GCP Professional Cloud Architect Practice Question

Your company uses Cloud Build to execute Terraform plans that provision GKE clusters and Cloud Storage buckets inside a production project. Security policy mandates that automation must follow the principle of least privilege and avoid unlimited permissions if the build pipeline is ever compromised. Which IAM approach best satisfies these requirements while still allowing Terraform to create and manage the necessary resources?

Grant the Cloud Build default service account the Project Owner role so Terraform can manage any resource it needs during the build.
Allow each developer's personal Google account the Service Account Token Creator (serviceAccountUser) role so they can impersonate the production service account when they trigger the build.
Create a dedicated service account for Terraform, grant it only the specific roles required to manage GKE and Cloud Storage, and configure Cloud Build to impersonate this service account when running terraform apply.
Generate a JSON key for a user-managed service account with the Project Editor role, store the key in Secret Manager, and have Cloud Build use the key to authenticate Terraform.

Report Issue

Answer Description

Creating a dedicated service account for Terraform and granting it only the specific predefined roles it needs (for example, roles/container.admin and roles/storage.admin) enforces least-privilege access. Configuring Cloud Build to impersonate that account lets the pipeline obtain short-lived, scoped credentials at runtime, eliminating the need to store long-lived keys and preventing the service from acquiring broader permissions than required.

Granting Owner or Editor on the project violates least-privilege by giving excessive rights. Allowing individual developers to impersonate the production account broadens the attack surface and also conflicts with separation-of-duties requirements. Storing a JSON key for a highly privileged account in Secret Manager still risks key leakage and does not restrict the account's capabilities. Therefore, the dedicated, narrowly scoped service account with impersonation is the most secure and compliant choice.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.