Examkin

Question

Difficulty: HardAdvising Development and Operation Teams

A healthcare analytics company is migrating its deployment workflow to Google Cloud. The development team currently manages infrastructure using Terraform from local workstations and uses long-lived JSON service account keys stored on developer machines. During recent testing, concurrent developer deployments caused conflicting infrastructure state changes and overwrites. You need to advise the operations and development teams on an architecture that provides secure, concurrent Infrastructure as Code (IaC) state management and eliminates service account key export risks, while adhering to least privilege and minimizing operational overhead. Which solution should you recommend?

  1. Configure a Cloud Storage bucket with object versioning as the remote backend for Terraform state locking, and establish Workload Identity Federation for keyless authentication from the CI/CD pipeline using granular IAM roles.Answer
  2. B
    Store the Terraform state file in a shared Git repository with file encryption, and assign the primitive Owner role to a central service account downloaded onto developer machines.
  3. C
    Maintain Terraform state files on a local shared network drive on a Compute Engine instance, and grant developers the Service Account Admin role so they can generate temporary service account keys on demand.
  4. D
    Keep state files on local developer machines while configuring Cloud Pub/Sub topics for build triggers, and submit a regional compute quota increase request before executing deployments.

Answer

The optimal architecture recommendation is to configure a Cloud Storage bucket with object versioning as the remote backend for Terraform state locking, and establish Workload Identity Federation for keyless CI/CD authentication using fine-grained IAM roles.
Recommending a Cloud Storage bucket backend with object versioning provides automated state locking for Terraform, preventing concurrent executions from corrupting infrastructure state. Combining this with Workload Identity Federation enables external pipeline runners to authenticate securely without downloading long-lived service account keys, fulfilling security and least-privilege requirements with minimal management effort.

Step-by-Step Solution

1
Analyze state management requirements for team collaboration
Identified that local state storage leads to concurrency collisions and overwrites.
Remote state backends like Google Cloud Storage support automatic state locking via Cloud Storage object generation checks, preventing simultaneous operations.
2
Evaluate authentication and credential security best practices
Identified that exported service account JSON keys pose high security risks.
Workload Identity Federation allows external CI/CD platforms or environment runners to authenticate to GCP keylessly using short-lived tokens.
3
Synthesize recommendations according to architectural constraints
Selected Cloud Storage remote backend coupled with Workload Identity Federation and least-privilege IAM roles.
This combination achieves zero service account key exposure, automatic state locking, and operational overhead minimization.

Key Concept

Best practices for advising teams on secure IaC state management and keyless pipeline authentication in GCP.
Rate this question

Topics

Advising Development and Operation Teams

More questions from this topic