Examkin

Question

Difficulty: MediumImplementing Infrastructure as Code using Terraform and Deployment Manager

Your cloud architecture team needs to migrate a local Terraform state file containing critical Google Cloud infrastructure to a centralized, multi-user Google Cloud Storage (GCS) remote backend with state locking and service account impersonation. What is the correct sequence of steps to perform this state migration securely?

  1. 1Provision a Cloud Storage (GCS) bucket configured with Object Versioning enabled and Uniform Bucket-Level Access.
  2. 2Add a `backend "gcs"` configuration block specifying the bucket name and prefix to the root Terraform module.
  3. 3Authenticate your environment session to assume the deployment Service Account identity with permissions on the GCS state bucket.
  4. 4Execute `terraform init -migrate-state` to automatically transfer the local state file entries into GCS and acquire state locks.

Answer

The correct sequence begins with provisioning a GCS bucket with Object Versioning, followed by defining the backend configuration block in code, authenticating via service account impersonation, and finally running terraform init with the -migrate-state flag to copy local state to GCS.
Migrating Terraform state requires establishing the underlying storage bucket first, updating the codebase to point to the new backend, authenticating the CLI session with short-lived service account credentials, and invoking terraform init with the -migrate-state flag to copy local state objects safely.

Step-by-Step Solution

1
Provision the destination Cloud Storage bucket configured with Object Versioning.
A secure GCS bucket is created to store state snapshots and protect against state corruption.
Terraform cannot create its own backend storage bucket automatically during state initialization; the bucket resource must pre-exist.
2
Configure the `backend "gcs"` block in the main Terraform module.
The Terraform CLI is informed of the new remote backend target location.
Terraform requires the target backend declared in source code to recognize that state migration is requested.
3
Authenticate to GCP and assume the deployment service account identity.
The active session gains short-lived IAM credentials required for bucket access.
State operations require direct object read/write and locking access to the GCS bucket.
4
Execute `terraform init -migrate-state` in the directory containing the local state.
Terraform copies state items from local disk into GCS and locks the state file.
The `-migrate-state` flag instructs Terraform to safely copy state resources to the newly configured remote backend.

Key Concept

Terraform Remote State Migration to GCS with Locking and Versioning
Rate this question

Topics

Implementing Infrastructure as Code using Terraform and Deployment Manager

More questions from this topic