An enterprise organization is designing a continuous integration and continuous delivery (CI/CD) pipeline on Google Cloud using Cloud Build to automate infrastructure provisioning via Terraform. The security team requires that the build process prevents data exfiltration during execution and enforces least privilege without relying on static credentials or broad access permissions. Which two configuration choices should you implement in your pipeline design to satisfy these requirements?
- Configure Cloud Build to execute within Private Pools integrated with VPC Service Controls to restrict external network egress during build execution.Cevap
- Use service account impersonation with fine-grained predefined IAM roles for Cloud Build pipeline execution steps instead of using exported service account JSON keys.Cevap
- CAssign the primitive Editor role to the Cloud Build default service account to ensure all Terraform resources can be created without encountering permission failures.
- DStore Terraform state files in an unversioned local directory within the build worker environment to avoid Cloud Storage object locking delays.
Cevap
The optimal pipeline design requires executing Cloud Build inside Private Pools protected by VPC Service Controls to prevent exfiltration, while enforcing service account impersonation with fine-grained IAM roles to eliminate static keys and primitive permissions.
Executing Cloud Build within Private Pools enclosed by VPC Service Controls isolates network traffic to prevent data exfiltration, while adopting service account impersonation ensures short-lived access with fine-grained IAM roles.
Adım Adım Çözüm
Anahtar Kavram
Secure CI/CD Pipeline Design with Cloud Build Private Pools and IAM Impersonation