Examkin

Question

Difficulty: MediumAnalyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines

An enterprise energy management company is auditing its continuous integration and continuous delivery (CI/CD) pipelines used to deploy infrastructure and microservices on Google Cloud. The automated pipeline executes Terraform via Cloud Build. An audit reveals that the build pipeline currently stores Terraform state files locally inside the transient Cloud Build workspace container, and the Cloud Build service account is assigned the primitive Project Editor role (`roles/editor`). The architecture team must optimize the pipeline to ensure state persistence, prevent state corruption from concurrent runs, and align with least-privilege security standards. Which combination of architectural changes should the team implement?

  1. Configure a Google Cloud Storage bucket with object versioning and state locking as the Terraform remote backend, and replace the primitive Editor role on the Cloud Build service account with granular predefined IAM roles for the targeted GCP resources.Answer
  2. B
    Store the Terraform state files inside a version-controlled Cloud Source Repositories repository during build execution, and grant the Cloud Build service account the `roles/iam.serviceAccountAdmin` role to manage resource deployment identities.
  3. C
    Retain the local workspace state file execution model inside Cloud Build, but upgrade the Cloud Build service account from Project Editor to Project Owner (`roles/owner`) to eliminate resource creation permission errors.
  4. D
    Export local Terraform state files to Cloud Logging as custom log entries after each build run, and grant the Cloud Build service account the `roles/iam.serviceAccountAdmin` role to execute deployment tasks.

Answer

Configure a Google Cloud Storage bucket with object versioning and state locking as the Terraform remote backend, and replace the primitive Editor role on the Cloud Build service account with granular predefined IAM roles for the targeted GCP resources.
The solution properly resolves both pipeline deficiencies identified during the audit. Storing Terraform state in a Cloud Storage bucket configured with object versioning and state locking prevents state corruption and loss during parallel CI/CD runs. Replacing the primitive Editor role with fine-grained predefined roles ensures the Cloud Build service account operates strictly within least-privilege security boundaries.

Step-by-Step Solution

1
Analyze IaC State Management Requirements
Local state files in transient CI/CD execution environments cause state loss and concurrency conflicts.
Terraform requires a centralized remote backend like Google Cloud Storage with state locking enabled to handle state safely in automated pipelines.
2
Analyze Pipeline IAM Security Requirements
Primitive roles like Editor or Owner provide broad, unmonitored permissions across the entire project.
Security best practices require replacing primitive roles with least-privilege predefined or custom IAM roles scoped strictly to the resources being provisioned.
3
Synthesize Optimal Architecture Solution
Combine Cloud Storage backend configuration with scoped predefined IAM roles for the Cloud Build service account.
This dual change resolves operational risks around state corruption while satisfying corporate compliance and security requirements.

Key Concept

CI/CD Pipeline Optimization and Infrastructure as Code State & Security Management
Rate this question

Topics

Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines