Examkin

Question

Difficulty: HardContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

A financial enterprise is designing a Continuous Integration and Continuous Delivery (CI/CD) pipeline on Google Cloud using Cloud Build and Terraform to manage infrastructure deployments inside a restricted security environment governed by VPC Service Controls. The architecture team requires that the pipeline prevents configuration drift, protects state files against concurrency corruption and exfiltration, and strictly enforces the principle of least privilege. Which TWO architectural controls should be implemented in this CI/CD pipeline design? (Select TWO.)

  1. Store the Terraform state file in a Cloud Storage bucket configured with object versioning and state locking, executing builds via Cloud Build private worker pools inside the network perimeter.Answer
  2. Grant the Cloud Build trigger service account the Service Account User role (roles/iam.serviceAccountUser) on a dedicated custom deployment service account to perform resource provisioning through short-lived impersonation.Answer
  3. C
    Assign the primitive Owner role (roles/owner) directly to the Cloud Build default service account to prevent permission errors when provisioning complex multi-resource topologies.
  4. D
    Maintain the Terraform state file within the ephemeral container storage of the Cloud Build runner workspace to avoid external network calls and prevent state data exfiltration.

Answer

The optimal design requires storing Terraform state in a versioned Cloud Storage bucket with state locking while running builds on Cloud Build private worker pools inside the VPC Service Controls perimeter, and granting the build service account the Service Account User role to impersonate a dedicated deployment service account.
The correct approach combines secure remote state management with private network execution and fine-grained identity impersonation. Storing Terraform state in a Cloud Storage bucket with object versioning and state locking prevents state file corruption and concurrency conflicts during concurrent deployments. Executing Cloud Build builds on private worker pools allows secure deployment within a VPC Service Controls perimeter. Additionally, granting the Cloud Build build trigger service account the `roles/iam.serviceAccountUser` role on a dedicated deployment service account enables minimal, audited permission delegation through service account impersonation.

Step-by-Step Solution

1
Establish secure remote state management and network perimeter boundary for IaC execution.
Configuring a Cloud Storage remote backend with state locking and object versioning ensures concurrent apply operations do not corrupt state. Running Cloud Build on private worker pools satisfies VPC Service Controls compliance requirements.
VPC Service Controls block public Cloud Build pool traffic, requiring private worker pools peered to the VPC for internal resource provisioning.
2
Configure fine-grained IAM privilege separation for build execution.
The Cloud Build service account is granted `roles/iam.serviceAccountUser` on a specific target service account that possesses minimal required deployment permissions.
Impersonation prevents assigning permanent broad privileges directly to build pipeline identities, adhering to GCP security architecture best practices.

Key Concept

Secure CI/CD Pipeline Design with Cloud Build, IaC State Locking, and IAM Service Account Impersonation
Rate this question

Topics

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

More questions from this topic