A telemetry platform team operating a global IoT data ingestion service on Google Cloud is restructuring their deployment pipeline and environment governance. Currently, engineers perform manual infrastructure modifications through the Cloud Console and authenticate CI/CD jobs using long-lived service account keys saved locally. As a Principal Cloud Architect, you are advising the development and operations teams on implementing GCP best practices for automation, security, and state management. Which TWO practices should you recommend? (Select TWO.)
- Authenticate external CI/CD deployment pipelines using Workload Identity Federation rather than exporting long-lived service account JSON keys.Cevap
- Store Terraform state files in a Cloud Storage bucket configured with object versioning and state locking enabled.Cevap
- CGrant the Editor primitive role to the deployment service account to ensure all existing and future infrastructure provisioning operations succeed.
- DMaintain Infrastructure as Code state files within developer local Git repositories to track infrastructure revisions alongside application source code.
- EAssign the Service Account Admin role to developer accounts to allow Compute Engine instances to run under application service accounts.
Cevap
The correct recommendations are authenticating external CI/CD deployment pipelines using Workload Identity Federation instead of long-lived keys, and storing Terraform state files in a Cloud Storage bucket configured with object versioning and state locking.
Advising DevOps teams effectively involves enforcing key security and operational principles. Authenticating pipelines using Workload Identity Federation avoids storing long-lived credentials, and using Cloud Storage for Terraform state management ensures centralized, locked, and versioned state file tracking.
Adım Adım Çözüm
Anahtar Kavram
Advising Development and Operation Teams on Secure Automation and IaC Best Practices