A healthcare enterprise is implementing an automated deployment pipeline using Terraform to provision cloud storage infrastructure for HIPAA-regulated patient data. The platform architecture requires that infrastructure state files are strictly protected against concurrent modifications and state corruption. Additionally, the target storage buckets must adhere to corporate security governance for key management while protecting stored objects against accidental overwrites. Which two provisioning actions should the infrastructure team implement? (Select TWO)
- Configure a remote Cloud Storage backend for Terraform with object versioning enabled on the state bucket.Cevap
- Enable Object Versioning on the target data storage bucket and configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS.Cevap
- CMaintain the Terraform state in unversioned local directory storage to prevent remote network exposure of infrastructure state.
- DConfigure the target storage bucket to require Customer-Supplied Encryption Keys (CSEK) for all upload operations to keep raw keys on-premises.
Cevap
The team should configure a remote Cloud Storage backend for Terraform with object versioning enabled, and configure the target storage bucket with Object Versioning and Customer-Managed Encryption Keys (CMEK) via Cloud KMS.
Configuring a remote Cloud Storage backend for Terraform enforces automatic state locking and state retention via versioning, ensuring robust infrastructure state management. Combining Object Versioning with Customer-Managed Encryption Keys (CMEK) on the data storage bucket guarantees data recovery against accidental overwrites while adhering to corporate security and key rotation requirements through Cloud KMS.
Adım Adım Çözüm
Anahtar Kavram
Provisioning secure Cloud Storage buckets and managing Terraform remote state locking and key governance