Examkin

Question

Difficulty: MediumContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

A digital banking enterprise is designing an automated infrastructure deployment pipeline using Cloud Build and Terraform across multiple Google Cloud projects. The architecture team requires that the pipeline prevents configuration state loss and adheres to strict least-privilege security principles during execution. Which architecture design approach should the team implement?

  1. Configure Cloud Build to store Terraform state in a Cloud Storage backend with object versioning enabled, and grant the build worker service account the Service Account User role to impersonate a dedicated deployment service account.Answer
  2. B
    Assign the primitive Editor role to the default Cloud Build service account across all target projects to ensure unrestricted access for executing Terraform resource provisioning.
  3. C
    Grant the Cloud Build service account the Service Account Admin role so the pipeline can dynamically create and manage specialized runtime service accounts for each build step.
  4. D
    Store the Terraform state file in local ephemeral storage within the Cloud Build workspace directory between build steps to minimize remote API calls during plan and apply execution.

Answer

Configure Cloud Build to store Terraform state in a Cloud Storage backend with object versioning enabled, and grant the build worker service account the Service Account User role to impersonate a dedicated deployment service account.
Storing state in a central Cloud Storage bucket with object versioning provides state locking, persistence, and recovery capability. Delegating execution by granting the `roles/iam.serviceAccountUser` role enables service account impersonation of a dedicated, fine-grained deployment service account, ensuring adherence to the principle of least privilege.

Step-by-Step Solution

1
Evaluate state storage requirements for Infrastructure as Code (IaC) in CI/CD pipelines.
Identify that Cloud Storage backends with versioning provide remote locking, persistence, and audit recovery for state files across automated runs.
Ephemeral local storage within build runners is discarded after execution completes.
2
Evaluate access control and service account privileges for pipeline execution.
Determine that the Cloud Build execution runner requires `roles/iam.serviceAccountUser` on a specific deployment service account to impersonate that account during deployment.
Primitive roles like Editor or administrative identities like Service Account Admin grant excessive, high-risk administrative privileges.

Key Concept

Secure CI/CD Pipeline Architecture for Infrastructure as Code
Estimated Time:1m 30s
Rate this question

Topics

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

More questions from this topic