Examkin

Question

Difficulty: Very hardImplementing Infrastructure as Code using Terraform and Deployment Manager

An enterprise organization is designing an automated IaC pipeline to manage multi-tenant infrastructure across hundreds of Google Cloud projects. The architecture team wants to allow feature teams to validate resource changes during continuous integration without permitting them to apply modifications directly or expose infrastructure state sensitive data. Additionally, deployment pipeline execution must strictly follow least-privilege access when creating and updating Google Cloud resources across target projects. Which IaC architecture and IAM configuration should you implement?

  1. Configure Cloud Storage remote backends with object versioning and state locking in a central management project. Grant feature team CI roles read-only access to plan outputs while executing Terraform runs using short-lived credentials via service account impersonation (`roles/iam.serviceAccountTokenCreator`) mapped to targeted predefined roles in workload projects.Answer
  2. B
    Store Terraform state files in local git repositories for local pipeline validation, and grant the CI pipeline service account the primitive Owner role (`roles/owner`) on all target GCP projects to eliminate permission errors during resource provisioning.
  3. C
    Grant feature team members the Service Account Admin role (`roles/iam.serviceAccountAdmin`) across target projects so the CI pipeline can create dedicated keys on demand for plan and apply stages.
  4. D
    Use unversioned Cloud Storage buckets for state files without object locking to maximize pipeline throughput, and submit regional quota increase requests only after plan validation failures occur.

Answer

The optimal architecture uses centralized Google Cloud Storage remote backends with versioning and object locking, combined with short-lived service account impersonation (`roles/iam.serviceAccountTokenCreator`) and least-privilege predefined roles in target projects.
Centralizing Terraform remote state in Google Cloud Storage with object versioning and state locking protects infrastructure state integrity. Implementing short-lived service account token creation allows automated pipelines to provision resources across target projects with least-privilege fine-grained roles without storing persistent service account keys.

Step-by-Step Solution

1
Centralize and secure Terraform remote state storage.
Configured Google Cloud Storage remote backends with object versioning and state locking enabled in a managed governance project.
Prevents state file corruption from concurrent pipeline operations and allows point-in-time recovery.
2
Configure short-lived credential delegation for multi-project provisioning.
Configured CI/CD pipeline workers to impersonate target project execution service accounts using `roles/iam.serviceAccountTokenCreator`.
Eliminates hardcoded long-lived service account keys and limits potential privilege escalation pathways.
3
Enforce least-privilege IAM permissions in workload projects.
Assigned specific, fine-grained predefined roles (e.g., Compute Network Admin, Storage Admin) to execution service accounts rather than primitive roles.
Ensures pipeline actions comply strictly with organizational enterprise security policy.

Key Concept

Infrastructure as Code Multi-Project Governance and Least-Privilege IAM Provisioning
Rate this question

Topics

Implementing Infrastructure as Code using Terraform and Deployment Manager

More questions from this topic