Your organization is rolling out a new continuous integration and delivery (CI/CD) process to deploy infrastructure and applications in Google Cloud. Many teams will use their own instances of the…

Question

Options

• A
  1. Create two service accounts, one for the infrastructure and one for the application deployment.
• B
  1. Create a dedicated service account for the CI/CD pipelines.
• C
  1. Create individual service accounts for each deployment pipeline.
• D
  1. Create service accounts for each deployment pipeline.

• A
  78% (28)
• B
  6% (2)
• C
  14% (5)
• D
  3% (1)

Explanation

Creating two service accounts - one for infrastructure deployment and one for application deployment - follows the principle of least privilege and separation of duties. The infrastructure service account needs broader permissions (e.g., creating VPCs, GKE clusters), while the application deployment account needs narrower permissions (e.g., deploying container images). Option B (single account for all pipelines) grants excessive shared permissions. Options C and D (per-pipeline accounts) are operationally impractical at scale across many teams and add unnecessary complexity without meaningful security benefit. Two purpose-scoped accounts strike the right balance between security and manageability.

No community discussion yet for this question.