A platform engineering team is automating the deployment of Google Cloud resources across multiple environments using an automated continuous integration pipeline. The security team mandates strict access controls and high resilience against state loss or concurrent execution conflicts. Which implementation approach satisfies these operational and security requirements?
- AMaintain state files locally on the persistent storage of the build runner to eliminate external network dependencies and decrease provisioning execution duration.
- BConfigure a Google Cloud Storage remote backend with versioning enabled, and grant the executing service account the primitive Owner role to prevent authorization failures during resource provisioning.
- Configure a Google Cloud Storage remote backend with object versioning and state locking enabled, and assign fine-grained predefined IAM roles to the executing service account.Answer
- DConfigure a Google Cloud Storage remote backend, and grant the deployment pipeline identity the Service Account Admin role so compute resources can run under dedicated service account credentials.
Answer
Configure a Google Cloud Storage remote backend with object versioning and state locking enabled, and assign fine-grained predefined IAM roles to the executing service account.
The option specifying a Google Cloud Storage remote backend with object versioning and state locking combined with fine-grained predefined IAM roles represents the Cloud Architect best practice for infrastructure as code automation. Google Cloud Storage natively supports state locking via state file generation checks, versioning provides a fallback safety net for state recovery, and least-privilege predefined roles maintain enterprise security standards.
Step-by-Step Solution
Key Concept
Terraform Remote State Management and IAM Least Privilege on GCP