You are designing a central, automated infrastructure deployment process for your organization using Terraform and Cloud Build. The security team prohibits the use of long-lived, static service…

Question

Options

• AConfigure the Cloud Build pipeline to use service account impersonation. Set up a trigger that
• BUse service account impersonation in Cloud Build. Configure the pipeline to run terraform plan on
• CConfigure the pipeline to only run terraform plan. After a pull request is approved, have an
• DCreate a privileged service account and store its JSON key in Secret Manager. Configure the

• A
  25% (9)
• B
  61% (22)
• C
  6% (2)
• D
  8% (3)

Explanation

Service account impersonation lets Cloud Build authenticate without storing long-lived keys, satisfying the security requirement. Running terraform plan on pull requests enables peer review without granting developers production apply permissions, and requiring a separate approval step before terraform apply enforces governance while keeping the apply action automated and controlled by the CI/CD pipeline identity.

No community discussion yet for this question.