Examkin

Question

Difficulty: MediumAnalyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines

A digital gaming studio is analyzing its continuous delivery pipeline on Google Cloud. The automated pipeline uses Cloud Build to execute Terraform manifests that provision compute clusters and database resources for new game instances. During an operational review, the team observes two major issues: concurrent pipeline runs occasionally overwrite each other's infrastructure changes causing state corruption, and the pipeline runs under an over-privileged security context. Which combination of architectural changes should the team implement to secure the pipeline and ensure infrastructure state integrity?

  1. Configure a dedicated custom service account for Cloud Build with least-privilege IAM roles, and configure Terraform to use a Cloud Storage remote backend with object versioning and state locking enabled.Answer
  2. B
    Assign the primitive Editor role to the default Cloud Build service account across the project, and store the Terraform state file within the temporary Cloud Build local workspace.
  3. C
    Grant the Service Account Admin role to developers triggering the pipeline, and store the Terraform state in an unversioned Cloud Storage bucket without state locking.
  4. D
    Configure VPC Service Controls to prevent data exfiltration from the build environment while retaining the primitive Owner role on the build service account without remote state locking.

Answer

The correct architecture requires configuring a custom service account for Cloud Build assigned minimal granular IAM roles needed for resource provisioning, alongside configuring Terraform to store state in a remote Cloud Storage backend with object versioning and state locking enabled.
Configuring a dedicated custom service account for Cloud Build bound to fine-grained predefined roles ensures least-privilege security control. Using a Cloud Storage remote backend with versioning and object locking prevents simultaneous pipeline executions from corrupting the Terraform state file.

Step-by-Step Solution

1
Analyze pipeline security requirements.
Identified that using primitive or over-privileged roles creates a security risk; replacing them with a dedicated custom service account adhering to least privilege isolates pipeline access.
Cloud Build should only possess the specific permissions necessary to create and manage targeted resources.
2
Analyze IaC state management requirements.
Identified that local build storage or unversioned state files cause state corruption during concurrent runs.
Cloud Storage remote backends support object locking (via backend state locking) to prevent race conditions and versioning to allow recovery.
3
Combine security and state management solutions.
Selected the option that pairs custom least-privilege service accounts with locked, versioned Cloud Storage backends.
This comprehensively addresses both identity security and infrastructure deployment reliability.

Key Concept

CI/CD Pipeline Security and Infrastructure as Code State Management Best Practices
Rate this question

Topics

Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines