A digital publishing firm's development and operations teams are standardizing their Google Cloud deployment practices. Developers currently hold the Editor primitive role on project environments so they can run deployment scripts and troubleshoot infrastructure issues. The security and operations teams require implementing strict least privilege and preventing manual configuration drift across environments. Which recommendation should the Cloud Architect give to best align the development and operations teams?
- Configure the automated CI/CD pipeline to authenticate using a dedicated deployment service account with fine-grained custom roles, grant developers permissions to trigger pipeline execution, and revoke developer Editor roles.Answer
- BGrant the deployment service account the Owner primitive role across all project environments to prevent pipeline permission failures, while maintaining developer Editor roles for rapid troubleshooting.
- CGrant developer accounts the Service Account Admin role so developers can create, download, and update service account keys directly during deployment pipeline runs.
- DInstruct developers to store Terraform state files in local developer workstations and manually commit state changes to source control after applying infrastructure updates.
Answer
Configure the automated CI/CD pipeline to authenticate using a dedicated deployment service account with fine-grained custom roles, grant developers permissions to trigger pipeline execution, and revoke developer Editor roles.
The architect should advise delegating deployment responsibilities to an automated pipeline that runs under a service account constrained by least-privilege roles. Developers trigger the automated workflow without holding direct administrative privileges on Google Cloud resources, maintaining security compliance and preventing manual environment drift.
Step-by-Step Solution
Key Concept
Advising DevOps on Secure Deployment Automation and IAM Least Privilege
Estimated Time:1m 30s