A software architecture team is analyzing their release management lifecycle for microservices running on Cloud Run. To align their continuous integration and continuous deployment (CI/CD) pipelines with security and governance best practices, they must establish appropriate permission boundaries for automated build processes. Which pipeline identity configuration follows Google Cloud recommended practices?
- Attach a dedicated service account to Cloud Build with minimal, predefined roles scoped only to the required deployment actions.Cevap
- BAssign the primitive Owner role to the build service account to guarantee build steps never run into permission errors.
- CGrant application developers the Service Account Admin role on the build pipeline service account so they can manage credentials during runs.
- DPersist deployment state tracking files exclusively on local container disk space during pipeline execution.
Cevap
Attach a dedicated service account to Cloud Build with minimal, predefined roles scoped only to the required deployment actions.
Configuring dedicated service accounts with fine-grained, predefined roles tailored to specific deployment targets adheres to Google Cloud security best practices by implementing the principle of least privilege.
Adım Adım Çözüm
Anahtar Kavram
Least Privilege Identity Management in CI/CD Pipelines