An enterprise logistics firm manages its Google Cloud infrastructure using Terraform across multiple environments. The cloud architecture team must secure the automated deployment pipeline, enforce least-privilege access control, and protect against state file corruption and configuration drift. Which TWO actions should the engineering team implement to meet these requirements? (Select TWO.)
- Configure a Cloud Storage bucket with Object Versioning enabled as the remote backend to store the Terraform state file securely.Answer
- Use Workload Identity Federation with fine-grained IAM roles to authenticate the CI/CD runner to Google Cloud without storing long-lived service account keys.Answer
- CStore the Terraform state file locally on the CI/CD build worker disk to eliminate cloud network latency during execution.
- DAssign the primitive Owner IAM role to the service account used by the CI/CD pipeline to prevent permission errors during deployment.
- EApply critical infrastructure changes manually in the Google Cloud Console first and skip modifying Terraform configurations to save operational time.
Answer
The engineering team should configure a Cloud Storage bucket with Object Versioning as the remote backend and authenticate the CI/CD pipeline using Workload Identity Federation with fine-grained IAM roles.
Configuring a Cloud Storage bucket with Object Versioning provides remote backend state locking, concurrency protection, and version recovery. Utilizing Workload Identity Federation with fine-grained IAM roles allows the CI/CD pipeline to authenticate securely without storing static service account keys while enforcing least-privilege security.
Step-by-Step Solution
Key Concept
Terraform Remote State Backend Security and CI/CD Keyless Authentication