Examkin

Soru

Zorluk: OrtaDeploying Infrastructure using Deployment Manager or Terraform

A Cloud Engineer is configuring an automated continuous integration pipeline to deploy Compute Engine virtual machines into a target project named `prod-services-456` using Terraform. The deployment pipeline runs under a service account created in a separate central CI/CD GCP project. According to Google Cloud security and operational best practices, which approach should the engineer take to ensure Terraform authenticates securely and successfully provisions the infrastructure?

  1. Configure the deployment pipeline to use service account impersonation with necessary predefined roles assigned in `prod-services-456`, and ensure the required Compute Engine API is enabled within `prod-services-456`.Cevap
  2. B
    Generate and download a long-lived JSON service account key for `prod-services-456` and store it directly inside the pipeline code repository for Terraform authentication.
  3. C
    Enable the Compute Engine API exclusively in the central CI/CD project, while granting the pipeline service account access to provision resources in `prod-services-456`.
  4. D
    Assign the Project Owner primitive role to the central pipeline service account at the organization level so that Terraform has unrestricted administrative permissions everywhere.

Cevap

Configure the deployment pipeline to use service account impersonation with necessary predefined roles assigned in `prod-services-456`, and ensure the required Compute Engine API is enabled within `prod-services-456`.
The correct approach uses short-lived authentication via service account impersonation to eliminate static key leakage risks, ensures that the required Google Cloud service APIs (Compute Engine API) are enabled inside the target project where the virtual machines will be created, and enforces the principle of least privilege using predefined roles.

Adım Adım Çözüm

1
Determine the secure authentication mechanism for cross-project Terraform execution.
Identified service account impersonation as the recommended practice over static JSON key files.
Static JSON key files present key management security risks, whereas service account impersonation provides short-lived tokens.
2
Verify target project API prerequisites for Terraform resource creation.
Confirmed that the Compute Engine API must be enabled in the target host project `prod-services-456`.
GCP resource management endpoints require API enablement within the project where resources are instantiated.
3
Apply the principle of least privilege for IAM permission assignment.
Selected specific predefined roles bound to the target project rather than primitive or organization-wide roles.
Predefined roles restrict permissions strictly to necessary operations for Compute Engine provisioning.

Anahtar Kavram

Terraform GCP Service Account Impersonation and API Enablement Scoping
Bu soruyu puanla

Konular

Deploying Infrastructure using Deployment Manager or Terraform