Examkin

Question

Difficulty: HardContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

An enterprise logistics company is designing an automated Continuous Integration and Continuous Delivery (CI/CD) pipeline using Cloud Build and Terraform to provision infrastructure across separate Google Cloud projects for staging and production. The security architecture mandates strict least-privilege enforcement, zero static service account keys in the pipeline, and protection against Terraform state corruption or concurrent execution conflicts across environments. Which CI/CD architecture design meets all technical and security requirements?

  1. Configure Cloud Build triggers to impersonate dedicated environment-specific service accounts using short-lived credentials via IAM role impersonation, store Terraform state remotely in Cloud Storage buckets with Object Versioning enabled, and grant Cloud Build permissions to generate short-lived tokens.Answer
  2. B
    Grant the default Cloud Build service account the Editor primitive role across all target projects to streamline resource deployment, and store Terraform state files in local build worker storage during pipeline execution.
  3. C
    Grant developers the Service Account Admin role to allow pipeline customization, execute Cloud Build steps using local state files inside the build container filesystem, and commit state updates back to Git source control repositories.
  4. D
    Export JSON service account keys with Owner permissions, store them as encrypted Cloud Storage objects for Cloud Build steps to download during runtime, and persist state in unversioned Cloud Storage buckets.

Answer

Configure Cloud Build triggers to impersonate dedicated environment-specific service accounts using short-lived credentials via IAM role impersonation, store Terraform state remotely in Cloud Storage buckets with Object Versioning enabled, and grant Cloud Build permissions to generate short-lived tokens.
The optimal design pattern for Google Cloud CI/CD infrastructure pipelines uses short-lived credentials via IAM service account impersonation combined with remote state storage in Cloud Storage. Object Versioning and native GCS state locking prevent state file corruption during concurrent builds while upholding least-privilege security standards.

Step-by-Step Solution

1
Analyze security credential requirements for automated CI/CD infrastructure pipelines.
Avoid exporting static JSON service account keys or assigning broad primitive roles (such as Owner or Editor). Instead, use short-lived token impersonation (`roles/iam.serviceAccountTokenCreator`).
Short-lived credentials minimize blast radius and eliminate long-term credential leakage risks in build logs or storage.
2
Evaluate backend state storage design for multi-project Terraform deployments.
Configure Cloud Storage backends for Terraform remote state with Object Versioning and state locking enabled.
Remote state backends prevent concurrent pipeline executions from corrupting infrastructure state and allow rollback if state file corruption occurs.
3
Synthesize optimal toolchain integration.
Combine Cloud Build with environment-specific service account impersonation and version-controlled GCS state backends.
This guarantees zero static credentials, strict environment isolation, and reliable automated release execution.

Key Concept

Secure CI/CD IaC Pipeline Architecture with Service Account Impersonation and Remote State Backend Locking
Rate this question

Topics

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

More questions from this topic