Examkin

Soru

Zorluk: OrtaContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

An enterprise architecture team is designing a Continuous Integration and Continuous Delivery (CI/CD) pipeline on Google Cloud using Cloud Build to build container images and execute deployments to Google Kubernetes Engine (GKE). To enforce strict enterprise security standards and the principle of least privilege throughout the build and deployment lifecycle, which TWO architectural practices should the team implement?

  1. Execute Cloud Build triggers using a dedicated custom service account provisioned only with necessary fine-grained roles rather than using the default Cloud Build service account.Cevap
  2. Grant the build pipeline's service account the Service Account User role (roles/iam.serviceAccountUser) on the target GKE runtime service account.Cevap
  3. C
    Assign primitive Editor roles to the pipeline service account at the project root to prevent permission errors during automated resource provisioning.
  4. D
    Store build artifacts and configuration state files in local transient disk storage within the build runner without enabling remote bucket versioning.

Cevap

The team should execute Cloud Build triggers using a dedicated custom service account with minimal predefined roles, and grant that service account the Service Account User role on the target runtime service account.
Secure CI/CD architecture on GCP requires isolating build pipeline identities by attaching dedicated custom service accounts with fine-grained predefined roles to Cloud Build triggers. Furthermore, to deploy workloads safely, the build pipeline service account requires the Service Account User role on the specific runtime service account assigned to the GKE application pods.

Adım Adım Çözüm

1
Identify identity management best practices for Cloud Build.
Using a dedicated custom service account ensures that pipeline permissions are limited strictly to what the build job requires, avoiding excessive permissions.
Default service accounts often hold broad default permissions that present a security risk if compromised.
2
Determine the necessary IAM permission model for deploying to GKE workloads.
The build pipeline requires impersonation rights over the workload's runtime identity via the roles/iam.serviceAccountUser role.
This allows the build runner to attach the runtime identity to GKE pods without granting the pipeline full administrative control over IAM resources.

Anahtar Kavram

Least Privilege Security Architecture for CI/CD Pipelines
Bu soruyu puanla

Konular

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

Bu konudan daha fazla soru