Examkin

Soru

Zorluk: Çok zorImplementing Infrastructure as Code using Terraform and Deployment Manager

An enterprise organization is establishing an automated CI/CD pipeline using Terraform to manage infrastructure across hundreds of Google Cloud projects. The lead architect requires a solution that guarantees state file resilience against accidental deletion, prevents state corruption from concurrent automated pipeline runs, eliminates long-lived service account keys, and adheres to the principle of least privilege. Which deployment architecture and state management configuration should the Cloud Architect recommend?

  1. Configure a central Cloud Storage bucket backend with Object Versioning and uniform bucket-level access enabled, rely on native Cloud Storage object locking for state concurrency control, and authenticate the CI/CD runners using Workload Identity Federation with short-lived tokens bound to specific predefined IAM roles.Cevap
  2. B
    Configure a central Cloud Storage bucket backend without Object Versioning, disable backend state locking to minimize pipeline execution latency, rely on job-level sequential queuing in the CI/CD tool for concurrency control, and assign the primitive Editor role to the automated deployment identity.
  3. C
    Export service account JSON key files into repository secret variables for build runner authentication, assign the Service Account Admin role across target projects, and track state files in local git repositories associated with each application codebase.
  4. D
    Deploy state files onto a shared Compute Engine persistent disk mounted across build worker instances, grant developer user accounts the Service Account Admin role directly to execute impersonation, and run Terraform apply steps via remote SSH execution scripts.

Cevap

Configure a Cloud Storage backend with Object Versioning, native object state locking, Workload Identity Federation keyless authentication, and least-privilege predefined IAM roles.
Combining a Cloud Storage backend with native object locking and Object Versioning ensures state durability and concurrency control. Integrating Workload Identity Federation replaces static service account keys with short-lived tokens, while predefined IAM roles maintain strict operational security boundaries.

Adım Adım Çözüm

1
Select remote state storage and locking architecture.
Google Cloud Storage backends provide built-in object locking and versioning to prevent race conditions and preserve state historical snapshots.
Unversioned backends or local disk storage risk data loss and state corruption during concurrent pipeline runs.
2
Determine runner authentication and credential lifecycle management.
Workload Identity Federation enables external CI/CD pipelines to impersonate GCP service accounts without generating or storing long-lived service account JSON keys.
Static service account keys present high security risks if leaked, committed to repositories, or improperly rotated.
3
Define IAM permissions for deployment identities.
Assign fine-grained predefined roles specific to the target resources being provisioned rather than primitive roles or identity management administrative roles.
Primitive roles grant excessive rights that compromise boundary security if the pipeline identity is hijacked.

Anahtar Kavram

Enterprise Infrastructure as Code Automation with Terraform Backend and Identity Best Practices
Bu soruyu puanla

Konular

Implementing Infrastructure as Code using Terraform and Deployment Manager

Bu konudan daha fazla soru