Examkin

Question

Difficulty: HardImplementing Infrastructure as Code using Terraform and Deployment Manager

A financial analytics firm uses Terraform to provision infrastructure across multiple Google Cloud projects. A recent security and operational audit revealed two critical issues: deployment pipelines frequently fail due to concurrent state file collisions when engineers apply changes simultaneously from local environments, and the service accounts executing infrastructure updates hold excessive administrative access across the entire GCP organization. Which two architectural configurations should you implement to resolve these concurrency and security issues in alignment with Google-recommended best practices? (Select TWO.)

  1. Configure a Cloud Storage (GCS) bucket as the remote backend for Terraform state files with Object Versioning enabled.Answer
  2. B
    Store Terraform state files in a central Git repository committed alongside module source code to track concurrency.
  3. C
    Assign the primitive Owner role at the Organization level to the CI/CD pipeline service accounts to ensure provisioning commands never fail on API authorization.
  4. Bind granular, predefined or custom IAM roles to dedicated service accounts at the target project scope, and grant deployment engineers the Service Account User role.Answer

Answer

To establish secure and reliable Infrastructure as Code workflows, configure a Cloud Storage backend with Object Versioning for Terraform state storage and state locking, and enforce least privilege by assigning granular predefined/custom roles to dedicated service accounts scoped to target projects while delegating access via the Service Account User role.
Configuring a Cloud Storage remote backend ensures automated, native state locking and consistency checks during Terraform executions, preventing concurrent state overwrite issues. Enabling Object Versioning adds durability against state corruption. Combining this backend configuration with fine-grained, project-scoped IAM roles and granting developers the Service Account User role ensures that automated infrastructure provisioning adheres strictly to Google Cloud security best practices.

Step-by-Step Solution

1
Address concurrent state modification and state corruption issues.
Migrate state management to a centralized Google Cloud Storage (GCS) bucket backend with Object Versioning enabled.
Cloud Storage backends offer built-in state locking and strong consistency, preventing simultaneous state writes and preserving historical state versions for rollback.
2
Address overly permissive organizational IAM access.
Replace primitive Organization-level roles with fine-grained predefined or custom IAM roles scoped strictly to the target project, and assign the Service Account User role (`roles/iam.serviceAccountUser`) to authorized deployment users.
This enforces the principle of least privilege, restricting CI/CD pipeline service accounts to only the necessary permissions required to provision specific project resources.

Key Concept

Terraform Remote State Management and IAM Least Privilege Delegation in Google Cloud
Rate this question

Topics

Implementing Infrastructure as Code using Terraform and Deployment Manager

More questions from this topic