Examkin

Question

Difficulty: MediumBuilding and Managing Infrastructure as Code (IaC)

A media streaming organization provisions its Google Cloud infrastructure using Terraform. During an operational review, the DevOps team discovers that engineers manually modified VPC firewall rules and Cloud Storage bucket access controls directly via the Google Cloud Console to address emergency hotfixes. Consequently, subsequent automated Terraform deployment pipelines are failing due to configuration drift. Which strategy should a cloud architect implement to safely resolve the configuration drift and prevent future unauthorized manual modifications?

  1. Reconcile the configuration drift using terraform plan and refresh, update code or state to reflect approved states, and revoke direct compute write permissions from developers while routing all changes through automated CI/CD pipelines.Answer
  2. B
    Instruct developers to continue making emergency manual modifications in the Console and append the -lock=false flag to pipeline deployment scripts to prevent state locking errors.
  3. C
    Delete the remote Terraform state file stored in Cloud Storage and re-initialize fresh state files on local developer workstations to match current infrastructure settings.
  4. D
    Grant the primitive Owner role to all developer IAM user accounts so manual Console changes automatically update the remote state file without triggering pipeline errors.

Answer

Reconcile configuration drift using terraform plan and refresh, update the Terraform code to align with authorized infrastructure changes, and enforce automated CI/CD execution while revoking direct manual write access.
Reconciling drift by executing plan operations, updating configuration files to match legitimate changes, and restricting interactive manual write privileges via IAM enforces strict Infrastructure as Code governance and ensures all cloud resource changes remain repeatable and version-controlled.

Step-by-Step Solution

1
Detect and analyze configuration drift
Identify out-of-band changes made via the Cloud Console using execution plans and refresh commands.
Before modifying state or code, the exact disparity between remote GCP state and code definitions must be understood.
2
Reconcile IaC code and state
Update Terraform code definitions for valid hotfixes or import/revert out-of-band modifications.
Bringing configuration files in sync with desired infrastructure establishes a clean baseline.
3
Enforce IAM access controls and pipeline governance
Restrict interactive administrative write permissions from developer accounts and enforce deployment via scoped CI/CD pipelines.
Preventing direct manual edits eliminates future configuration drift and enforces auditable deployment processes.

Key Concept

IaC Drift Detection, State Reconciliation, and Governance
Rate this question

Topics

Building and Managing Infrastructure as Code (IaC)

More questions from this topic