An enterprise organization wants to streamline infrastructure provisioning on Google Cloud while eliminating manual interventions. Currently, engineers execute terraform apply directly from their local workstations, leading to configuration drift and inconsistent environments between staging and production. The cloud architecture team establishes the following governance and operational requirements: All infrastructure changes must be managed as code in a centralized Git repository. Proposed configuration changes must be automatically previewed and validated during code review before merging. Deployments must be automated via continuous integration and delivery (CI/CD) pipelines, ensuring changes are deployed and verified in the dev environment prior to promotion to prod. Remote state files must be centrally maintained and protected. How should you design this automated provisioning workflow?

Configure remote Terraform state in a Cloud Storage bucket, create Cloud Build pull request triggers to run `terraform plan` for automated validation, and configure branch triggers so merging into `dev` applies changes to the development environment, followed by merging `dev` into `prod` to apply changes to production.: ### What a GitOps Infrastructure Workflow Is A **GitOps infrastructure workflow** uses a version-controlled Git repository as the single source of truth for infrastructure configuration, paired with automated CI/CD tools such as **Cloud Build** to execute Terraform commands predictably and reliably across environments. ### How it Meets the Stated Requirements - **Automated Validation and Code Review**: By configuring Cloud Build triggers on pull requests (PRs) from feature branches, the pipeline automatically executes `terraform plan`. Collaborators can inspect the generated execution plan directly on the pull request before any code is merged, preventing unintended changes from entering the codebase. - **Controlled Promotion (`dev` to `prod`)**: Merging approved pull requests into the `dev` branch triggers a Cloud Build job that executes `terraform apply` against the development environment. Once verified in `dev`, a subsequent pull request merges the `dev` branch into `prod`, triggering an automated `terraform apply` in the production environment. - **Reduced Manual Intervention and Consistency**: Provisioning is fully offloaded to automated pipelines, removing the need for local workstation execution, reducing human error, and ensuring both development and production environments strictly reflect committed code. - **Central State Management**: Storing state remotely in a **Cloud Storage bucket** ensures team-wide state locking, prevents local state corruption, and enables headless pipeline executions. ### Key Advantages and Capabilities - **Auditability and Traceability**: Every infrastructure deployment is tied directly to a specific commit hash and approved pull request in Git. - **Automated Pre-flight Checks**: Changes are previewed (`terraform plan`) and validated against policies before actuation. - **Standardized CI/CD Integration**: Seamless integration with Google Cloud IAM and service accounts ensures least-privilege deployment execution. ### Why This Is Optimal This architecture adheres to Google Cloud's recommended GitOps blueprint for Infrastructure as Code. It establishes strict environment isolation, prevents configuration drift, and ensures changes are validated before impacting production workloads.

StudyCerts

Automated Iac Gitops Terraform Cloud Build | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Automated Iac Gitops Terraform Cloud Build

Section: Service catalog and provisioning

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise organization wants to streamline infrastructure provisioning on Google Cloud while eliminating manual interventions. Currently, engineers execute terraform apply directly from their local workstations, leading to configuration drift and inconsistent environments between staging and production.

The cloud architecture team establishes the following governance and operational requirements:

All infrastructure changes must be managed as code in a centralized Git repository.
Proposed configuration changes must be automatically previewed and validated during code review before merging.
Deployments must be automated via continuous integration and delivery (CI/CD) pipelines, ensuring changes are deployed and verified in the dev environment prior to promotion to prod.
Remote state files must be centrally maintained and protected.

How should you design this automated provisioning workflow?

Configure remote Terraform state in a Cloud Storage bucket, create Cloud Build pull request triggers to run terraform plan for automated validation, and configure branch triggers so merging into dev applies changes to the development environment, followed by merging dev into prod to apply changes to production.

Store Terraform state files locally on individual developer workstations, and configure Cloud Build triggers to pull state files over SSH during pipeline execution before deploying to production.

Configure a single Cloud Build trigger on the main branch that executes terraform plan and terraform apply -auto-approve simultaneously against both development and production projects whenever a commit is pushed.

Migrate all Terraform configurations to Cloud Deployment Manager templates, and configure developers to run gcloud deployment-manager deployments create manually using deployment previews.

Professional Cloud Architect

Automated Iac Gitops Terraform Cloud Build

Related questions