A software company uses Cloud Build and Terraform to automate the provisioning of ephemeral testing environments in Google Cloud. During parallel build executions, the team occasionally experiences deployment race conditions and unauthorized IAM privilege escalation risks. You need to implement infrastructure as code (IaC) governance practices to ensure reliable provisioning and secure state management. Which TWO actions should you take? (Select TWO answers.)
- Configure the Terraform backend to use a Google Cloud Storage bucket with object versioning and state locking enabled.Cevap
- Grant the Cloud Build service account targeted predefined roles and the Service Account User role on required deployment service accounts.Cevap
- CStore Terraform state files on the local ephemeral disk of the Cloud Build execution runner to maximize state write speeds.
- DAssign the Owner primitive IAM role to the Cloud Build service account to ensure uninhibited provisioning of all cloud resources.
Cevap
Configure the Terraform backend to use a Google Cloud Storage bucket with object versioning and state locking, and grant the Cloud Build service account targeted predefined roles along with the Service Account User role.
Configuring a Google Cloud Storage remote backend with state locking ensures that concurrent automated workflows safely mutate infrastructure state without causing state file corruption or deployment race conditions. Furthermore, granting targeted predefined roles and the Service Account User role to the Cloud Build runner enforces the principle of least privilege while allowing legitimate resource provisioning through service account impersonation.
Adım Adım Çözüm
Anahtar Kavram
Reliable Infrastructure as Code Environment Provisioning
Tahmini Süre:2m 0s