An enterprise organization is establishing an automated Continuous Integration and Continuous Delivery (CI/CD) pipeline using Cloud Build to provision and update infrastructure across multiple Google Cloud projects using Terraform. The architecture team requires that concurrent execution of pipeline builds does not result in state file corruption or race conditions. Additionally, access to infrastructure state must adhere to least privilege security practices. Which architecture design meets these requirements?
- Configure a Cloud Storage bucket with Object Versioning as the remote Terraform backend, and grant the Cloud Build service account specific predefined Storage Object Admin and resource-specific IAM roles.Cevap
- BMaintain Terraform state files within the local directory of the ephemeral Cloud Build worker runner filesystem during pipeline execution.
- CAssign the primitive Owner role (roles/owner) to the Cloud Build service account to ensure it has unrestricted access to lock state and provision all cloud resources.
- DGrant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the Cloud Build service account to allow it to impersonate runtime service accounts during deployment.
Cevap
Configure a Cloud Storage bucket with Object Versioning as the remote Terraform backend, and grant the Cloud Build service account specific predefined Storage Object Admin and resource-specific IAM roles.
Configuring Cloud Storage as the remote backend provides built-in state locking mechanisms that prevent race conditions during parallel CI/CD pipeline executions. Combining this with specific predefined roles satisfies least privilege security standards.
Adım Adım Çözüm
Anahtar Kavram
Terraform Remote State Management and CI/CD Security Best Practices in Cloud Build