Examkin

Soru

Zorluk: Çok zorContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

A enterprise security team requires a central CI/CD pipeline built on Cloud Build to provision infrastructure via Terraform and deploy containerized workloads onto a private Google Kubernetes Engine (GKE) cluster. The workload infrastructure and Cloud Storage bucket hosting the Terraform backend are isolated within a VPC Service Controls (VPC-SC) security perimeter. Pipeline workers run in a Cloud Build Private Pool peered to the target VPC. The pipeline fails during execution when attempting to modify GKE resources and interact with the remote Terraform backend. Which architectural modification correctly resolves the execution failure while adhering to Google Cloud security best practices and least privilege?

  1. A
    Assign the primitive Owner role to the Cloud Build service account across the organization hierarchy to bypass VPC Service Controls perimeter restrictions and GKE resource impersonation limits.
  2. B
    Grant the Cloud Build service account the Service Account Admin role (`roles/iam.serviceAccountAdmin`) on the GKE node service account and store the Terraform state file in a locally ephemeral volume within the Cloud Build runner container.
  3. Configure an Ingress policy in the VPC Service Controls perimeter allowing the Cloud Build service account access to Cloud Storage and GKE API services, grant `roles/iam.serviceAccountUser` on the runtime service account, and use a versioned, locked Cloud Storage backend for Terraform state.Cevap
  4. D
    Assign `roles/iam.serviceAccountAdmin` to the Cloud Build service account and remove the Cloud Storage state bucket from the VPC Service Controls perimeter to enable unrestricted state locks.

Cevap

Configure an explicit Ingress policy in the VPC Service Controls perimeter targeting the Cloud Build service account for Cloud Storage and GKE endpoints, grant the Service Account User role (`roles/iam.serviceAccountUser`) on the target compute/runtime service accounts, and manage Terraform state in a Cloud Storage bucket with object versioning and state locking enabled inside the perimeter.
The solution correctly addresses all security and functional requirements: updating the VPC Service Controls perimeter with an explicit Ingress rule enables the Cloud Build worker identity to communicate with protected GCP APIs (GKE and Cloud Storage); assigning `roles/iam.serviceAccountUser` respects the principle of least privilege required for workload deployment; and storing Terraform state in a versioned Cloud Storage backend within the perimeter prevents configuration drift while maintaining strict perimeter security.

Adım Adım Çözüm

1
Analyze perimeter restriction failures
Identified that Cloud Build Private Pool execution requires explicit VPC Service Controls ingress/egress authorization rules or service perimeter membership to access resources protected inside the perimeter.
VPC-SC blocks requests to protected Google APIs (such as Cloud Storage state buckets and GKE control planes) even if standard IAM permissions are present.
2
Evaluate IAM privilege requirements
Determined that Cloud Build service accounts require `roles/iam.serviceAccountUser` to attach runtime service accounts to GKE resources, rather than broad administrative roles.
Principle of least privilege dictates granting impersonation/usage rights instead of full service account administration.
3
Validate IaC state management strategy
Confirmed that Infrastructure as Code state must reside in a protected, versioned Cloud Storage bucket with object locking.
Ephemeral runner storage causes state drift, loss, and concurrency issues in automated pipeline execution.

Anahtar Kavram

Secure Enterprise CI/CD Pipeline Integration with VPC Service Controls, IAM Least Privilege, and IaC State Governance
Bu soruyu puanla

Konular

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

Bu konudan daha fazla soru