Your enterprise DevOps team is establishing an automated CI/CD pipeline in Google Cloud Build to produce secure, immutable golden VM images for Compute Engine workloads using HashiCorp Packer. The pipeline must satisfy the following architectural and security requirements: Adhere strictly to the principle of least privilege for the automated pipeline identity. Automatically compile and execute the Packer template within Cloud Build to bake the operating system and dependencies. Organize the generated images systematically so downstream deployment pipelines can automatically reference the latest version. Which configuration and IAM permission setup should you implement?

Submit the community Packer builder to your project registry, grant the Compute Engine Instance Admin role (roles/compute.instanceAdmin.v1) to the Cloud Build service account, and configure cloudbuild.yaml to invoke packer build with image family and project parameters.: ### What the Cloud Build and Packer Pipeline Solution Is Automating golden machine image creation with **HashiCorp Packer** inside **Google Cloud Build** enables declarative, reproducible, and immutable VM image lifecycles. Cloud Build executes containerized build steps, using a prebuilt Packer builder container image stored in **Artifact Registry** or **Container Registry** to provision temporary instances, install hardened dependencies, and package the resulting disk into a Compute Engine image. ### How It Meets the Requirements - **Principle of Least Privilege**: Granting the **Compute Engine Instance Admin** (`roles/compute.instanceAdmin.v1`) role provides the necessary permissions to create, run, and delete temporary VM build instances and register machine images, without granting overly permissive roles like `roles/editor` or `roles/owner`. - **Automated Packer Execution**: Building and submitting the Packer community builder allows Cloud Build to natively run `packer build` inside the execution container, passing necessary project, zone, and template parameters directly through `cloudbuild.yaml`. - **Downstream Referencing**: Grouping generated images under a designated `image_family` parameter ensures that downstream deployment tooling (like Terraform, MIG templates, or deployment scripts) can always query and reference the newest active image in the family. ### Key Advantages and Capabilities - **Immutable Infrastructure**: Guarantees that every provisioned Compute Engine instance runs a standardized, pre-tested software stack. - **CI/CD Integration**: Seamlessly integrates into automated trigger workflows upon source code updates or scheduled monthly base image updates. - **Centralized Image Cataloging**: Using image families simplifies rolling updates and automated rollbacks across development, staging, and production environments. - **Auditability and Governance**: Centralizes build logs and provenance in Cloud Build while enforcing organizational IAM constraints. ### Why This Is Optimal This solution implements Google Cloud best practices for image baking by leveraging containerized build steps and scoped predefined IAM roles. It eliminates manual intervention and prevents broad administrative privilege escalation across the cloud environment.

Cloud Build Packer Golden Image Pipeline | Professional Cloud DevOps Engineer

Cloud Build Packer Golden Image Pipeline

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise DevOps team is establishing an automated CI/CD pipeline in Google Cloud Build to produce secure, immutable golden VM images for Compute Engine workloads using HashiCorp Packer.

The pipeline must satisfy the following architectural and security requirements:

Adhere strictly to the principle of least privilege for the automated pipeline identity.
Automatically compile and execute the Packer template within Cloud Build to bake the operating system and dependencies.
Organize the generated images systematically so downstream deployment pipelines can automatically reference the latest version.

Which configuration and IAM permission setup should you implement?

Grant the Compute Image User role (roles/compute.imageUser) to the Cloud Build service account, and configure a Cloud Build step that executes startup scripts directly on live production VMs to configure dependencies in place.

Deploy Jenkins on a Compute Engine instance with full Cloud Platform API scopes, install the GKE plugin, and use kpt to render Kubernetes manifests into disk images.

Submit the community Packer builder to your project registry, grant the Compute Engine Instance Admin role (roles/compute.instanceAdmin.v1) to the Cloud Build service account, and configure cloudbuild.yaml to invoke packer build with image family and project parameters.

Grant the Project Editor role (roles/editor) to the default Compute Engine service account, and run a bash script step in Cloud Build that installs the Packer binary on the fly and creates standalone unversioned images.

Professional Cloud DevOps Engineer

Cloud Build Packer Golden Image Pipeline

Related questions