Examkin

Soru

Zorluk: ZorBuilding and Managing Infrastructure as Code (IaC)

A renewable energy grid platform provisions its multi-project Google Cloud environment using Terraform managed through an automated continuous integration pipeline. During an unannounced operational incident, an on-call engineer manually altered a Cloud Storage telemetry bucket retention policy and added a Compute Engine VPC firewall rule via the Google Cloud Console. The Cloud Architecture team needs to reconcile this out-of-band infrastructure drift, align the codebase with the actual environment, and prevent future manual drift while preserving state concurrency and security best practices. Which approach should the team take?

  1. Run `terraform plan` to analyze the drift, update the Terraform configuration files to incorporate the required changes (or reject unintended modifications), and execute `terraform apply` through the automated pipeline using a dedicated service account configured with Workload Identity Federation and least-privilege IAM roles against a Cloud Storage state backend with object versioning and state locking enabled.Cevap
  2. B
    Manually revert the Cloud Storage retention policy and remove the VPC firewall rule using the Google Cloud Console before triggering the automated deployment pipeline to ensure the live environment matches the existing un-updated HCL code.
  3. C
    Download the active remote state file to an engineer's local workstation, manually modify the JSON state mapping to include the manual console resources, and re-upload the state file to Cloud Storage without acquiring an state lock.
  4. D
    Grant the CI/CD pipeline service account the Owner primitive role across all Google Cloud projects so that subsequent `terraform apply` executions can forcibly overwrite drifted resources without encountering permission failures.

Cevap

Run `terraform plan` to identify configuration drift, update the declarative configuration files to reflect the intended state, and execute `terraform apply` via a CI/CD pipeline using Workload Identity Federation with least-privilege IAM roles against a Cloud Storage backend configured with versioning and state locking.
The correct approach enforces Infrastructure as Code (IaC) governance by using `terraform plan` to detect infrastructure drift, updating the HCL code repository to re-establish a single source of truth, and executing deployments strictly through automated CI/CD pipelines. Authenticating via Workload Identity Federation avoids long-lived service account keys, using least-privilege IAM roles minimizes security exposure, and leveraging Cloud Storage with state locking and versioning guarantees state integrity and concurrency protection.

Adım Adım Çözüm

1
Detect Infrastructure Drift
Execute `terraform plan` in the pipeline to compare the real-world infrastructure state against the declarative HCL configuration and identify out-of-band changes.
Declarative IaC workflows require identifying discrepancies between live cloud resources and the state file before taking corrective action.
2
Reconcile Configuration Code
Update the Terraform HCL codebase to include valid manual emergency fixes (e.g., updated bucket retention rules) or adjust code to safely delete unauthorized additions upon apply.
The version-controlled repository must remain the single source of truth for all cloud infrastructure definitions.
3
Enforce Pipeline Governance & State Locking
Apply updates exclusively via CI/CD using short-lived Workload Identity Federation tokens and fine-grained IAM roles, storing remote state in Cloud Storage with state locking and object versioning.
Prevents concurrency conflicts, state corruption, and security risks associated with primitive IAM permissions or manual console modifications.

Anahtar Kavram

IaC Drift Detection, Remote State Management, and CI/CD Governance
Bu soruyu puanla

Konular

Building and Managing Infrastructure as Code (IaC)

Bu konudan daha fazla soru