Examkin

Soru

Zorluk: ZorAnalyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines

An enterprise architecture team is conducting an SDLC audit of a multi-project CI/CD deployment pipeline using Cloud Build and Terraform to provision infrastructure across target Google Cloud projects. The audit reveals two critical security and governance findings: the build pipeline uses the default Cloud Build service account with primitive Owner permissions across target projects, and build steps maintain Terraform state within ephemeral Cloud Build workspace storage committed back to git repositories. Additionally, developers require administrative rights over service accounts to run build triggers. Which set of refactoring steps should the architecture team recommend to remediate these pipeline vulnerabilities while adhering to Google Cloud best practices?

  1. A
    Maintain the Editor primitive role on target projects for deployment flexibility, migrate Terraform state storage to a central Cloud Storage bucket with object versioning, and grant developers the Service Account User role on the build service account.
  2. B
    Create a user-managed service account for Cloud Build with specific predefined roles on target projects, migrate Terraform state storage to a central Cloud Storage bucket with object versioning, and grant developers the Service Account Admin role to execute triggers.
  3. Create a user-managed service account for Cloud Build configured with fine-grained predefined roles on target projects, configure a Cloud Storage remote backend with object versioning and state locking for Terraform, and grant developers the Service Account User role on the build service account.Cevap
  4. D
    Create a user-managed service account for Cloud Build with fine-grained predefined roles on target projects, encrypt Terraform state files locally inside Cloud Build workspace containers using KMS before committing them, and grant developers the Service Account User role on the build service account.

Cevap

The correct architecture solution requires creating a user-managed service account for Cloud Build configured with minimal predefined roles, migrating Terraform state to a remote Cloud Storage backend with object versioning and state locking, and granting developers the Service Account User role.
The correct recommendation enforces strict SDLC pipeline governance on GCP. Replacing primitive roles with fine-grained predefined roles assigned to a user-managed Cloud Build service account enforces least privilege. Storing Terraform state in a centralized Cloud Storage backend with object versioning and state locking eliminates state corruption and concurrency risks. Granting developers the Service Account User role provides the necessary rights to execute build jobs under the service account without exposing full administrative controls.

Adım Adım Çözüm

1
Analyze CI/CD identity and access management requirements
Identify that using primitive Owner or Editor roles violates least privilege, and granting Service Account Admin provides unnecessary administrative control when only build impersonation (Service Account User) is required.
CI/CD service accounts should only possess specific deployment roles (e.g., Kubernetes Engine Developer, Cloud Run Admin) necessary for build targets.
2
Evaluate Infrastructure as Code (IaC) state management security
Recognize that storing Terraform state files in ephemeral workspaces or git repositories leads to state corruption, race conditions, and key leakage.
Terraform state must be stored in a centralized Google Cloud Storage (GCS) backend supporting object versioning for rollback capabilities and object locking to prevent concurrent apply operations.
3
Synthesize optimal secure SDLC configuration for Cloud Build
Combine user-managed Cloud Build service accounts with fine-grained roles, GCS remote backend for Terraform, and Service Account User permissions for developers.
This establishes robust pipeline security, operational reliability, and compliance with Google Cloud enterprise deployment standards.

Anahtar Kavram

CI/CD Security Hardening and IaC State Management in GCP
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines