Examkin

Question

Difficulty: EasyBuilding and Managing Infrastructure as Code (IaC)

A cloud engineering team is adopting Terraform to manage infrastructure deployments on Google Cloud. Multiple team members will be executing Terraform configurations simultaneously. Which deployment pattern is the Google Cloud recommended best practice for storing and managing the Terraform state file safely?

  1. Store the state file in a Google Cloud Storage (GCS) bucket configured as a remote backend with Object Versioning enabled.Answer
  2. B
    Keep state files on local developer workstations and commit updated state files to a central Git version control repository after each apply.
  3. C
    Apply modifications manually using the Google Cloud Console first, then rely on terraform refresh to update the local state file.
  4. D
    Grant the primitive Owner role to all deployment service accounts to bypass bucket-level IAM permission checks when reading state files.

Answer

Store the state file in a Google Cloud Storage (GCS) bucket configured as a remote backend with Object Versioning enabled.
Configuring a Google Cloud Storage (GCS) bucket as the remote backend is the standard best practice for Terraform on GCP. GCS supports native state locking using Cloud Storage lock objects, ensuring that simultaneous executions do not corrupt the state. Enabling Object Versioning allows teams to rollback to previous state versions if needed.

Step-by-Step Solution

1
Identify the multi-developer concurrency requirement for IaC management.
Recognize that local state storage cannot guarantee lock synchronization or state integrity across multiple operators.
Simultaneous runs against a un-locked state file cause state corruption.
2
Evaluate remote backend capabilities in Google Cloud.
Determine that Google Cloud Storage natively supports object locking and state locking via the GCS backend.
GCS backend automatically handles distributed locking to allow only one operator to modify state at a time.
3
Apply security and reliability best practices.
Enable GCS Object Versioning to allow state history recovery and restrict bucket access using minimal required IAM roles.
Object Versioning protects against accidental state destruction or invalid modifications.

Key Concept

Building and Managing Infrastructure as Code (IaC) Remote State Management
Rate this question

Topics

Building and Managing Infrastructure as Code (IaC)

More questions from this topic