A financial analytics firm is designing an automated CI/CD pipeline on Google Cloud to build container images and deploy microservices to Google Kubernetes Engine (GKE). The security team requires that only cryptographically verified build artifacts can be deployed, and that build execution environments are strictly isolated from the public internet to prevent data exfiltration. Which TWO design controls should you implement to satisfy these security requirements?
- Enable Binary Authorization on the GKE cluster and require attestations generated by Cloud Build and signed using Cloud KMS keys during the image creation phase.Cevap
- Run Cloud Build tasks inside private worker pools connected to a VPC network enclosed within a VPC Service Controls security perimeter.Cevap
- CAssign the primitive Owner role to the default Cloud Build service account across target projects to grant full access to cluster endpoints and container registries.
- DGrant the Service Account Admin role to the automated deployment pipeline service account so it can create and manage credentials during deployment.
Cevap
The pipeline should combine Binary Authorization with Cloud KMS attestation signing and utilize Cloud Build private worker pools within a VPC Service Controls perimeter.
Enforcing Binary Authorization policies tied to Cloud KMS attestation signatures ensures that only validated images are deployed to GKE. Utilizing Cloud Build private worker pools peered to private VPCs within a VPC Service Controls perimeter secures network traffic and blocks data exfiltration during execution.
Adım Adım Çözüm
Anahtar Kavram
Secure CI/CD Pipeline Design with Binary Authorization and Private Build Environments