Examkin

Question

Difficulty: HardImplementing Infrastructure as Code using Terraform and Deployment Manager

A Lead Cloud Architect is designing an automated CI/CD pipeline using Google Cloud Build and Terraform to provision infrastructure across multiple enterprise Google Cloud projects. Security compliance requires eliminating long-lived service account JSON keys while maintaining strict adherence to the principle of least privilege. The pipeline running in a central management project must provision compute and networking resources inside target workload projects. Which authentication and IAM delegation strategy should you implement?

  1. Grant the Cloud Build service account the roles/iam.serviceAccountTokenCreator role on dedicated deployment service accounts in each target project, configure Terraform to use short-lived credential impersonation, and assign fine-grained predefined roles to the target service accounts.Answer
  2. B
    Grant the central Cloud Build service account the roles/iam.serviceAccountAdmin role across all target projects so Terraform can dynamically elevate permissions and manage target service accounts during execution.
  3. C
    Grant the central Cloud Build service account the primitive roles/owner role at the organization level so Terraform has full resource creation authority across all current and future target projects.
  4. D
    Configure the pipeline script to dynamically generate service account JSON keys at build start, store them in the local Terraform workspace, and delete them immediately after terraform apply finishes.

Answer

Grant the Cloud Build service account the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on target project deployment service accounts, configure Terraform Google provider service account impersonation, and assign specific predefined roles to the target deployment service accounts.
The correct approach leverages native GCP IAM service account impersonation by granting `roles/iam.serviceAccountTokenCreator` on target service accounts to the central Cloud Build service account. Terraform's Google provider natively supports `alias` blocks with `access_token` impersonation, allowing completely keyless pipeline authentication that strictly obeys least-privilege principles.

Step-by-Step Solution

1
Identify the keyless authentication requirement for enterprise CI/CD pipelines.
Avoid downloading or storing static service account JSON key files.
Static service account keys present high security risks related to credential leakages and key rotation management overhead.
2
Configure IAM delegation using Service Account Impersonation.
Cloud Build service account impersonates target deployment service accounts using short-lived tokens.
Granting `roles/iam.serviceAccountTokenCreator` on specific target service accounts allows short-lived token acquisition without exposing raw key credentials.
3
Apply least-privilege permissions to target deployment service accounts.
Target service accounts possess only the fine-grained predefined IAM roles necessary to provision specific resources within target projects.
Ensures central pipeline operations strictly conform to least privilege without using primitive roles or overly broad administrative access.

Key Concept

Keyless IAM Service Account Impersonation in Terraform CI/CD Pipelines
Rate this question

Topics

Implementing Infrastructure as Code using Terraform and Deployment Manager

More questions from this topic