Examkin

Question

Difficulty: MediumImplementing Infrastructure as Code using Terraform and Deployment Manager

A DevOps team is setting up an automated Continuous Integration/Continuous Deployment (CI/CD) pipeline using HashiCorp Terraform to provision infrastructure in Google Cloud. Multiple automated jobs and team members will execute Terraform deployments concurrently across shared environments. You need to configure a remote backend that prevents state file corruption from concurrent writes, maintains history for disaster recovery, and enforces least-privilege security access. Which solution should you implement?

  1. Store the Terraform state in a Google Cloud Storage bucket with Object Versioning enabled, configure the Terraform `gcs` backend to handle state locking automatically, and authenticate using fine-grained IAM roles via service account impersonation.Answer
  2. B
    Store the Terraform state file in a standard Cloud Storage bucket without versioning, relying on developers to maintain manual local state file backups prior to executing deployment runs.
  3. C
    Configure a Cloud Storage remote backend and assign the primitive Project Owner IAM role to the CI/CD execution service account to eliminate permission errors during backend initialization and state updates.
  4. D
    Configure the Terraform backend to use Cloud Storage and configure automated script retries in the CI/CD pipeline to resolve regional quota availability failures during execution.

Answer

The correct architecture uses a Google Cloud Storage remote backend with Object Versioning enabled, Terraform's native `gcs` backend for automatic state locking, and fine-grained IAM permissions using service account impersonation.
Configuring a Cloud Storage bucket with Object Versioning combined with Terraform's native `gcs` backend ensures state locking prevents concurrent modification while enabling historical state recovery. Authenticating using least-privilege predefined IAM roles aligns with Google Cloud security best practices.

Step-by-Step Solution

1
Configure a dedicated Google Cloud Storage bucket for Terraform remote state with Object Versioning enabled.
Every state modification creates a historical version, enabling point-in-time recovery from accidental state corruption.
Object Versioning protects critical state history in shared enterprise environments.
2
Set the Terraform backend configuration to `gcs` referencing the versioned bucket.
Terraform automatically leverages GCP object locking mechanisms to lock the state file during operations.
State locking prevents race conditions and state file corruption caused by concurrent pipeline executions.
3
Grant the CI/CD service account granular IAM roles (predefined storage and resource administration roles) rather than primitive roles.
Terraform runs securely under least-privilege access controls.
Limits exposure and prevents unauthorized administrative actions across the GCP project.

Key Concept

Enterprise Terraform Remote State Management on Google Cloud Storage
Rate this question

Topics

Implementing Infrastructure as Code using Terraform and Deployment Manager

More questions from this topic