Examkin

Question

Difficulty: MediumAnalyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines

An organization is reviewing its CI/CD pipeline automation for deploying microservices to Cloud Run. During an internal SDLC security audit, the team discovers that the Cloud Build pipeline runs under a service account granted the Owner primitive role across the target Google Cloud project. To enforce least-privilege security controls while maintaining automated pipeline deployments, which configuration change should the Cloud Architect recommend?

  1. Configure Cloud Build build triggers to execute using a dedicated user-managed service account assigned only the specific predefined roles required to build artifacts and deploy to Cloud Run.Answer
  2. B
    Replace the Owner role on the default Cloud Build service account with the Editor primitive role to reduce administrative scope across the project.
  3. C
    Grant the Service Account Admin role to pipeline developers so they can directly impersonate and manage the Cloud Build execution identity.
  4. D
    Maintain the project-level Owner permissions on the service account and implement VPC Service Controls to prevent unauthorized resource modifications.

Answer

Configure Cloud Build triggers to execute using a dedicated user-managed service account assigned only the specific predefined roles required to build artifacts and deploy to Cloud Run.
Configuring Cloud Build triggers to use a custom user-managed service account with fine-grained predefined roles satisfies least-privilege access requirements while allowing automated build and deployment workflows.

Step-by-Step Solution

1
Identify the security risk in the current SDLC pipeline setup.
The pipeline service account currently holds the primitive Owner role, which grants broad, unsafe permissions across the entire GCP project.
CI/CD execution identities should strictly follow the principle of least privilege.
2
Evaluate GCP identity architecture options for Cloud Build.
Cloud Build supports attaching custom, user-managed service accounts to build triggers rather than relying on default identities with overly broad privileges.
User-managed service accounts allow scoping permissions specifically to the build and deployment targets.
3
Assign fine-grained predefined roles.
Grant only necessary roles (e.g., roles/run.developer, roles/artifactregistry.writer, roles/iam.serviceAccountUser) to the dedicated service account.
This maintains automated deployment capabilities while satisfying compliance and audit requirements.

Key Concept

Least-Privilege Pipeline Execution with User-Managed Service Accounts
Rate this question

Topics

Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines