Examkin

Soru

Zorluk: OrtaAssessing and Mitigating Technical Debt in Cloud Architectures

An enterprise retail supply chain company migrated its inventory tracking microservices to Google Cloud using a rapid rehosting approach. A post-migration architecture review identifies two critical technical debt risks: infrastructure modifications are executed manually by developers using local Terraform state files saved on individual laptops, and application service accounts have been assigned the primitive Project Editor role (`roles/editor`) to avoid access permission errors. Which TWO architecture refactoring steps should the Lead Cloud Architect recommend to mitigate this technical debt? (Select TWO answers.)

  1. Migrate Terraform state management to a central Google Cloud Storage bucket with object versioning and object locking enabled, and enforce infrastructure changes through a continuous integration pipeline.Cevap
  2. Replace primitive project roles on service accounts with fine-grained predefined or custom IAM roles scoped strictly to the specific resources required by each microservice.Cevap
  3. C
    Commit and store the raw local Terraform state files directly into the microservices application source code repository to enable version control across team members.
  4. D
    Grant the Service Account Admin role (`roles/iam.serviceAccountAdmin`) to all microservice service accounts to allow automated runtime key generation and permission self-management.

Cevap

The architect should migrate Terraform state files to a centralized Cloud Storage backend with object versioning and state locking enforced via automated CI/CD pipelines, and replace broad primitive Project Editor roles on service accounts with fine-grained, resource-scoped IAM roles.
Remediating technical debt resulting from rapid rehosting requires addressing governance and security anti-patterns. Implementing a remote Cloud Storage backend for Terraform ensures state locking and version history, while executing deployments through automated CI/CD pipelines prevents manual drift. Additionally, replacing broad primitive Project Editor roles with targeted predefined roles enforces least-privilege access for application service accounts.

Adım Adım Çözüm

1
Assess Infrastructure as Code state management technical debt.
Identified risk: Storing Terraform state locally causes configuration drift, state corruption, and lack of locking during updates.
Centralizing state management in Cloud Storage with backend locking and CI/CD automation secures state history and standardizes deployments.
2
Assess identity and access management technical debt.
Identified risk: Primitive Editor roles grant overly broad permissions across all project resources.
Applying the principle of least privilege by scoping predefined or custom IAM roles to specific microservice dependencies removes excess project-level access.

Anahtar Kavram

Assessing and Mitigating Technical Debt in Cloud Architectures
Bu soruyu puanla

Konular

Assessing and Mitigating Technical Debt in Cloud Architectures