Google Cloud Professional Cloud Architect PCA — Topic 1 Question 249

Question

You are designing a central, automated infrastructure deployment process for your organization using Terraform and Cloud Build. The security team prohibits the use of long-lived, static service account keys in any CI/CD pipeline. Additionally, while developers can propose infrastructure changes for peer review, they must not have permissions to directly apply changes in the production project. You need to design a secure and automated workflow for applying Terraform changes that meets the security team's requirements and ensures proper governance. What should you do?

Accepted Answer

Correct answer: B. The correct answer is B. Option B: Use service account impersonation in Cloud Build. Configure the pipeline to run terraform plan on pull requests, and require manual approval before running terraform apply. A service account provides an identity for workloads to access Google Cloud APIs securely. Cloud Build runs managed CI pipelines to build, test, and package code. Terraform provisions Google Cloud infrastructure as code repeatably.

Google Cloud Professional Cloud Architect PCA — Question 249