Examkin

Soru

Zorluk: ZorContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

A financial services organization is implementing a CI/CD pipeline using Cloud Build to automate the deployment of multi-tier cloud infrastructure defined in Terraform. The security team requires that the pipeline strictly enforce least-privilege security controls and prevent credentials exposure when creating resources and deploying applications under specific workload service accounts. Which architectural approach should the cloud architect choose for the Cloud Build pipeline configuration?

  1. Configure Cloud Build to execute using a dedicated custom pipeline service account with specific resource permissions, and grant this pipeline service account the Service Account User role on the target runtime service accounts.Cevap
  2. B
    Assign the primitive Editor role to the default Cloud Build service account at the organization level to ensure all Terraform resource creation commands complete without permission errors.
  3. C
    Grant the pipeline service account the Service Account Admin role on the target workload service accounts so that Cloud Build can generate and manage temporary JSON service account keys during execution.
  4. D
    Configure Cloud Build steps to store Terraform state files locally in the build container's ephemeral workspace directory to optimize build speed and prevent remote backend unauthorized access.

Cevap

The optimal strategy is to run Cloud Build using a dedicated custom service account assigned minimal specific permissions, and grant that custom service account the Service Account User role (`roles/iam.serviceAccountUser`) on the target workload service accounts.
Running Cloud Build with a dedicated custom service account configured with granular, minimal permissions meets enterprise security compliance. Granting `roles/iam.serviceAccountUser` on specific target workload identities allows the pipeline service account to attach those identities to newly deployed resources (such as GKE nodes or Cloud Run services) without requiring administrative rights over service accounts or excessive primitive roles.

Adım Adım Çözüm

1
Analyze security and governance requirements for CI/CD deployment execution.
Identified that least-privilege access and secure workload deployment require isolating pipeline execution credentials from target compute identities.
Default or overly permissive service accounts expose the environment to security risks and audit non-compliance.
2
Evaluate IAM role bindings required for CI/CD automation of compute and storage resources.
Determined that the `roles/iam.serviceAccountUser` role permits Cloud Build to attach specified target service accounts to resources without needing full administrative control over those identities.
This separation enforces least privilege and avoids the risks associated with primitive roles or key generation.
3
Verify state management strategy for Terraform within Cloud Build pipelines.
Confirmed that remote versioned Cloud Storage backends with state locking must be used rather than ephemeral local disk storage.
Remote state backends prevent concurrent pipeline executions from causing state corruption and loss of infrastructure tracking.

Anahtar Kavram

CI/CD Pipeline Security and Least-Privilege IAM Design with Cloud Build
Bu soruyu puanla

Konular

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

Bu konudan daha fazla soru