Examkin

Question

Difficulty: MediumImplementing Infrastructure as Code using Terraform and Deployment Manager

A financial software firm uses Cloud Build pipelines to execute Terraform configurations across multiple Google Cloud projects. During continuous integration test runs, concurrent pipeline executions intermittently corrupt infrastructure state tracking. Additionally, security audits revealed that the pipeline's service account uses the primitive Editor role. You need to redesign the execution environment to enforce state concurrency locking, state recovery, and least-privilege security controls. Which set of configurations should you implement?

  1. Configure a Cloud Storage backend with object versioning enabled on the bucket, and grant the Cloud Build service account minimal predefined or custom IAM roles required for the target resources.Answer
  2. B
    Store Terraform state files locally inside the Cloud Build ephemeral workspace, and enforce git branch locking to prevent parallel deployment conflicts.
  3. C
    Configure a Cloud Storage backend with object versioning enabled, and assign the primitive Owner role to the Cloud Build service account to prevent permission failures during provisioning.
  4. D
    Grant developer user accounts the Service Account Admin role (roles/iam.serviceAccountAdmin) to let them generate service account keys locally and bypass pipeline permissions.

Answer

Configure a Cloud Storage backend with object versioning enabled on the bucket, and grant the Cloud Build service account minimal predefined or custom IAM roles required for the target resources.
The correct configuration uses Google Cloud Storage as a remote backend for Terraform state, enabling automatic state locking and object versioning for state safety and recovery. Additionally, it enforces least-privilege access by assigning minimal predefined or fine-grained custom IAM roles to the Cloud Build service account rather than broad primitive roles.

Step-by-Step Solution

1
Select a remote state backend supporting state locking and versioning.
Configuring the Google Cloud Storage (`gcs`) backend ensures state files are locked automatically during `terraform apply` operations, preventing race conditions and file corruption.
Local workspace storage in temporary CI runners loses state between runs and cannot lock concurrent executions.
2
Enable object versioning on the designated Cloud Storage state bucket.
Enables historical state retention and recovery in case of accidental corruption or invalid state updates.
Object versioning safeguards against state file corruption or destructive manual modifications.
3
Apply principle of least privilege to the Cloud Build service account.
Replace primitive Editor or Owner roles with narrow predefined or custom IAM roles specific to the infrastructure being managed.
Primitive roles grant excessive project-wide privileges, violating security compliance standards.

Key Concept

Terraform Cloud Storage backend state locking, state versioning, and IAM least-privilege automation service account management.
Estimated Time:1m 30s
Rate this question

Topics

Implementing Infrastructure as Code using Terraform and Deployment Manager

More questions from this topic