Examkin

Question

Difficulty: MediumImplementing Infrastructure as Code using Terraform and Deployment Manager

An enterprise architecture team is configuring an automated CI/CD pipeline using Cloud Build and Terraform to provision resources across target Google Cloud projects. The team must adhere to Google Cloud security best practices by applying the principle of least privilege to the pipeline service account while ensuring concurrency safety and state integrity during automated deployments. Which provisioning strategy should the team implement?

  1. Assign fine-grained predefined IAM roles for target services and the Service Account User role to the Cloud Build service account, while configuring a remote Cloud Storage backend with object versioning and state locking enabled.Answer
  2. B
    Assign the primitive Owner role at the organization level to the Cloud Build service account to prevent permission failures during provisioning, while storing state locally within the ephemeral build execution environment.
  3. C
    Assign the Service Account Admin role to the Cloud Build service account to allow attached compute resources to execute tasks, while configuring a remote Cloud Storage backend without object versioning.
  4. D
    Generate static service account JSON keys and embed them within the Terraform provider configuration, while disabling state locking to increase parallel execution speed.

Answer

Assign fine-grained predefined IAM roles for target services and the Service Account User role to the Cloud Build service account, while configuring a remote Cloud Storage backend with object versioning and state locking enabled.
The correct strategy enforces the principle of least privilege by combining fine-grained predefined target roles with the Service Account User role for service account impersonation. Additionally, configuring a Google Cloud Storage remote backend with versioning and object locking guarantees state file resilience and prevents concurrent pipelines from corrupting infrastructure state.

Step-by-Step Solution

1
Evaluate the IAM permission requirements for the deployment pipeline service account.
Identified that least privilege requires granting specific predefined roles for managed resources and roles/iam.serviceAccountUser to attach service accounts to compute resources, rather than broad administrative or primitive roles.
Prevents over-privileging the CI/CD pipeline while granting necessary execution rights.
2
Evaluate the state management architecture for automated Terraform executions.
Selected Cloud Storage as a remote backend with object versioning and state locking enabled via Cloud Storage object locking.
Ensures state consistency, enables concurrency controls during pipeline execution, and provides rollback capabilities via bucket object versioning.

Key Concept

Secure IaC automation using least-privilege service accounts and centralized Cloud Storage backend with state locking.
Estimated Time:1m 30s
Rate this question

Topics

Implementing Infrastructure as Code using Terraform and Deployment Manager

More questions from this topic