A cloud operations team is designing a CI/CD pipeline to automate infrastructure provisioning across multiple Google Cloud projects using Terraform. To meet strict enterprise security guidelines, the team must eliminate long-lived service account key files, prevent state file corruption during concurrent pipeline runs, and adhere to the principle of least privilege. Which deployment architecture and authentication strategy adhering to Google Cloud recommended best practices should the team implement?
- Configure a Cloud Storage remote backend with Object Versioning and state locking enabled, and authenticate the CI/CD pipeline using Workload Identity Federation with fine-grained IAM roles.Answer
- BStore Terraform state files in a versioned local directory on the CI/CD runner, and grant the pipeline service account the primitive Editor role to simplify resource creation across all target projects.
- CConfigure a Cloud Storage remote backend for state files, and grant the CI/CD pipeline service account the Service Account Admin role across target projects to manage and impersonate compute workloads.
- DStore state files in an unversioned local storage directory on the build agent, committing updated state files back to the private repository after each execution while authenticating with static service account keys.
Answer
Configure a Cloud Storage remote backend with Object Versioning and state locking enabled, and authenticate the CI/CD pipeline using Workload Identity Federation with fine-grained IAM roles.
Configuring a Cloud Storage remote backend with Object Versioning provides automated state locking via GCS generation checks to ensure safe concurrent operations. Using Workload Identity Federation allows CI/CD systems to authenticate without long-lived keys while leveraging fine-grained IAM roles.
Step-by-Step Solution
Key Concept
Infrastructure as Code Centralized State Governance and Keyless CI/CD Authentication
Estimated Time:1m 30s