Examkin

Question

Difficulty: Very hardImplementing Infrastructure as Code using Terraform and Deployment Manager

A Cloud Architect needs to migrate an existing local Terraform state file containing critical production Google Cloud resources to a secure Google Cloud Storage (GCS) remote backend with state locking and CMEK encryption. Arrange the operational steps in the correct chronological order to safely complete this backend migration while maintaining resource integrity.

  1. 1Provision a dedicated GCS bucket configured with Object Versioning, CMEK encryption, and uniform bucket-level access, granting IAM access exclusively to the Terraform service account.
  2. 2Configure the `backend "gcs"` block in the Terraform root module's configuration files specifying the bucket name and state prefix.
  3. 3Run `terraform init -migrate-state` and approve the prompt to transfer local state records into the remote GCS backend.
  4. 4Execute `terraform plan` to confirm that the remote state matching produces zero pending infrastructure changes or drift.
  5. 5Clean up and remove the local `terraform.tfstate` and local state backup files from the local working directory.

Answer

The correct sequence starts with provisioning and securing the remote GCS bucket, adding the `backend "gcs"` configuration to the Terraform code, executing `terraform init -migrate-state` to copy state data, running `terraform plan` to verify zero drift, and finally purging local state file artifacts.
Migrating Terraform state safely requires creating the remote GCS backend infrastructure first, declaring the backend in HCL, using the CLI tool's dedicated `-migrate-state` command to copy existing resource records under a state lock, verifying state synchronization via a plan, and lastly removing legacy local state files.

Step-by-Step Solution

1
Provision GCS storage bucket with object versioning, CMEK, and minimal IAM permissions.
Secure storage destination for remote state management is established.
The GCS bucket must exist and have proper state locking and security controls before Terraform can communicate with it.
2
Add the `backend "gcs"` block into the Terraform root configuration.
Terraform configuration points to the targeted GCS bucket.
Terraform needs backend definitions in HCL to recognize the change from local backend to remote GCS storage.
3
Execute `terraform init -migrate-state`.
Local state contents are safely copied into GCS state storage under state lock protection.
The `-migrate-state` flag explicitly instructs Terraform to copy existing local state metadata to the newly configured backend.
4
Run `terraform plan` to validate infrastructure synchronization.
Confirmation of zero resource changes or state corruption.
Validation against live Google Cloud resources ensures that state pointers were migrated without drift.
5
Remove local `terraform.tfstate` files.
Prevention of concurrent local executions and credential exposure.
Deleting local state files enforces central GCS state usage across team members.

Key Concept

Terraform Remote State Migration to Google Cloud Storage
Rate this question

Topics

Implementing Infrastructure as Code using Terraform and Deployment Manager

More questions from this topic