Examkin

Question

Difficulty: HardInfrastructure as Code and Environment Provisioning

A financial services organization is automating its multi-region environment deployment pipeline using Terraform executed by Cloud Build. To adhere to Google Cloud operational reliability and security best practices, the pipeline must prevent state file corruption during concurrent automated runs and enforce least privilege during resource provisioning. The deployment worker currently needs to provision compute and network resources across multiple target projects. How should the Site Reliability Engineering (SRE) team configure the Terraform state storage and execution permissions?

  1. Configure a Cloud Storage backend with Object Versioning enabled for remote state storage, and use service account impersonation by granting the Cloud Build service account the Service Account Token Creator role on a dedicated provisioning service account assigned fine-grained IAM roles.Answer
  2. B
    Store the Terraform state files inside a Git repository managed directly within the pipeline workspace, using Git commits to track state changes and manage concurrent provisioning execution across environments.
  3. C
    Configure a Cloud Storage backend for remote state storage, and assign the Owner primitive IAM role directly to the Cloud Build service account across all managed GCP target projects to ensure execution authorization.
  4. D
    Configure a Cloud Storage backend for remote state storage, and grant the Cloud Build service account the Service Account Admin role on the target project service account so it can manage service account credentials directly during execution.

Answer

Configure a Cloud Storage backend with Object Versioning enabled for remote state storage, and use service account impersonation by granting the Cloud Build service account the Service Account Token Creator role on a dedicated provisioning service account assigned fine-grained IAM roles.
The combination of storing Terraform remote state in a Cloud Storage bucket with Object Versioning enabled and utilizing service account impersonation via the Service Account Token Creator role fulfills all security and reliability constraints. Cloud Storage natively handles lock acquisition to protect state files from concurrent mutation, while short-lived impersonation avoids long-lived service account keys and limits execution authority to fine-grained predefined roles assigned to the target service account.

Step-by-Step Solution

1
Evaluate Terraform state storage reliability requirements.
Identify that Cloud Storage backends provide automatic native object locking via Google Cloud Storage to prevent race conditions during concurrent runs, while Object Versioning allows recovery from corrupted state updates.
Local or repository-bound state storage lacks reliable locking semantics and exposes state sensitive data.
2
Assess identity and access management for automated CI/CD pipelines.
Determine that service account impersonation using the Service Account Token Creator role enables the build runner to acquire short-lived tokens for a dedicated deployment service account without relying on static service account keys or over-privileged roles.
Directly assigning broad roles (like Owner) or administrative roles (like Service Account Admin) breaks security perimeters and governance frameworks.

Key Concept

Reliable Infrastructure as Code environment provisioning requires remote state storage with object locking and versioning in Cloud Storage, combined with short-lived service account impersonation enforcing least privilege.
Rate this question

Topics

Infrastructure as Code and Environment Provisioning