity Federation rather than exporting long-lived service account JSON keys.Answer
- Store Terraform state files in a Cloud Storage bucket configured with object versioning and state locking enabled.Answer
- CGrant the Editor primitive role to the deployment service account to ensure all existing and future infrastructure provisioning operations succeed.
- DMaintain Infrastructure as Code state files within developer local Git repositories to track infrastructure revisions alongside application source code.
- EAssign the Service Account Admin role to developer accounts to allow Compute Engine instances to run under application service accounts.
Answer
The correct recommendations are authenticating external CI/CD deployment pipelines using Workload Identity Federation instead of long-lived keys, and storing Terraform state files in a Cloud Storage bucket configured with object versioning and state locking.
Advising DevOps teams effectively involves enforcing key security and operational principles. Authenticating pipelines using Workload Identity Federation avoids storing long-lived credentials, and using Cloud Storage for Terraform state management ensures centralized, locked, and versioned state file tracking.
Step-by-Step Solution
Key Concept
Advising Development and Operation Teams on Secure Automation and IaC Best Practices