Examkin

Question

Difficulty: Very hardContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

An enterprise architecture team is designing an automated CI/CD pipeline on Google Cloud using Cloud Build to provision infrastructure via Terraform across multiple landing zone projects. The governance team mandates three strict security and operational constraints:
1. Build execution and state management must occur within an isolated network perimeter to prevent arbitrary internet access and exfiltration of state data.
2. Terraform state must be protected against concurrency conflicts and inadvertent corruption during parallel pipeline executions.
3. Developers triggering pipeline runs must be able to initiate deployments without being granted administrative access over the execution service accounts or direct write permissions on target project resources.

Which TWO architectural decisions and IAM security controls should the architect implement to satisfy these requirements? (Select TWO.)

  1. Run build steps using Cloud Build Private Pools peered with a private VPC enclosed inside a VPC Service Controls perimeter, and configure the Terraform backend using Cloud Storage with Object Versioning and state locking enabled.Answer
  2. B
    Grant developers the Service Account Admin role (roles/iam.serviceAccountAdmin) on the deployment service account so the CI/CD pipeline can dynamically create, attach, and rotate service account keys during build execution.
  3. Assign the Service Account User role (roles/iam.serviceAccountUser) on the dedicated deployment service account to the Cloud Build service agent, while granting developers only the Cloud Build Build Editor role to submit triggers.Answer
  4. D
    Assign the primitive Owner role (roles/owner) to the Cloud Build execution service account across all target projects to ensure unhindered resource creation during pipeline runs.

Answer

The architect should configure Cloud Build Private Pools inside a VPC Service Controls perimeter paired with a Cloud Storage backend leveraging state locking and object versioning, and grant the Service Account User role on the execution identity specifically to the Cloud Build service identity while granting developers only Cloud Build trigger execution roles.
Secure deployment pipeline design on Google Cloud requires separating developer execution privileges from resource management privileges, isolating worker infrastructure, and ensuring state integrity. Utilizing Cloud Build Private Pools peered to a VPC within a VPC Service Controls perimeter satisfies network isolation and prevents exfiltration of sensitive infrastructure code and state data. Remote state stored in Cloud Storage with Object Versioning and state locking guarantees protection against concurrent mutation. Using service account impersonation by granting `roles/iam.serviceAccountUser` to the Cloud Build service agent ensures developers only trigger builds without direct rights to target resources or service account management.

Step-by-Step Solution

1
Evaluate network isolation and exfiltration controls for build runners.
Identify that default Cloud Build public worker pools cannot connect to private VPC networks without Private Pools. Enclosing Private Pools inside a VPC Service Controls perimeter enforces strict network boundaries against data exfiltration.
Meets the first requirement for isolated network build execution.
2
Establish secure Infrastructure as Code (IaC) state backend governance.
Configure Cloud Storage with Object Versioning and state locking enabled for the Terraform backend.
Prevents race conditions, state file corruption from simultaneous applies, and enables rollback to previous state versions if needed.
3
Configure least-privilege IAM access control for developer triggers and service account impersonation.
Grant developers minimal roles (Cloud Build Build Editor) to execute pipeline triggers. Grant `roles/iam.serviceAccountUser` on the target deployment service account to the Cloud Build service agent.
Allows Cloud Build to impersonate the deployment identity securely without granting developers direct administrative privileges over service accounts or target infrastructure.

Key Concept

Enterprise CI/CD Security with Cloud Build Private Pools, Remote Terraform State Locking, and IAM Service Account Impersonation
Rate this question

Topics

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

More questions from this topic