Examkin

Question

Difficulty: EasyAdvising Development and Operation Teams

A development team is establishing an automated Infrastructure as Code (IaC) deployment pipeline using Terraform on Google Cloud. As a Cloud Architect, you are advising the operations team on foundational security and state management best practices. Which TWO recommendations should you provide to ensure secure, concurrent, and reliable deployments? (Select TWO answers.)

  1. Store the Terraform state file in a Google Cloud Storage backend with object versioning and state locking enabled.Answer
  2. Grant CI/CD service accounts fine-grained predefined or custom IAM roles adhering to the principle of least privilege.Answer
  3. C
    Store Terraform state files on the local filesystem of developer workstations or CI runners to maximize execution speed.
  4. D
    Assign the primitive Owner role to the deployment service account to ensure pipeline tasks never fail due to missing permissions.
  5. E
    Grant the Service Account Admin role to developers who need to run infrastructure deployment scripts from their local machines.

Answer

The architect should advise the team to store Terraform state in a Cloud Storage bucket with object versioning and state locking enabled, and to grant deployment service accounts least-privilege predefined or custom IAM roles.
Centralizing Terraform state management using a Google Cloud Storage bucket with versioning and object locking ensures multi-user concurrency protection and disaster recovery for IaC state. Concurrently, granting specific predefined or custom roles to deployment service accounts enforces the principle of least privilege without exposing administrative control over unrelated resources.

Step-by-Step Solution

1
Analyze the state management requirement for team deployments.
Local state files cause race conditions and risk loss. A central Cloud Storage backend with state locking handles concurrent access safely.
Terraform state locks prevent multiple pipeline runs from corrupting infrastructure state simultaneously.
2
Analyze the security privileges for the automated pipeline service account.
Primitive roles like Owner grant overly broad access across resources, whereas fine-grained roles follow security best practices.
Adhering to least-privilege IAM controls prevents potential security exfiltration or unintended resource disruption.

Key Concept

Advising operations and development teams on Cloud Storage Terraform backends and least-privilege IAM service account configuration.
Rate this question

Topics

Advising Development and Operation Teams

More questions from this topic