An online insurance platform's backend infrastructure was initially deployed on Google Cloud using ad-hoc automation and direct console actions. An architectural evaluation reveals severe technical debt: developer accounts hold project-level primitive Editor roles, and Terraform state files reside locally on developer laptops without concurrency locking or backup. As the lead cloud architect, which strategy should you recommend to mitigate this technical debt while establishing production governance?
- Migrate local Terraform state to a centralized Cloud Storage bucket with versioning and state locking enabled, and replace project-level primitive roles with least-privilege predefined or custom IAM roles.Cevap
- BCommit and push local Terraform state files directly into a private git repository for version tracking, and reassign developers from project Editor roles to project Viewer roles.
- CMigrate state files to Cloud Storage with versioning enabled, but retain project Editor roles for developers to ensure fast hotfixing and avoid build pipeline disruptions.
- DDeploy an Autopilot Google Kubernetes Engine (GKE) cluster to manage infrastructure state workloads, while maintaining developer project Editor access for cluster administration.
Cevap
Migrate local Terraform state to a centralized Cloud Storage bucket with versioning and state locking enabled, and replace project-level primitive roles with least-privilege predefined or custom IAM roles.
The correct recommendation addresses both technical debt vectors: migrating Terraform state to a Cloud Storage remote backend ensures state concurrency locking and backup, while replacing primitive Editor roles with fine-grained predefined or custom IAM roles satisfies least privilege governance.
Adım Adım Çözüm
Anahtar Kavram
Mitigating IaC state management and IAM governance technical debt in cloud architectures