An enterprise logistics company migrated its fleet routing microservices to Google Cloud under tight deadlines. A post-migration technical debt assessment reveals two major risks: deployment pipelines rely on local Terraform state files stored on individual developer workstations, and the continuous deployment service accounts have been granted the project Owner primitive role to bypass permission errors. Which TWO architecture refactoring steps should you implement to mitigate this technical debt and enforce infrastructure governance? (Select TWO answers.)
- Configure a Remote Backend using a Google Cloud Storage bucket with object versioning enabled and strict IAM permissions for state storage.Cevap
- Replace primitive project Owner roles on deployment service accounts with least-privilege predefined or custom IAM roles scoped strictly to required infrastructure resources.Cevap
- CCommit and push local Terraform state files directly to the version-controlled Git source code repository to enable shared access across development teams.
- DAssign the Service Account Admin role to developers so they can impersonate project service accounts directly without modifying pipeline IAM assignments.
Cevap
The correct architecture refactoring steps are configuring a Cloud Storage remote backend with object versioning for central Terraform state management, and replacing primitive Owner roles on continuous deployment service accounts with granular, least-privilege IAM roles.
Migrating to a Cloud Storage remote backend with object versioning solves state file concurrency conflicts and durability risks. Concurrently, replacing primitive project Owner roles with least-privilege predefined or custom IAM roles establishes robust security governance and eliminates privilege escalation vulnerabilities.
Adım Adım Çözüm
Anahtar Kavram
Technical Debt Mitigation for Infrastructure as Code and Security Governance