Centralized Custom Image Compliance Baseline

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise organization requires all development teams across multiple Google Cloud projects to provision Compute Engine virtual machines exclusively from standardized, security-hardened base images. These images must embed organizational security policies, required logging agents, and baseline development tooling from inception.

You need to establish an automated, centralized image architecture and governance strategy that meets the following requirements:

Centralizes image creation, curation, and storage in a dedicated project
Allows developers across various application projects to provision instances using the latest compliant image version without modifying deployment scripts
Strictly prevents teams from provisioning VM instances using unapproved public images
Adheres to the principle of least privilege for Identity and Access Management (IAM)

What should you do?

Create and maintain hardened custom images organized into an image family within a dedicated central project. Enforce an organization policy with the Trusted Image Projects constraint to restrict VM creation across development projects to that central project, and grant developers the Compute Image User role (roles/compute.imageUser) on the central project.

Bake hardened custom images in a central project and make them publicly accessible by adding allAuthenticatedUsers with the Compute Image User role (roles/compute.imageUser), while distributing image release IDs to development teams for their provisioning scripts.

Provision standard public OS images across all development projects and attach a startup script in instance templates to download, install, and configure the required security agents and baseline tooling during VM initialization.

Export custom images from a build project to Cloud Storage buckets as compressed tar.gz archives, give developers Storage Object Viewer permissions, and have each team import the raw image file into their respective project.

Professional Cloud DevOps Engineer

Centralized Custom Image Compliance Baseline

Related questions