A smart building management provider on Google Cloud experiences deployment instability and security compliance failures resulting from accrued technical debt. An architecture audit revealed two major issues: infrastructure provisioning relies on local Terraform state files saved on individual engineer workstations without concurrency locking, and application workloads run using the default Compute Engine service account bound to project-level primitive Editor roles. Which TWO architectural remediations should the cloud architect implement to mitigate this technical debt? (Select TWO.)
- Migrate state management to a Google Cloud Storage bucket configured with Object Versioning and enable remote backend state locking.Answer
- Replace primitive role assignments by creating dedicated user-managed service accounts with predefined or fine-grained custom roles following least privilege.Answer
- CCommit local Terraform state files directly into the version-controlled application repository to track revision history and resolve state conflicts through merge requests.
- DAssign developers the Service Account Admin role at the project level to allow workloads to dynamically request elevated privileges at runtime.
Answer
The team should migrate Terraform state files to a Google Cloud Storage bucket configured with Object Versioning and remote backend locking, and replace project-level primitive roles by creating dedicated user-managed service accounts with fine-grained custom or predefined roles.
Migrating Terraform state management to a Cloud Storage bucket with Object Versioning and state locking ensures isolated, atomic state updates without risk of race conditions or data loss. Creating dedicated user-managed service accounts with scoped custom or predefined roles removes over-privileged primitive Editor roles, establishing robust IAM governance.
Step-by-Step Solution
Key Concept
Mitigating technical debt by modernizing IaC state backends and enforcing granular IAM least-privilege permissions on Google Cloud.