A gaming studio's backend platform team is establishing automated infrastructure deployment pipelines using Infrastructure as Code (IaC) to provision Compute Engine instance groups and Cloud SQL instances. The lead cloud architect must advise the operations team on securing pipeline credentials and persisting deployment state safely with minimal operational overhead. Which TWO recommendations should the architect provide? (Select TWO)
- Configure the IaC backend to store state files in a Cloud Storage bucket with Object Versioning enabled.Cevap
- Grant the CI/CD pipeline deployment service account the Service Account User role (roles/iam.serviceAccountUser) on the target service account attached to compute instances.Cevap
- CStore state files locally within the CI/CD runner container filesystem to eliminate network dependencies during deployment.
- DAssign the primitive Editor role (roles/editor) to the deployment service account at the project level to guarantee broad deployment privileges.
- EGrant developer identity accounts the Service Account Admin role (roles/iam.serviceAccountAdmin) so they can directly modify credentials during pipeline failures.
Cevap
The architect should recommend configuring the Infrastructure as Code backend to store state in a Cloud Storage bucket with Object Versioning enabled, and granting the deployment service account the Service Account User role on the target instance service account.
Centralizing Infrastructure as Code state in Cloud Storage with Object Versioning enables automated locking and version history, preventing concurrent state corruption. Additionally, granting the Service Account User role to the deployment pipeline service account allows it to bind target workload service accounts to Compute Engine instances under the principle of least privilege.
Adım Adım Çözüm
Anahtar Kavram
Best practices for Infrastructure as Code state management and least privilege IAM delegation for dev/ops deployment pipelines.