An enterprise digital advertising platform recently migrated its ad attribution engine to Google Cloud. A post-migration technical debt assessment reveals two primary architectural risks: infrastructure changes are executed using unversioned Terraform state files stored on individual developer workstations, and background worker service accounts remain assigned primitive Project Editor roles. Which TWO actions should the cloud architect recommend to effectively mitigate this technical debt? (Select TWO answers.)
- Configure a Cloud Storage remote backend with object versioning and state locking enabled for Terraform state management.Answer
- Replace the primitive Project Editor roles on service accounts with specific predefined IAM roles that grant minimal required permissions.Answer
- CMigrate the background worker processes to a multi-region Google Kubernetes Engine (GKE) cluster to isolate permissions.
- DCommit and push local Terraform state files to a central Git repository encrypted with Customer-Supplied Encryption Keys (CSEK).
Answer
The architect should migrate Terraform state files to a Cloud Storage remote backend with versioning and object locking, and replace primitive Project Editor IAM roles on service accounts with minimal predefined roles.
Establishing a remote Cloud Storage backend with object versioning and locking resolves IaC state vulnerability and concurrency issues. Replacing primitive Editor roles with fine-grained predefined roles removes excessive access and enforces least privilege governance.
Step-by-Step Solution
Key Concept
Remediating IaC state drift and IAM over-privilege technical debt in Cloud Architectures