A healthcare enterprise is designing a secure CI/CD pipeline on Google Cloud using Cloud Build to automate infrastructure changes via Terraform and deploy containerized services. The security architect specifies that the build process must prevent privilege escalation, avoid local configuration state loss, and restrict network traffic to internal resources. Which TWO architectural practices should the team implement to satisfy these security and reliability requirements? (Select TWO.)
- Execute pipeline builds using Cloud Build private pools peered with a VPC network to prevent public internet access and enforce network perimeter controls.Answer
- Configure a Cloud Storage remote backend with Object Versioning for Terraform state and require Cloud Build to use service account impersonation with fine-grained roles.Answer
- CGrant the Cloud Build service account the primitive Owner role and the Service Account Admin role across the project to ensure unrestricted resource creation capabilities.
- DSave the Terraform state file within the local transient workspace directory of the Cloud Build worker node to maximize execution speed and reduce storage API calls.
Answer
The team should execute builds using Cloud Build private pools peered to a VPC network and store Terraform state in a Cloud Storage remote backend with Object Versioning while enforcing service account impersonation.
Executing pipeline builds in Cloud Build private pools connected via VPC Network Peering guarantees private connectivity and strict perimeter security controls. Additionally, using Cloud Storage as a remote Terraform backend with versioning ensures durable, concurrent state tracking, while leveraging service account impersonation guarantees least-privilege security.
Step-by-Step Solution
Key Concept
Designing secure and resilient CI/CD pipelines with Cloud Build private pools, remote Terraform state locking, and least-privilege IAM impersonation.