Examkin

Question

Difficulty: MediumAssessing and Mitigating Technical Debt in Cloud Architectures

A digital news publishing company rapidly migrated its microservices to Google Cloud to meet a tight launch deadline. A post-launch architectural assessment reveals significant technical debt: development teams have been making out-of-band manual configuration changes directly in the Cloud Console, resulting in severe infrastructure drift, and compute workloads rely on the default compute service account equipped with the primitive Editor role. You need to establish automated infrastructure governance and remediate this technical debt while ensuring minimal operational disruption. Which strategy should you recommend?

  1. Import existing cloud resources into Terraform state using infrastructure-as-code import workflows, enforce all future updates through an automated CI/CD pipeline, and replace primitive service account permissions with specific predefined roles based on least privilege.Answer
  2. B
    Allow teams to continue using manual Cloud Console modifications for rapid emergency updates while managing only new infrastructure using Terraform scripts, and preserve the primitive Editor role to avoid unexpected service disruptions.
  3. C
    Replace service accounts entirely by embedding individual service account JSON keys directly into application source code, and configure Cloud Monitoring alerts to flag manual console edits after they occur.
  4. D
    Migrate all basic virtual machine workloads onto a multi-region Google Kubernetes Engine Enterprise cluster with Service Mesh to automatically detect and revert manual Cloud Console configuration drift.

Answer

Import existing cloud resources into declarative IaC state files, route all changes through automated deployment pipelines, and replace broad primitive Editor roles with granular predefined IAM roles following least privilege.
The optimal strategy for mitigating technical debt from rapid cloud adoption involves adopting declarative Infrastructure as Code (such as Terraform) by importing existing resources, automating updates via CI/CD, and auditing permissions to replace primitive roles with minimal predefined IAM roles. This establishes sustainable governance and enforces security best practices.

Step-by-Step Solution

1
Assess current technical debt sources
Identified two core areas of debt: unmanaged manual console changes (configuration drift) and excessive IAM privileges (primitive Editor role on service accounts).
Technical debt mitigation requires addressing both operational governance and security vulnerabilities systematically.
2
Bring existing infrastructure under automated control
Import unmanaged GCP resources into Terraform state and restrict modification rights strictly to CI/CD service accounts.
Declarative Infrastructure as Code managed via continuous deployment pipelines prevents configuration drift and establishes an auditable single source of truth.
3
Remediate service account security debt
Audit workload permission requirements and grant minimum necessary predefined or custom IAM roles.
Replacing primitive roles with fine-grained roles enforces the principle of least privilege and reduces potential blast radius.

Key Concept

Technical Debt Mitigation via Infrastructure as Code Governance and IAM Least Privilege
Estimated Time:1m 30s
Rate this question

Topics

Assessing and Mitigating Technical Debt in Cloud Architectures