An industrial telemetry platform manages its Google Cloud infrastructure using Terraform within a automated CI/CD pipeline. The lead cloud architect must ensure that infrastructure provisioning is secure, resilient against concurrent execution conflicts, and adheres to the principle of least privilege during deployment. Which TWO strategies should the architect implement to meet these requirements? (Select TWO.)
- Configure the Terraform backend to use a Google Cloud Storage bucket with object versioning and state locking enabled via standard Cloud Storage backend configuration.Answer
- BStore the Terraform state files on the local disk of the CI/CD runner instance to accelerate deployment performance and eliminate cloud storage network overhead.
- Configure the CI/CD execution pipeline to impersonate a dedicated service account granted only the specific predefined roles necessary for the managed resources.Answer
- DAssign the primitive Editor IAM role to the CI/CD service account to ensure provisioning scripts do not fail due to missing resource permissions.
- EAllow developers to make urgent manual modifications directly in the Google Cloud Console and automatically overwrite state files without running terraform plan.
Answer
The architect should configure the Terraform backend to use a Google Cloud Storage bucket with object versioning and state locking enabled, and configure the CI/CD pipeline to impersonate a dedicated service account granted minimal predefined IAM roles.
Configuring a Cloud Storage backend with versioning and object locking ensures safe collaborative IaC workflows without state corruption. Using fine-grained predefined roles with service account impersonation guarantees least-privilege security for automated pipelines.
Step-by-Step Solution
Key Concept
Terraform State Backend Security and CI/CD IAM Governance