Examkin

Question

Difficulty: MediumBuilding and Managing Infrastructure as Code (IaC)

An enterprise SaaS company manages its Google Cloud infrastructure using Terraform within a Cloud Build CI/CD pipeline. The lead cloud architect must establish a secure Terraform state management architecture that prevents concurrent execution conflicts, enables state rollback in the event of corruption, and avoids using static, long-lived service account keys for pipeline authentication. Which solution meets these requirements according to Google Cloud best practices?

  1. Store the Terraform state in a Google Cloud Storage bucket with Object Versioning enabled, rely on the GCS backend's native state locking capabilities, and authenticate Cloud Build via Workload Identity Federation using a fine-grained service account.Answer
  2. B
    Store the Terraform state file locally in the Cloud Build build runner directory, upload it to Cloud Storage upon pipeline completion, and grant the runner service account the primitive Editor role.
  3. C
    Store the Terraform state in a Google Cloud Storage bucket with Object Versioning disabled to reduce storage overhead, and grant the pipeline service account the primitive Owner role to ensure unrestricted access.
  4. D
    Store the Terraform state in a Google Cloud Storage bucket, and instruct operators to perform manual updates via the Google Cloud Console whenever state locks fail to release automatically during pipeline execution.

Answer

Store the Terraform state in a Google Cloud Storage bucket with Object Versioning enabled, rely on native GCS backend state locking, and authenticate the CI/CD pipeline using Workload Identity Federation with a dedicated, least-privilege service account.
The combination of a Cloud Storage remote backend with Object Versioning and native locking provides centralized, consistent, and recoverable state management. Paired with Workload Identity Federation, the CI/CD pipeline securely authenticates using short-lived credentials assigned to a least-privilege service account without requiring static key storage.

Step-by-Step Solution

1
Configure the remote backend using Cloud Storage with Object Versioning.
Terraform state history is retained, enabling seamless recovery in case of accidental modification or state file corruption.
Google Cloud Storage natively supports object versioning, satisfying the state recovery requirement.
2
Leverage GCS backend native state locking.
Concurrent pipeline executions are prevented from writing to the state file simultaneously.
The GCS backend uses Cloud Storage strongly consistent object updates to lock state during execution without requiring external locking databases.
3
Establish Workload Identity Federation for authentication.
The Cloud Build CI/CD pipeline authenticates securely using short-lived tokens without storing or managing long-lived service account key files.
Workload Identity Federation removes key management overhead and security risks associated with exported service account JSON keys.

Key Concept

Infrastructure as Code (IaC) Remote State Governance and Secure CI/CD Authentication
Rate this question

Topics

Building and Managing Infrastructure as Code (IaC)

More questions from this topic