Examkin

Question

Difficulty: HardContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

A global media organization is establishing a centralized CI/CD pipeline using Cloud Build, Artifact Registry, and Cloud Deploy to deliver microservices to GKE clusters. The enterprise security policy enforces two strict constraints: first, build workers must operate without public internet exposure and be prevented from exfiltrating source code or build artifacts to external Google Cloud projects; second, build and deployment execution identities must adhere to strict least-privilege principles without administrative rights over IAM service accounts. Which pipeline architecture and security configuration satisfies these requirements?

  1. Execute build jobs using Cloud Build Private Pools enclosed within a VPC Service Controls perimeter, establish separate dedicated service accounts for Cloud Build and Cloud Deploy pipelines, and grant the Cloud Deploy worker service account the Service Account User role (roles/iam.serviceAccountUser) on the target GKE runtime service account.Answer
  2. B
    Execute build jobs using default Cloud Build worker pools with VPC Peering, and assign the primitive Editor role (roles/editor) to the Cloud Build service account to ensure seamless provisioning and deployment across all target environments.
  3. C
    Execute build jobs inside Cloud Build Private Pools, and grant the pipeline service account the Service Account Admin role (roles/iam.serviceAccountAdmin) so the build runner can dynamically generate and impersonate short-lived credentials during release delivery.
  4. D
    Execute build jobs using default Cloud Build pools protected by IAM condition bindings, relying solely on Cloud Audit Logs to monitor and alert on potential code exfiltration to unauthorized storage buckets.

Answer

Execute build jobs using Cloud Build Private Pools enclosed within a VPC Service Controls perimeter, establish separate dedicated service accounts for Cloud Build and Cloud Deploy pipelines, and grant the Cloud Deploy worker service account the Service Account User role (roles/iam.serviceAccountUser) on the target GKE runtime service account.
Designing secure cloud native CI/CD pipelines on GCP requires combining VPC Service Controls with private build infrastructure and fine-grained IAM controls. Cloud Build Private Pools run inside a private VPC network within a VPC Service Controls boundary, preventing unauthorized exfiltration of intellectual property and source code. Additionally, decoupling CI and CD service account identities and assigning the Service Account User role (roles/iam.serviceAccountUser) to the deployment runner provides exact workload impersonation rights without granting dangerous administrative IAM permissions.

Step-by-Step Solution

1
Analyze build worker network isolation and data exfiltration controls.
Identify that default Cloud Build pools execute in a shared Google-managed network, requiring Cloud Build Private Pools peered to a custom VPC inside a VPC Service Controls security perimeter to restrict egress and exfiltration.
VPC Service Controls protect sensitive assets by preventing API-based exfiltration to unauthorized Google Cloud resources.
2
Evaluate IAM least-privilege identity model for pipeline runners.
Separate the build identity (Cloud Build SA) from the delivery identity (Cloud Deploy SA) and restrict permissions to targeted roles.
Separation of duties prevents a compromise in the build phase from compromising cluster release operations.
3
Determine correct service account delegation role for deployment.
Grant `roles/iam.serviceAccountUser` on specific runtime service accounts rather than primitive roles or `roles/iam.serviceAccountAdmin`.
The Service Account User role allows a runner to impersonate or attach a runtime identity without providing administrative rights to alter IAM policies or delete service accounts.

Key Concept

Secure CI/CD Pipeline Design with Private Pools, VPC Service Controls, and IAM Least Privilege
Rate this question

Topics

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

More questions from this topic