Examkin

Soru

Zorluk: ZorAutomating Continuous Deployment Pipelines and Release Strategies

An online retail platform uses Cloud Build to automate continuous deployment of microservices to Google Kubernetes Engine (GKE) clusters across staging and production environments. To maintain strict security and governance, the deployment pipeline must run with the minimum permissions required to impersonate the workload's runtime service account, while ensuring that automated Terraform infrastructure updates prevent concurrent state corruption. Which architecture strategy should the cloud team implement?

  1. Grant the Cloud Build service account the Service Account User role (roles/iam.serviceAccountUser) on the runtime service account, and configure a Cloud Storage backend with object versioning and state locking for Terraform state management.Cevap
  2. B
    Grant the Cloud Build service account the Service Account Admin role (roles/iam.serviceAccountAdmin) across the project, and store Terraform state files in a local directory during pipeline execution.
  3. C
    Grant the primitive Owner role to the Cloud Build service account, and maintain Terraform state files in an unversioned Cloud Storage bucket without state locking.
  4. D
    Grant the Cloud Build service account the Service Account User role on the runtime service account, and save Terraform state locally within the Cloud Build workspace container.

Cevap

Granting the Service Account User role (roles/iam.serviceAccountUser) on the specific runtime service account to the Cloud Build service account follows least privilege for workload execution. Configuring a remote Cloud Storage backend with state locking and object versioning secures Terraform state against concurrency conflicts and corruption.
The correct strategy enforces the principle of least privilege by granting the Cloud Build service account the Service Account User role specifically on the runtime service account rather than project-wide admin permissions. Concurrently, managing Terraform state using a remote Cloud Storage backend with object versioning and state locking ensures that automated pipeline runs do not suffer from state loss or concurrent execution conflicts.

Adım Adım Çözüm

1
Analyze the IAM permission requirements for pipeline execution
Determined that the Cloud Build service account only needs to impersonate/attach the runtime service account, which requires roles/iam.serviceAccountUser on the target service account resource.
Granting roles/iam.serviceAccountAdmin or primitive roles violates the principle of least privilege.
2
Analyze the Infrastructure as Code (IaC) state management requirements
Identified that Terraform state must be stored in a centralized remote location with locking (Cloud Storage backend) to prevent concurrent writes.
Ephemeral local storage within Cloud Build runners loses state between builds, causing state corruption and resource duplication.
3
Combine security and state management solutions
Selected the approach pairing roles/iam.serviceAccountUser on the target identity with a versioned, lock-enabled Cloud Storage backend.
This satisfies both zero-trust access control and robust automated CI/CD state governance.

Anahtar Kavram

Continuous Deployment Pipeline Security and Declarative Infrastructure State Governance
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Automating Continuous Deployment Pipelines and Release Strategies