An enterprise DevOps team is designing an automated workflow to ingest and process Google Cloud Recommender suggestions across multiple production projects within their GitOps CI/CD pipeline. The governance policy defines the following criteria: Low-risk operating system and runtime compliance baselines must be automatically remediated and enforced. High-risk security modifications (such as reducing over-privileged permissions identified by IAM Recommender or changing Cloud Service Mesh authorization policies) must be classified for human review via peer-reviewed pull requests rather than being applied directly. The CI/CD pipeline service account must follow the principle of least privilege for recommendation discovery. Which workflow and configuration should the team implement?

Assign the CI/CD pipeline runner service account the recommender.viewer role to query recommendations; implement an automated job that classifies risk, uses VM Manager OS Policies in ENFORCEMENT mode for low-risk compliance baselines, and generates pull requests in the infrastructure repository for high-risk IAM and security policy changes.: ### What the Recommended Workflow Is This solution establishes a secure, GitOps-aligned automation architecture that uses **Google Cloud Recommender** APIs to discover optimization and security insights, classifies them based on operational risk, and applies distinct remediation paths for automated enforcement versus human-in-the-loop review. ### How It Meets the Requirements - **Principle of Least Privilege**: Granting the pipeline service account the `roles/recommender.viewer` role allows the CI/CD worker to inspect and ingest recommendation payloads across projects without conferring broad write or administrative access. - **Automated Low-Risk Remediation**: Deploying **VM Manager OS Policies** in `ENFORCEMENT` mode ensures runtime and OS compliance configurations (such as baseline CIS benchmark settings) are automatically validated and brought into compliance across VMs without manual intervention. - **Human Review for High-Risk Changes**: Routing IAM Recommender suggestions and **Cloud Service Mesh** authorization policy modifications through pull requests preserves infrastructure-as-code (IaC) governance, enabling mandatory peer reviews, automated policy validation, and change audit trails prior to merging and deployment. ### Key Advantages and Capabilities - **Strict Governance Separation**: Differentiates non-disruptive compliance updates from high-impact permission revocations that could break live application service accounts. - **GitOps Consistency**: Prevents configuration drift by committing all structural security changes to version control rather than mutating cloud infrastructure out-of-band. - **Automated Drift Correction**: Continuously enforces host-level configuration policies via OS Config agents. - **Auditability**: Every IAM or service mesh adjustment is logged, reviewed, and versioned within Git pull request history. ### Why This Is Optimal Directly applying high-risk IAM changes via automated scripts introduces the danger of revoking critical service agent permissions or breaking microservice mesh communication. Using read-only Recommender permissions combined with pull-request workflows for high-risk items provides safety and auditability, while OS Policy enforcement handles repetitive baseline compliance efficiently.

Automate Gcp Recommender Cicd Governance | Professional Cloud DevOps Engineer

Automate Gcp Recommender Cicd Governance

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise DevOps team is designing an automated workflow to ingest and process Google Cloud Recommender suggestions across multiple production projects within their GitOps CI/CD pipeline.

The governance policy defines the following criteria:

Low-risk operating system and runtime compliance baselines must be automatically remediated and enforced.
High-risk security modifications (such as reducing over-privileged permissions identified by IAM Recommender or changing Cloud Service Mesh authorization policies) must be classified for human review via peer-reviewed pull requests rather than being applied directly.
The CI/CD pipeline service account must follow the principle of least privilege for recommendation discovery.

Which workflow and configuration should the team implement?

Assign the basic roles/owner role to the pipeline runner and configure VM Manager OS Policies in VALIDATE-ONLY mode for all systems while ignoring IAM recommendations.

Assign the CI/CD pipeline runner service account the recommender.viewer role to query recommendations; implement an automated job that classifies risk, uses VM Manager OS Policies in ENFORCEMENT mode for low-risk compliance baselines, and generates pull requests in the infrastructure repository for high-risk IAM and security policy changes.

Deploy GKE Enterprise Policy Controller to automatically modify and approve IAM bindings across the Google Cloud organization while configuring OS Policies to opt out of CIS benchmark checks.

Assign the CI/CD pipeline runner service account the recommender.iamAdmin role and configure a Cloud Function to automatically apply and claim all IAM Recommender recommendations directly via the API upon detection.

Professional Cloud DevOps Engineer

Automate Gcp Recommender Cicd Governance

Related questions