Your enterprise is deploying an enterprise-grade Google Cloud foundation using the Cloud Foundation Toolkit (CFT) and Terraform. You need to establish the bootstrap pipeline architecture and Terraform state management according to Google-recommended practices. The deployment must satisfy the following technical requirements: Isolate and protect Terraform remote state files with history retention. Enable automated CI/CD execution using dedicated service accounts with least privilege across pipeline layers. Ensure downstream Terraform modules correctly maintain implicit resource dependency graphs. Which implementation should you choose?

Deploy the 0-bootstrap stage to create a seed project containing Cloud Storage buckets with Object Versioning enabled for Terraform state, configure privileged service accounts in the seed project for CI/CD execution, and ensure module outputs reference resource attributes rather than raw input variables.: ### What the Cloud Foundation Toolkit Bootstrap Architecture Is The **Cloud Foundation Toolkit (CFT)** deployment methodology uses a phased, layered approach to establish an enterprise cloud foundation. The initial stage, `0-bootstrap`, provisions the prerequisite infrastructure required to run automated GitOps pipelines securely, establishing isolated environments for continuous integration and continuous deployment (CI/CD) and state management. ### How It Meets the Requirements - **State Protection and History**: The `0-bootstrap` stage configures a dedicated **seed project** that hosts Google Cloud Storage (GCS) buckets for Terraform remote backends. Enabling **Object Versioning** on these state buckets prevents catastrophic data loss by preserving previous revisions of the state file across modifications. - **Automated CI/CD and Separation of Duties**: The seed project provisions dedicated, highly privileged service accounts that Cloud Build impersonates during automated pipeline runs. This cleanly separates the foundation pipeline from workload and infrastructure pipelines. - **Implicit Dependency Graphs**: Following CFT and Terraform best practices, module outputs in `outputs.tf` reference direct resource attributes (e.g., `google_compute_network.vpc.id`) rather than passing through input variables (e.g., `var.network_name`). This ensures Terraform accurately builds the **directed acyclic graph (DAG)** for resource creation order and dependency tracking. ### Key Advantages - **Blast Radius Reduction**: Separating state storage into a dedicated seed project isolates administrative state and credential access from day-to-day workload projects. - **Automated Recovery**: Cloud Storage Object Versioning ensures rollback capability if a state file is corrupted during concurrency collisions or bad applies. - **Reliable Ordering**: Attribute referencing in outputs prevents race conditions where Terraform attempts to provision dependent resources before upstream dependencies are ready. ### Why This Is Optimal This architecture establishes a secure, repeatable foundation baseline aligned with Google Cloud landing zone standards, ensuring complete auditability, immutability of historical state, and seamless dependency propagation across modular stages.

Cft Terraform Bootstrap State Management | Professional Cloud DevOps Engineer

Cft Terraform Bootstrap State Management

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise is deploying an enterprise-grade Google Cloud foundation using the Cloud Foundation Toolkit (CFT) and Terraform. You need to establish the bootstrap pipeline architecture and Terraform state management according to Google-recommended practices.

The deployment must satisfy the following technical requirements:

Isolate and protect Terraform remote state files with history retention.
Enable automated CI/CD execution using dedicated service accounts with least privilege across pipeline layers.
Ensure downstream Terraform modules correctly maintain implicit resource dependency graphs.

Which implementation should you choose?

Deploy the 0-bootstrap stage to create a seed project containing Cloud Storage buckets with Object Versioning enabled for Terraform state, configure privileged service accounts in the seed project for CI/CD execution, and ensure module outputs reference resource attributes rather than raw input variables.

Provision individual Cloud Storage state buckets on developer workstations using local shell scripts, and configure user credentials via gcloud CLI without centralized seed or CI/CD projects.

Consolidate the foundation, workload infrastructure, and application deployment layers into a single monolithic pipeline in the CI/CD project, utilizing local Terraform state files checked directly into source control.

Store all foundation and infrastructure state files in a single unversioned Cloud Storage bucket located in the organization common folder, and pass input variables directly through module outputs in outputs.tf to simplify variable propagation.

Professional Cloud DevOps Engineer

Cft Terraform Bootstrap State Management

Related questions