A platform engineering team is establishing automated infrastructure provisioning routines for a regional order processing service on Google Cloud. The architecture requires a managed relational database instance and an object storage bucket for audit logs. Corporate security policies demand that all storage encryption keys remain under central organization management in Cloud KMS without developers handling raw key material, and infrastructure automation must prevent concurrent state modification and accidental state file corruption. Which TWO provisioning configurations should the engineering team implement? (Select TWO.)
- Configure the Terraform remote backend to use a Google Cloud Storage bucket with Object Versioning enabled for managing state files.Answer
- Provision the Cloud SQL instance using a Customer-Managed Encryption Key (CMEK) hosted in Cloud Key Management Service (KMS).Answer
- CMaintain the Terraform `.tfstate` files on a local shared developer filesystem to bypass cloud storage API authentication requirements.
- DConfigure Customer-Supplied Encryption Keys (CSEK) by supplying 256-bit AES encryption key strings directly inside the Terraform configuration files.
Answer
The team should configure the Terraform remote backend to use a Google Cloud Storage bucket with Object Versioning enabled and provision the Cloud SQL instance using a Customer-Managed Encryption Key (CMEK) in Cloud KMS.
Configuring a Cloud Storage remote backend with Object Versioning ensures Terraform state files are locked during concurrent execution and backed up against state corruption. Provisioning Cloud SQL with Customer-Managed Encryption Keys (CMEK) in Cloud KMS satisfies regulatory key-governance requirements without introducing raw key management risk.
Step-by-Step Solution
Key Concept
Provisioning secure cloud database and storage resources via IaC requires robust remote state locking and compliance-driven KMS key integration.