Examkin

Question

Difficulty: HardImplementing Infrastructure as Code using Terraform and Deployment Manager

An enterprise architecture team is transitioning a critical Google Cloud infrastructure codebase from local execution to a centralized, collaborative Terraform model. To meet corporate security and operational standards, the team must migrate the local state file to a secure Google Cloud Storage (GCS) remote backend featuring state locking and least-privilege service account impersonation. Sequence the steps required to execute this state backend migration safely and correctly.

  1. 1Provision a Cloud Storage bucket with Object Versioning enabled, uniform bucket-level access, and restrictive IAM permissions.
  2. 2Add a backend "gcs" block to the Terraform configuration file specifying the target bucket name and state prefix.
  3. 3Configure short-lived Service Account impersonation parameters for authentication rather than using static key files.
  4. 4Run "terraform init -migrate-state" to acquire state locks and transfer existing state records from local disk to the remote GCS bucket.
  5. 5Execute "terraform plan" to verify state lock acquisition and confirm that no spurious resource changes are detected.

Answer

The correct operational sequence begins with provisioning and securing the target GCS bucket, adding the remote backend definition to the HCL configuration, establishing least-privilege service account impersonation, executing terraform init to migrate the state under state locks, and finally validating state integrity with terraform plan.
Migrating Terraform state safely requires creating the secured GCS storage resource first, configuring HCL backend settings, establishing IAM impersonation credentials, running terraform init to perform state transfer under state locks, and executing terraform plan to confirm operational readiness.

Step-by-Step Solution

1
Provision and secure the Google Cloud Storage bucket
A target GCS bucket exists with Object Versioning and uniform bucket-level access enabled to protect state integrity.
The GCS storage location must exist and be secured prior to pointing Terraform to it.
2
Configure the HCL backend block
The Terraform code declares the gcs backend with the target bucket and prefix.
Terraform needs backend configuration metadata to know where state data should be written.
3
Set up least-privilege Service Account impersonation
Authentication relies on short-lived service account tokens instead of persistent service account key files.
Impersonation must be configured before invoking initialization so state storage operations run under the correct identity.
4
Initialize the backend and migrate state
Terraform acquires a state lock on GCS and transfers the state content from local storage to the bucket.
The terraform init command detects backend changes and performs interactive or automated state migration.
5
Validate remote state operations
Terraform plan acquires the GCS lock, reads state, confirms zero unexpected drift, and releases the lock.
Post-migration verification ensures that remote lock acquisition works as expected and state corruption did not occur.

Key Concept

Remote Terraform State Management with GCS, Object Versioning, State Locking, and Service Account Impersonation
Rate this question

Topics

Implementing Infrastructure as Code using Terraform and Deployment Manager

More questions from this topic