Examkin

Soru

Zorluk: Çok zorDeploying Infrastructure using Deployment Manager or Terraform

A cloud engineering team is constructing an automated CI/CD deployment pipeline to provision infrastructure in a new Google Cloud project named `prod-workloads-456` using Terraform. The pipeline executes using a dedicated deployment service account residing in a central management project `ci-cd-tools-100`. During the initial run of `terraform apply` targeting `prod-workloads-456`, the deployment fails with an error indicating that `compute.googleapis.com` is not enabled. Furthermore, corporate security policy strictly prohibits storing long-lived credentials in pipeline secrets. Which set of actions adheres to Google Cloud best practices to resolve the deployment failure and secure pipeline authentication?

  1. Enable the Compute Engine API directly within the target project `prod-workloads-456`, and configure the CI/CD pipeline to authenticate using short-lived credentials via IAM Service Account Impersonation.Cevap
  2. B
    Enable the Compute Engine API in the central management project `ci-cd-tools-100` where the Terraform CLI executes, and export a long-lived service account JSON key for pipeline authentication.
  3. C
    Generate a downloadable service account JSON key, store it in the repository secret manager, and grant the service account `roles/owner` at the organization level to automatically bypass project-level API requirements.
  4. D
    Grant `roles/resourcemanager.organizationAdmin` to the pipeline service account at the parent folder level so that API enablement settings are inherited down the resource hierarchy without modifying the target project.

Cevap

Enable the Compute Engine API directly within the target project `prod-workloads-456`, and configure the CI/CD pipeline to authenticate using short-lived credentials via IAM Service Account Impersonation.
The correct approach requires enabling the required Cloud API (`compute.googleapis.com`) directly on the target project (`prod-workloads-456`) where resources will reside. For pipeline security, Google Cloud recommends using short-lived credentials generated via IAM Service Account Impersonation or Workload Identity Federation instead of downloading persistent JSON keys.

Adım Adım Çözüm

1
Identify API enablement scoping
Determine that Google Cloud APIs (such as `compute.googleapis.com`) are project-scoped and must be enabled specifically in target project `prod-workloads-456` where resources are being created.
Enabling an API in the CI/CD runner's project does not grant permission or enable endpoints in a remote target project.
2
Select secure authentication mechanism
Choose IAM Service Account Impersonation or Workload Identity Federation instead of downloading persistent JSON service account keys.
Generating static service account keys violates the mandatory policy against persistent key storage in pipeline environments.
3
Synthesize compliant workflow
Enable the API on `prod-workloads-456` (via `gcloud services enable` or Terraform project service resource) and run Terraform via short-lived impersonated tokens.
This guarantees successful resource provisioning while maintaining compliance with identity and credential security standards.

Anahtar Kavram

GCP IaC Security Best Practices and Service API Scoping
Bu soruyu puanla

Konular

Deploying Infrastructure using Deployment Manager or Terraform