Examkin

Soru

Zorluk: ZorImplementing Infrastructure as Code using Terraform and Deployment Manager

An enterprise platform engineering team is designing an automated continuous integration and continuous deployment (CI/CD) framework to provision Google Cloud infrastructure across multiple target projects using Terraform. The security architecture requires that pipeline runners execute without static service account keys, state management prevents concurrent runs and state corruption, and deployments follow the principle of least privilege. Which architectural implementation best meets these requirements?

  1. Configure a centralized Google Cloud Storage bucket with object versioning enabled for the Terraform backend, and authenticate pipeline runners using Workload Identity Federation to impersonate a service account assigned fine-grained predefined or custom IAM roles on target resources.Cevap
  2. B
    Store Terraform state files in a shared local repository directory synchronized across pipeline build nodes, and assign the primitive Owner role to the deployment service account to ensure all infrastructure provisioning operations succeed without credential failure.
  3. C
    Configure a Google Cloud Storage bucket for Terraform state management, export a long-lived service account JSON key into CI/CD secrets variables, and grant the service account the primitive Editor role across all managed target projects.
  4. D
    Configure a Google Cloud Storage bucket for Terraform remote state, and grant the Service Account Admin role directly to pipeline execution users so they can dynamically generate and rotate credentials during each plan and apply workflow.

Cevap

Configure a centralized Google Cloud Storage bucket with object versioning enabled for the Terraform backend, and authenticate pipeline runners using Workload Identity Federation to impersonate a service account assigned fine-grained predefined or custom IAM roles on target resources.
The solution leveraging a Cloud Storage bucket with object versioning alongside Workload Identity Federation provides native state locking, protection against accidental state deletion, zero static key management overhead, and adherence to least-privilege IAM controls.

Adım Adım Çözüm

1
Analyze State Management Requirements
Identify that Cloud Storage remote backends with object versioning and state locking are required to prevent concurrency conflicts and allow recovery from corrupted states.
Terraform remote backends natively support locking via Cloud Storage, which prevents simultaneous pipeline executions from mutating state.
2
Evaluate Authentication Mechanism
Select Workload Identity Federation over static JSON keys.
Workload Identity Federation removes the operational and security burden of managing and rotating long-lived service account keys by exchanging external identity tokens for short-lived GCP tokens.
3
Evaluate IAM Role Scoping
Assign fine-grained predefined or custom IAM roles to the deployment service account.
Using least-privilege roles prevents unauthorized modifications and limits blast radius compared to granting broad primitive Editor or Owner roles.

Anahtar Kavram

Terraform Remote Backend & Workload Identity Federation Governance
Bu soruyu puanla

Konular

Implementing Infrastructure as Code using Terraform and Deployment Manager

Bu konudan daha fazla soru