Examkin

Question

Difficulty: Very hardAnalyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines

A financial services firm utilizes a Cloud Build CI/CD pipeline to execute Terraform code that provisions microservices and database infrastructure across multiple Google Cloud projects. During release cycles, concurrent code merges from multiple engineering teams cause frequent Terraform state lock failures and pipeline build collisions. Additionally, developers have been downloading service account JSON keys to run terraform apply locally from their workstations to bypass pipeline queues. You need to redesign the CI/CD pipeline and SDLC process to eliminate state corruption, enforce execution order, and adhere to Google Cloud security best practices. Which solution should you implement?

  1. Configure a shared Cloud Storage backend with object versioning and state locking for Terraform, configure Cloud Build trigger concurrency limits to serialize deployment executions, and replace downloadable service account keys with Workload Identity Federation and service account impersonation.Answer
  2. B
    Maintain Terraform state files within the version-controlled application source repository, instruct developers to pull state changes before running deployments, and issue long-lived service account keys with specific permissions to developer workstations.
  3. C
    Assign the roles/iam.serviceAccountAdmin role to developers so they can generate and manage transient service account keys for local CLI deployments, and store Terraform state files in separate developer-owned Cloud Storage buckets.
  4. D
    Grant developers the primitive Editor role on the target GCP projects to allow direct manual intervention during build failures, and execute Cloud Build triggers simultaneously without concurrency limits to maximize build throughput.

Answer

Configure a shared Cloud Storage backend with object versioning and state locking for Terraform, configure Cloud Build trigger concurrency limits to serialize deployment executions, and replace downloadable service account keys with Workload Identity Federation and service account impersonation.
Centralizing Terraform state in Google Cloud Storage with object versioning and state locking guarantees atomic operations and prevents state corruption across concurrent runs. Configuring concurrency controls in Cloud Build serializes release execution, preventing race conditions during deployments. Utilizing Workload Identity Federation eliminates long-lived service account JSON keys by using short-lived, impersonated credentials.

Step-by-Step Solution

1
Analyze state management requirements for IaC in CI/CD
Identified that remote state locking via Cloud Storage backend with versioning prevents concurrent state modification and corruption.
Terraform requires centralized locking when multiple pipelines or developers execute changes against shared infrastructure.
2
Analyze pipeline concurrency and execution ordering
Determined that setting Cloud Build concurrency controls serializes execution runs.
Serializing build execution prevents race conditions when applying infrastructure changes from concurrent pull request merges.
3
Analyze authentication and identity security in the SDLC
Replaced static service account JSON key files with Workload Identity Federation and IAM service account impersonation.
Static keys represent high-risk security vulnerabilities; short-lived tokens via impersonation align with GCP security best practices.

Key Concept

CI/CD Pipeline Security and Infrastructure as Code (IaC) State Lock Optimization
Rate this question

Topics

Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines