Examkin

Soru

Zorluk: ZorBuilding and Managing Infrastructure as Code (IaC)

A global logistics enterprise provisions its multi-project Google Cloud environment using Terraform managed through an automated external CI/CD pipeline. Security policy strictly forbids generating and storing long-lived service account JSON keys in CI/CD secrets. Additionally, operational guidelines mandate that Terraform state files are fully protected against concurrent pipeline execution conflicts and that previous state versions are preserved for recovery in case of state corruption. Which implementation strategy meets all security and operational requirements?

  1. Authenticate the CI/CD pipeline using Workload Identity Federation to impersonate a fine-grained service account, and store the state file in a Google Cloud Storage bucket with Object Versioning enabled using the native GCS backend.Cevap
  2. B
    Authenticate the CI/CD pipeline using a service account assigned the Editor primitive role, and store the Terraform state in a Cloud Storage bucket with uniform bucket-level access and Object Versioning disabled to reduce storage overhead.
  3. C
    Store the Terraform state file directly inside the version-controlled CI/CD Git repository workspace, and dynamically generate temporary service account JSON keys at the start of each pipeline execution job.
  4. D
    Authenticate the pipeline via Workload Identity Federation, but configure the deployment script to perform manual resource updates via gcloud commands whenever state locking fails to resolve state lock contention.

Cevap

Authenticate the CI/CD pipeline using Workload Identity Federation to impersonate a fine-grained service account, and store the state file in a Google Cloud Storage bucket with Object Versioning enabled using the native GCS backend.
Workload Identity Federation allows external CI/CD workloads to impersonate GCP service accounts securely using short-lived tokens, fulfilling keyless security requirements. Cloud Storage (GCS) backend provides native state locking to prevent concurrent modifications and Object Versioning preserves historical state revisions for disaster recovery.

Adım Adım Çözüm

1
Configure Workload Identity Federation on Google Cloud to map external CI/CD identity tokens to Google Cloud IAM service account identities.
Pipeline authenticates securely without storing long-lived service account JSON keys.
Meets enterprise security compliance for keyless authentication.
2
Configure the Terraform backend block to use the 'gcs' backend referencing a central Cloud Storage bucket.
Terraform state locks are managed natively via Cloud Storage object locking during execution.
Prevents race conditions and state corruption during concurrent pipeline runs.
3
Enable Object Versioning on the target Cloud Storage state bucket.
Historical state files are archived on every state file update.
Ensures state history is preserved for recovery in case of accidental state deletion or invalid state modifications.

Anahtar Kavram

Keyless authentication with Workload Identity Federation and GCS remote backend state locking/versioning
Bu soruyu puanla

Konular

Building and Managing Infrastructure as Code (IaC)

Bu konudan daha fazla soru