Examkin

Question

Difficulty: MediumContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

A video gaming company is implementing an automated CI/CD pipeline using Cloud Build to deploy application infrastructure via Terraform across multiple Google Cloud environments. The security team mandates that Cloud Build must run builds following the principle of least privilege without being granted administrative control over service accounts. Additionally, the pipeline design must ensure that concurrent build executions do not cause state corruption or race conditions. Which combination of IAM configuration and state management should you implement?

  1. Grant the Cloud Build service account the Service Account User role on a dedicated deployment service account, and configure Terraform to use a Cloud Storage remote backend with state locking enabled.Answer
  2. B
    Grant the Cloud Build service account the Service Account Admin role across the project, and store the Terraform state files in a standard Cloud Storage bucket without object versioning or locking.
  3. C
    Grant the Cloud Build service account the primitive Owner role on the target project, and store state files locally within the ephemeral Cloud Build execution environment.
  4. D
    Configure Cloud Build to run under the default Compute Engine service account, storing the generated terraform.tfstate files in unversioned local build storage to maximize execution performance.

Answer

Granting the Cloud Build service account the Service Account User role on a dedicated deployment service account, combined with storing Terraform state in a Cloud Storage remote backend with state locking, fulfills both least privilege IAM requirements and prevents infrastructure state corruption.
The correct solution grants the minimal necessary IAM role (`roles/iam.serviceAccountUser`) to Cloud Build so that build steps can execute using the target deployment service account identity. Additionally, configuring a Google Cloud Storage backend with native object locking ensures that multiple parallel builds cannot mutate the Infrastructure as Code state simultaneously, preventing corruption and race conditions.

Step-by-Step Solution

1
Evaluate IAM privileges required for Cloud Build service account impersonation.
The Cloud Build service account requires `roles/iam.serviceAccountUser` to impersonate or attach a dedicated service account, rather than `roles/iam.serviceAccountAdmin` or primitive `roles/owner`.
This enforces the principle of least privilege by restricting Cloud Build from managing service account lifecycles.
2
Evaluate Infrastructure as Code state management requirements for CI/CD automation.
Terraform must be configured with a Cloud Storage backend (`gcs` backend) utilizing state locking via Cloud Storage object versioning/locking mechanisms.
Remote state storage with locking ensures concurrent pipeline triggers do not overwrite state files simultaneously or create configuration drift.

Key Concept

CI/CD Pipeline Security and IaC State Management
Rate this question

Topics

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

More questions from this topic