Examkin

Question

Difficulty: HardBuilding and Managing Infrastructure as Code (IaC)

A security engineer at a financial technology company performed emergency out-of-band updates to a Cloud Storage bucket retention policy and Cloud KMS encryption settings using the Google Cloud Console to mitigate an active security alert. The infrastructure was originally provisioned and managed via Terraform within a Cloud Build CI/CD pipeline. During the next scheduled deployment pipeline run, `terraform plan` detects configuration drift and proposes modifying the bucket settings back to their previous state, which would violate current security compliance requirements. The team needs to align the Terraform code and state with the live GCP infrastructure without causing service disruption or deleting existing data. Which approach should the cloud architecture team follow to resolve this drift safely?

  1. Update the local Terraform configuration files to match the emergency manual changes made in the Cloud Console, execute `terraform plan` to confirm zero changes will be made, and commit the updated code to version control.Answer
  2. B
    Execute `terraform apply` using the existing pipeline configuration to force overwrite the manual changes, then re-apply the emergency security settings manually through the GCP Console.
  3. C
    Delete the remote Terraform state file object stored in Cloud Storage and re-run `terraform init` and `terraform apply` to rebuild the state file automatically from live resources.
  4. D
    Grant the deployment service account the Owner primitive IAM role and run `gcloud storage` commands directly within the pipeline to override the state verification step.

Answer

The team should update the Terraform HCL codebase to reflect the manual emergency modifications, run a plan to verify no infrastructure changes are detected, and commit the updated configuration to source control.
When emergency or out-of-band modifications must be preserved permanently for security compliance, the correct standard operational procedure in Infrastructure as Code is to update the Terraform configuration files to match the live state. Running a subsequent plan confirms zero proposed changes, after which committing the code restores git as the single source of truth.

Step-by-Step Solution

1
Inspect the live infrastructure parameters created during the emergency response using gcloud or GCP Console.
Identified exact configuration attributes applied out-of-band to Cloud Storage retention policies and Cloud KMS keys.
Accurate details are necessary to update the declarative IaC definitions precisely.
2
Modify the Terraform resource definitions in the version-controlled repository to match the updated live settings.
Terraform configuration files match real-world cloud resource states.
Bringing code into alignment with live state is the standard declarative reconciliation method for intentional drift.
3
Run `terraform plan` in the CI/CD pipeline.
Terraform outputs 'No changes. Your infrastructure matches the configuration.'
Verifies that state, code, and actual infrastructure are fully synchronized without triggering resource destruction or modification.

Key Concept

Remediating Intentional Infrastructure Drift in Terraform
Rate this question

Topics

Building and Managing Infrastructure as Code (IaC)

More questions from this topic