Examkin

Question

Difficulty: MediumAnalyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines

An organization is analyzing its automated software release process for a hybrid microservices platform deployed on Compute Engine Managed Instance Groups (MIGs). The CI/CD pipeline utilizes Cloud Build to build custom Golden Images using Packer and execute Terraform scripts to update instance templates. An SDLC architecture review identified two critical issues: the Cloud Build default service account uses the primitive Editor role across the project, and Terraform state files generated during execution are stored on local runner storage without locks, causing concurrency errors during parallel pipeline runs. Which TWO actions should the architecture team recommend to resolve these issues while following Google Cloud best practices? (Select TWO.)

  1. Configure a dedicated user-managed service account for Cloud Build with granular roles for compute resource management and grant it the Service Account User role on the workload runtime service account.Answer
  2. B
    Grant the Cloud Build service account the Service Account Admin role to allow it full control over identity delegation during compute provisioning.
  3. C
    Assign the primitive Owner role to the Cloud Build service account to ensure all automated resource creation steps bypass IAM permission checks.
  4. D
    Configure Terraform pipelines to store state files inside ephemeral build workspace storage to isolate each build execution from network access.
  5. Configure a central Google Cloud Storage bucket backend with Object Versioning enabled for Terraform state management.Answer

Answer

To establish a secure and reliable CI/CD pipeline, the organization must create a dedicated user-managed service account for Cloud Build with least-privilege predefined roles (including Service Account User for compute workload attachment) and store Terraform state remotely in a Google Cloud Storage bucket with Object Versioning enabled.
The solution requires hardening the CI/CD pipeline identity and securing IaC state management. Configuring a dedicated user-managed service account with fine-grained permissions and the Service Account User role enforces least privilege. Storing Terraform state in a centralized Google Cloud Storage bucket with versioning prevents state corruption, lock contention, and drift during automated pipeline runs.

Step-by-Step Solution

1
Analyze pipeline security and identify IAM role anti-patterns.
Identified that primitive Editor/Owner roles grant broad unnecessary access across GCP services.
Least privilege requires replacing primitive roles with fine-grained custom or predefined roles and using roles/iam.serviceAccountUser to attach identities to compute resources.
2
Evaluate Infrastructure as Code (IaC) state management requirements.
Identified that local state files on ephemeral runner storage cause race conditions and state loss.
Google Cloud Storage provides central state locking and versioning for multi-execution Terraform pipelines.

Key Concept

CI/CD Pipeline Security and IaC Remote State Management
Rate this question

Topics

Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines