Your engineering team is migrating legacy infrastructure management to an automated CI/CD pipeline using Terraform across multiple Google Cloud projects. You need to configure state storage and pipeline access permissions to ensure concurrency safety, auditability, and adherence to least-privilege security principles. Which architecture configuration should you implement?
- Store the state file in a Cloud Storage backend with Object Versioning enabled, and configure the automated pipeline to impersonate a dedicated service account using the Service Account Token Creator role.Answer
- BStore the Terraform state file in the application source control repository, and execute the automated pipeline using a service account assigned the primitive Owner role.
- CStore the state file in an unversioned Cloud Storage bucket, and grant the pipeline service account the Service Account Admin role to ensure it can manage all identity resources during execution.
- DStore the Terraform state in local execution storage, and configure the pipeline script to request GCP regional quota increases automatically after a state apply failure occurs.
Answer
Store the state file in a Cloud Storage backend with Object Versioning enabled, and configure the automated pipeline to impersonate a dedicated service account using the Service Account Token Creator role.
Configuring a Cloud Storage backend with Object Versioning provides automatic lock acquisition during execution and state recovery options. Combining this backend with service account impersonation via short-lived tokens ensures enterprise security and operational reliability without exposing static key files.
Step-by-Step Solution
Key Concept
Terraform Remote State locking, GCS Versioning, and Service Account Impersonation
Estimated Time:1m 30s