Examkin

Soru

Zorluk: OrtaAutomating Continuous Deployment Pipelines and Release Strategies

An enterprise organization is establishing an automated CI/CD release pipeline using Cloud Build and Cloud Deploy to manage infrastructure and application workloads across GCP environments. The security architecture team requires that the pipeline adheres strictly to the principle of least privilege, specifically ensuring Cloud Build can impersonate dedicated target execution service accounts without gaining administrative control over IAM permissions or using over-privileged roles. Which architectural configuration correctly satisfies these requirements?

  1. Grant the Cloud Build service account the Service Account User role (roles/iam.serviceAccountUser) on the specific target execution service accounts, and assign appropriate predefined Cloud Deploy roles for release creation.Cevap
  2. B
    Assign the primitive Owner role (roles/owner) to the Cloud Build service account at the GCP project level to simplify deployment permissions across all target environments.
  3. C
    Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the Cloud Build service account on the target execution service accounts to enable deployment execution.
  4. D
    Store and manage Terraform state files on the Cloud Build runner's local ephemeral filesystem to bypass remote backend state permission requirements.

Cevap

Grant the Cloud Build service account the Service Account User role (roles/iam.serviceAccountUser) on the specific target execution service accounts, and assign appropriate predefined Cloud Deploy roles for release creation.
The principle of least privilege requires granting the minimal set of permissions necessary to execute pipeline tasks. To allow Cloud Build to impersonate dedicated deployment execution service accounts, the Cloud Build service account must be granted the Service Account User role (roles/iam.serviceAccountUser) specifically on those target service accounts.

Adım Adım Çözüm

1
Identify the minimum required permission for a service account to impersonate or run tasks as another execution service account in GCP.
The necessary IAM role is Service Account User (roles/iam.serviceAccountUser).
Service Account User provides permission to attach or impersonate the target service account without granting permissions to alter IAM policies.
2
Evaluate the pipeline runner security requirements against the principle of least privilege.
Cloud Build requires impersonation privileges restricted to specific target execution service accounts.
Scoping the role grant specifically to the target service account prevents unintended access across unapproved resources.
3
Select the correct IAM configuration option matching these least-privilege standards.
Granting roles/iam.serviceAccountUser on the target service account is the optimal and secure approach.
This avoids primitive roles and administrative over-privileging while maintaining full deployment automation capabilities.

Anahtar Kavram

Least-privilege IAM configuration for automated CI/CD pipeline service account impersonation.
Bu soruyu puanla

Konular

Automating Continuous Deployment Pipelines and Release Strategies