A smart city traffic management platform manages its Google Cloud infrastructure across multiple environments using Terraform executed via Cloud Build CI/CD pipelines. The engineering team wants to enforce IaC governance, ensure remote state file security and integrity, prevent configuration drift, and adhere to least privilege security practices. Which TWO actions should the team implement to meet these requirements?
- Configure a Cloud Storage bucket with Object Versioning enabled as a remote backend for Terraform state, and grant backend access only to the deployment service account.Answer
- Assign fine-grained predefined IAM roles to the Cloud Build service account and schedule periodic terraform plan runs to identify infrastructure drift.Answer
- CStore Terraform state files on the local file system of the CI/CD runner build agents to accelerate build performance.
- DGrant the Project Owner primitive role (roles/owner) to the Cloud Build service account to guarantee smooth execution without role scoping errors.
- EPermit engineers to perform manual console modifications during incidents and delete remote state files to force infrastructure re-creation.
Answer
The team should configure a Cloud Storage remote backend with Object Versioning for secure state management, and assign fine-grained predefined IAM roles to the CI/CD service account while running automated periodic terraform plan checks to detect drift.
Configuring a Google Cloud Storage bucket with Object Versioning as the remote backend provides state locking, concurrency protection, and historical state recovery. Additionally, granting fine-grained predefined IAM roles to the build service account adheres to the principle of least privilege, while running periodic automated 'terraform plan' commands continuously monitors for configuration drift.
Step-by-Step Solution
Key Concept
Terraform remote state management, IAM least privilege, and continuous drift detection in Google Cloud CI/CD pipelines.