An enterprise platform engineering team is configuring an automated Cloud Build pipeline to provision a isolated staging environment on Google Cloud using Terraform. Place the procedural steps in the correct order to execute a secure, reliable environment provisioning workflow following Google Cloud best practices.
- 1Authenticate the CI/CD pipeline worker using Workload Identity Federation to obtain short-lived credentials for the designated Terraform deployment service account.
- 2Execute `terraform init` to configure the Cloud Storage remote backend and acquire an exclusive state lock on the environment state file.
- 3Run `terraform plan -out=tfplan` to validate configuration syntax, analyze resource drift, and output a speculative execution plan artifact.
- 4Execute `terraform apply tfplan` to provision targeted GCP resources strictly according to the saved plan file.
- 5Run post-provisioning automated health checks against the environment endpoints and release the state lock upon successful verification.
Answer
The correct sequence for environment provisioning is: 1) Authenticate pipeline identity via Workload Identity Federation, 2) Initialize Terraform backend and acquire GCS state lock, 3) Generate a deterministic execution plan artifact, 4) Apply the saved execution plan artifact, and 5) Run post-deployment validation tests and release state locks.
The sequence follows GCP enterprise reliability best practices: establish identity authentication first via Workload Identity Federation, initialize the remote backend to lock state and prevent concurrent updates, generate a deterministic plan artifact to lock in expected changes, apply the exact plan artifact to provision resources, and complete post-provisioning integration testing before releasing state locks.
Step-by-Step Solution
Key Concept
Automated Environment Provisioning & IaC State Lifecycle
Estimated Time:1m 30s