Examkin

Question

Difficulty: MediumContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

A enterprise team is configuring an automated CI/CD pipeline on Google Cloud using Cloud Build and Cloud Deploy to automatically build container images and deliver service updates to Cloud Run. To satisfy corporate compliance mandates, the Cloud Build execution service account must be configured according to the principle of least privilege so that it can create releases in Cloud Deploy and act on behalf of the deployment service account without gaining unnecessary administrative rights. Which IAM permission configuration meets these security and pipeline requirements?

  1. Grant the Cloud Build service account the Cloud Deploy Releaser role (roles/clouddeploy.releaser) at the project level, and grant it the Service Account User role (roles/iam.serviceAccountUser) specifically on the dedicated Cloud Deploy execution service account.Answer
  2. B
    Grant the Cloud Build service account the primitive Owner role (roles/owner) at the GCP project level to ensure it has all required permissions to build images, manage Cloud Deploy releases, and update Cloud Run revisions.
  3. C
    Grant the Cloud Build service account the Service Account Admin role (roles/iam.serviceAccountAdmin) at the project level so it can manage service accounts and execute deployment operations.
  4. D
    Configure Cloud Build to save build artifacts and pipeline state files directly in unversioned local directory storage on the build worker instance to optimize execution speed.

Answer

Grant the Cloud Build service account the Cloud Deploy Releaser role (roles/clouddeploy.releaser) at the project level, and grant it the Service Account User role (roles/iam.serviceAccountUser) specifically on the dedicated Cloud Deploy execution service account.
The correct solution enforces the principle of least privilege. Granting the predefined Cloud Deploy Releaser role allows Cloud Build to create pipeline releases. Scoping the Service Account User role specifically to the target execution service account ensures that Cloud Build can pass that identity to Cloud Deploy without gaining access to other service accounts or administrative control.

Step-by-Step Solution

1
Identify the minimum predefined role required for Cloud Build to create releases in Cloud Deploy.
The Cloud Deploy Releaser role (roles/clouddeploy.releaser) provides necessary permissions to create and manage releases without full administrative privileges.
Following least privilege requires selecting predefined functional roles rather than primitive or administrative roles.
2
Determine the required IAM permission for Cloud Build to trigger execution under the deployment service account identity.
The Service Account User role (roles/iam.serviceAccountUser) must be granted to the Cloud Build service account on the specific Cloud Deploy execution service account.
This allows Cloud Build to impersonate or delegate execution to the designated service account without granting Service Account Admin or project-wide permissions.

Key Concept

Least Privilege IAM Role Binding in Cloud Build and Cloud Deploy Pipelines
Rate this question

Topics

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

More questions from this topic