A financial enterprise is designing a secure continuous integration (CI) build pipeline on Google Cloud. The organization must comply with the Supply-chain Levels for Software Artifacts (SLSA) framework to achieve SLSA Level 3 compliance. The build architecture must satisfy the following requirements: Build environments must execute on isolated, ephemeral compute workers to eliminate post-build tampering and cross-build pollution. Build execution must occur in a dedicated Virtual Private Cloud (VPC) network without direct public internet egress. Build provenance must be automatically generated, signed, and verifiable for container images stored in Artifact Registry. Which Cloud Build architecture should you implement to satisfy these security requirements?

Configure Cloud Build private pools with VPC Service Controls and private worker peering, and store built images in Artifact Registry: What Cloud Build Private Pools and Provenance Are Cloud Build private pools are dedicated, isolated, and highly configurable worker pools hosted in a managed Google tenant project and peered directly with a customer's Virtual Private Cloud (VPC). Private pools provide isolated compute resources that run ephemeral build steps while preventing cross-build contamination and unwanted external egress. How It Meets the Requirements Ephemeral, isolated workers: Private pools assign dedicated worker virtual machines per build that are instantiated and destroyed ephemerally, fulfilling SLSA Level 3 build isolation requirements and mitigating tampering between consecutive builds. Isolated VPC and no public egress: By configuring private worker peering with an internal VPC and combining it with VPC Service Controls, build steps are completely restricted from reaching the public internet while securely communicating with private internal endpoints. Verifiable build provenance: Cloud Build automatically generates non-falsifiable, cryptographically verifiable build provenance for container artifacts pushed to Artifact Registry, capturing details such as source commit hash, build triggers, parameters, and cryptographic hashes of generated artifacts. Key Advantages and Capabilities SLSA Level 3 Compliance: Meets rigorous supply chain assurance criteria by establishing an isolated, ephemeral, and hermetic build service. Controlled Network Perimeters: Enables zero egress to the internet and enforces data loss prevention via VPC Service Controls. Tamper-Evident Attestation: Works seamlessly with Binary Authorization to enforce that only verified, provenance-backed container images deploy to Google Kubernetes Engine (GKE) or Cloud Run. Customizable Worker Sizing: Allows tailoring CPU, disk, and network throughput to suit specific pipeline compilation needs. Why This Is Optimal Using Cloud Build private pools with VPC integration provides the ideal combination of managed infrastructure, strict network segmentation, ephemeral execution environments, and native provenance generation required for enterprise software supply chain security.

StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Build Slsa3 Provenance Private Pools

Section: Securing software supply chain

A financial enterprise is designing a secure continuous integration (CI) build pipeline on Google Cloud. The organization must comply with the Supply-chain Levels for Software Artifacts (SLSA) framework to achieve SLSA Level 3 compliance.

The build architecture must satisfy the following requirements:

Build environments must execute on isolated, ephemeral compute workers to eliminate post-build tampering and cross-build pollution.
Build execution must occur in a dedicated Virtual Private Cloud (VPC) network without direct public internet egress.
Build provenance must be automatically generated, signed, and verifiable for container images stored in Artifact Registry.

Which Cloud Build architecture should you implement to satisfy these security requirements?

Configure Cloud Build private pools with VPC Service Controls and private worker peering, and store built images in Artifact Registry

Deploy a persistent self-hosted Jenkins server on a Compute Engine virtual machine with a static external IP address in your private subnet

Use default Cloud Build shared worker pools and configure custom build steps running local Docker-in-Docker daemons to manually output in-toto metadata files

Execute builds on an existing multi-tenant Google Kubernetes Engine cluster by using persistent volume claims to cache dependencies across build stages

Professional Cloud Architect

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Build Slsa3 Provenance Private Pools

Section: Securing software supply chain

The build architecture must satisfy the following requirements:

Build environments must execute on isolated, ephemeral compute workers to eliminate post-build tampering and cross-build pollution.
Build execution must occur in a dedicated Virtual Private Cloud (VPC) network without direct public internet egress.
Build provenance must be automatically generated, signed, and verifiable for container images stored in Artifact Registry.

Which Cloud Build architecture should you implement to satisfy these security requirements?

Configure Cloud Build private pools with VPC Service Controls and private worker peering, and store built images in Artifact Registry

Deploy a persistent self-hosted Jenkins server on a Compute Engine virtual machine with a static external IP address in your private subnet

Use default Cloud Build shared worker pools and configure custom build steps running local Docker-in-Docker daemons to manually output in-toto metadata files

Execute builds on an existing multi-tenant Google Kubernetes Engine cluster by using persistent volume claims to cache dependencies across build stages

Explanations

What Cloud Build Private Pools and Provenance Are

Cloud Build private pools are dedicated, isolated, and highly configurable worker pools hosted in a managed Google tenant project and peered directly with a customer's Virtual Private Cloud (VPC). Private pools provide isolated compute resources that run ephemeral build steps while preventing cross-build contamination and unwanted external egress.

How It Meets the Requirements

Ephemeral, isolated workers: Private pools assign dedicated worker virtual machines per build that are instantiated and destroyed ephemerally, fulfilling SLSA Level 3 build isolation requirements and mitigating tampering between consecutive builds.
Isolated VPC and no public egress: By configuring private worker peering with an internal VPC and combining it with VPC Service Controls, build steps are completely restricted from reaching the public internet while securely communicating with private internal endpoints.
Verifiable build provenance: Cloud Build automatically generates non-falsifiable, cryptographically verifiable build provenance for container artifacts pushed to Artifact Registry, capturing details such as source commit hash, build triggers, parameters, and cryptographic hashes of generated artifacts.

Key Advantages and Capabilities

SLSA Level 3 Compliance: Meets rigorous supply chain assurance criteria by establishing an isolated, ephemeral, and hermetic build service.
Controlled Network Perimeters: Enables zero egress to the internet and enforces data loss prevention via VPC Service Controls.
Tamper-Evident Attestation: Works seamlessly with Binary Authorization to enforce that only verified, provenance-backed container images deploy to Google Kubernetes Engine (GKE) or Cloud Run.
Customizable Worker Sizing: Allows tailoring CPU, disk, and network throughput to suit specific pipeline compilation needs.

Why This Is Optimal

Using Cloud Build private pools with VPC integration provides the ideal combination of managed infrastructure, strict network segmentation, ephemeral execution environments, and native provenance generation required for enterprise software supply chain security.

View source documentation

Professional Cloud Architect

Cloud Build Slsa3 Provenance Private Pools

Professional Cloud Architect

Cloud Build Slsa3 Provenance Private Pools

What Cloud Build Private Pools and Provenance Are

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions