Examkin

Soru

Zorluk: ZorAssessing and Mitigating Technical Debt in Cloud Architectures

A renewable energy analytics firm recently completed a rapid lift-and-shift migration of its IoT data processing pipeline to Google Cloud. A post-migration architecture audit identified two critical sources of technical debt: infrastructure engineers store Terraform state files on local developer workstations, resulting in frequent state drift and race conditions during deployments; additionally, compute workloads execute using service accounts assigned the project-level Owner primitive role to simplify access to Cloud Storage and BigQuery. Which combination of architectural refactoring actions should you recommend to effectively mitigate this technical debt while adhering to Google Cloud recommended practices?

  1. Migrate the Terraform state files to a centralized Cloud Storage bucket configured with Object Versioning and state locking, and replace the project-level Owner roles with minimal predefined IAM roles assigned directly to workload service accounts.Cevap
  2. B
    Commit all local Terraform state files directly into a version-controlled Git repository, and replace project-level Owner roles with minimal predefined IAM roles assigned directly to workload service accounts.
  3. C
    Migrate the Terraform state files to a centralized Cloud Storage bucket configured with Object Versioning and state locking, but maintain project-level Owner primitive roles while relying on VPC Service Controls to prevent unauthorized resource access.
  4. D
    Refactor all compute workloads to run inside Google Kubernetes Engine (GKE) clusters using Workload Identity, while migrating Terraform state management to a dedicated Cloud Spanner instance.

Cevap

The optimal mitigation strategy is to migrate Terraform state files to a Cloud Storage backend with Object Versioning and state locking, while replacing primitive Owner roles with least-privilege predefined IAM roles.
The correct recommendation addresses both identified areas of technical debt according to Google Cloud architectural best practices. Configuring Cloud Storage as a remote backend provides central state storage, object versioning for rollback capabilities, and native state locking to prevent concurrent modifications. Concurrently, replacing primitive Owner roles with targeted predefined roles (such as Cloud Storage Object Admin or BigQuery Data Editor) enforces least privilege and meets compliance standards without introducing operational complexity.

Adım Adım Çözüm

1
Assess the Infrastructure as Code (IaC) technical debt.
Identified that local state files lead to concurrency conflicts, environment drift, and risk of state loss.
Google Cloud recommended practice dictates using a remote backend such as Cloud Storage with state locking enabled to ensure consistent, secure deployment pipeline execution.
2
Assess the Identity and Access Management (IAM) technical debt.
Identified that project-level Owner primitive roles violate security compliance and grant excessive permissions.
Replacing primitive roles with specific predefined or custom roles follows the principle of least privilege.
3
Combine the refactoring strategies into a minimal-overhead, standardized architecture.
Configuring a GCS backend for IaC state and scoping IAM roles to specific services directly resolves both forms of technical debt without adding excessive infrastructure management overhead.
This directly remediates operational instability and security compliance failures while remaining cost-effective.

Anahtar Kavram

Technical Debt Mitigation in IaC State Management and IAM Role Scoping
Bu soruyu puanla

Konular

Assessing and Mitigating Technical Debt in Cloud Architectures