Examkin

Soru

Zorluk: Çok zorAnalyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines

An enterprise organization is evaluating the security and governance of its automated CI/CD pipeline. The current pipeline uses Cloud Build to run integration tests for incoming pull requests (PRs) against a Cloud Spanner database situated inside a VPC Service Controls (VPC-SC) perimeter. An architecture audit revealed two critical issues: pull requests submitted by external contributors can execute arbitrary build scripts using the default Cloud Build service account, creating data exfiltration risks, and developers frequently execute ad-hoc infrastructure updates from local workstations, leading to state corruption and configuration drift. Which architecture and pipeline control strategy should a Principal Cloud Architect implement to address these security and operational risks?

  1. A
    Grant the default Cloud Build service account the primitive Owner role across the project to bypass VPC Service Controls perimeter checks, and configure pull request triggers to execute automatically on default shared worker pools.
  2. B
    Rely exclusively on Cloud IAM role bindings to prevent data exfiltration during pull request builds on default public Cloud Build pools, and store Terraform state files in unversioned local storage to prevent remote locking bottlenecks.
  3. Configure Cloud Build to use a private worker pool peered into the VPC-SC perimeter, attach a minimal user-managed service account to the pipeline, require approval from a repository maintainer before running PR builds from external contributors, and enforce IaC deployments exclusively through CI/CD using a versioned Cloud Storage backend.Cevap
  4. D
    Distribute service account JSON keys to developers so they can run Terraform apply commands directly from local workstations, while allowing Cloud Build integration tests to run unvetted PR scripts on shared default pools.

Cevap

Configure Cloud Build to execute PR builds using private worker pools connected within the VPC Service Controls perimeter, utilize a least-privilege user-managed service account, require maintainer approval for pull request triggers from untrusted authors, and enforce centralized Infrastructure as Code execution with a versioned Cloud Storage backend.
The correct strategy combines network isolation, IAM least privilege, build trigger safeguards, and automated IaC governance. Private worker pools allow Cloud Build to access resources inside a VPC-SC perimeter securely. Utilizing a user-managed service account with fine-grained permissions prevents excessive build privileges. Requiring maintainer approval before building external pull requests mitigates malicious code execution risks. Finally, centralized IaC deployment using Cloud Storage remote backends with versioning and locking prevents state corruption and configuration drift.

Adım Adım Çözüm

1
Analyze pipeline network security and perimeter requirements.
Default Cloud Build shared pools reside outside VPC-SC perimeters. Private worker pools must be provisioned and peered with the VPC network containing the Cloud Spanner database to allow secure access without exposing perimeter resources.
VPC Service Controls perimeters prevent data exfiltration and block unauthorized ingress/egress from public build environments.
2
Analyze IAM permission and build trigger security for pull requests.
Assign a dedicated user-managed service account with fine-grained permissions instead of the default Cloud Build service account, and require maintainer approval prior to executing build scripts submitted by external pull request authors.
Prevent arbitrary code execution in untrusted pull requests from abusing build pipeline privileges or exfiltrating data.
3
Evaluate Infrastructure as Code (IaC) governance and state management.
Mandate that all Terraform changes execute exclusively through the automated CI/CD pipeline using a Cloud Storage remote backend with object versioning and state locking enabled.
Eliminate manual local updates that cause configuration drift and prevent state file corruption during concurrent deployments.

Anahtar Kavram

Analyzing SDLC and CI/CD Pipeline Security and Governance in GCP
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines