Examkin

Question

Difficulty: MediumAutomating Continuous Deployment Pipelines and Release Strategies

A telecommunications enterprise is implementing Google Cloud Deploy to automate release management for stateless customer portal services on Cloud Run. The security governance policy dictates that deployment automation must strictly adhere to least-privilege principles: release engineers must be allowed to create releases and approve promotions between staging and production environments, but they must not hold direct administrative control over target Cloud Run resources or possess rights to manage IAM service account keys. Which pipeline configuration fulfills these security and delivery requirements?

  1. Configure Cloud Deploy delivery pipelines with dedicated execution service accounts holding the Cloud Deploy Job Runner role, and assign release engineers the Cloud Deploy Releaser role to approve promotions via the Cloud Deploy API.Answer
  2. B
    Grant the primitive Owner role to the Cloud Deploy pipeline execution service account so that deployment operations do not fail when provisioning new Cloud Run revisions in production.
  3. C
    Assign the Service Account Admin role directly to release engineers so they can create and download key files locally to execute pipeline steps under the runner identity.
  4. D
    Migrate the stateless microservices from Cloud Run to a dedicated multi-zone GKE Enterprise cluster with an installed Service Mesh to manage release pipelines.

Answer

Configure Cloud Deploy delivery pipelines with dedicated execution service accounts holding the Cloud Deploy Job Runner role, and assign release engineers the Cloud Deploy Releaser role to approve promotions via the Cloud Deploy API.
The correct strategy leverages Google Cloud Deploy's native IAM architecture. By granting release engineers the Cloud Deploy Releaser role (`roles/clouddeploy.releaser`), they can initiate releases and approve stage promotions through Cloud Deploy APIs without direct IAM access to the underlying Cloud Run instances. Cloud Deploy performs the actual rendering and deployment operations using a dedicated service account configured with the Cloud Deploy Job Runner role (`roles/clouddeploy.jobRunner`), satisfying strict governance and least-privilege requirements.

Step-by-Step Solution

1
Analyze security and operational constraints for the deployment pipeline.
Identified the requirement to separate human approval privileges from execution identity privileges without granting administrative access to target environments.
Security policy prohibits engineers from having direct resource modification or key management rights in production.
2
Evaluate Google Cloud Deploy IAM architecture.
Cloud Deploy uses execution service accounts with `roles/clouddeploy.jobRunner` for target resource deployment, while human users interact with `roles/clouddeploy.releaser` to trigger releases and approve rollouts.
This configuration provides role separation and enforces fine-grained access control across environment stages.
3
Select the option that configures proper Cloud Deploy IAM roles without unnecessary infrastructure overhead or over-privileged roles.
The configuration using dedicated execution service accounts with Job Runner permissions combined with Releaser roles for engineers satisfies all security constraints.
It achieves automated deployment with strict compliance to least privilege principles.

Key Concept

Least-Privilege Security Model in Continuous Deployment Pipelines
Estimated Time:1m 30s
Rate this question

Topics

Automating Continuous Deployment Pipelines and Release Strategies