Your enterprise DevOps team is establishing an automated CI/CD pipeline in Google Cloud Build to produce secure, immutable golden VM images for Compute Engine workloads using HashiCorp Packer. The pipeline must satisfy the following architectural and security requirements: Adhere strictly to the principle of least privilege for the automated pipeline identity. Automatically compile and execute the Packer template within Cloud Build to bake the operating system and dependencies. Organize the generated images systematically so downstream deployment pipelines can automatically reference the latest version. Which configuration and IAM permission setup should you implement?

Submit the community Packer builder to your project registry, grant the Compute Engine Instance Admin role (roles/compute.instanceAdmin.v1) to the Cloud Build service account, and configure cloudbuild.yaml to invoke packer build with image family and project parameters.: What the Cloud Build and Packer Pipeline Solution Is Automating golden machine image creation with HashiCorp Packer inside Google Cloud Build enables declarative, reproducible, and immutable VM image lifecycles. Cloud Build executes containerized build steps, using a prebuilt Packer builder container image stored in Artifact Registry or Container Registry to provision temporary instances, install hardened dependencies, and package the resulting disk into a Compute Engine image. How It Meets the Requirements Principle of Least Privilege: Granting the Compute Engine Instance Admin (roles/compute.instanceAdmin.v1) role provides the necessary permissions to create, run, and delete temporary VM build instances and register machine images, without granting overly permissive roles like roles/editor or roles/owner. Automated Packer Execution: Building and submitting the Packer community builder allows Cloud Build to natively run packer build inside the execution container, passing necessary project, zone, and template parameters directly through cloudbuild.yaml. Downstream Referencing: Grouping generated images under a designated image_family parameter ensures that downstream deployment tooling (like Terraform, MIG templates, or deployment scripts) can always query and reference the newest active image in the family. Key Advantages and Capabilities Immutable Infrastructure: Guarantees that every provisioned Compute Engine instance runs a standardized, pre-tested software stack. CI/CD Integration: Seamlessly integrates into automated trigger workflows upon source code updates or scheduled monthly base image updates. Centralized Image Cataloging: Using image families simplifies rolling updates and automated rollbacks across development, staging, and production environments. Auditability and Governance: Centralizes build logs and provenance in Cloud Build while enforcing organizational IAM constraints. Why This Is Optimal This solution implements Google Cloud best practices for image baking by leveraging containerized build steps and scoped predefined IAM roles. It eliminates manual intervention and prevents broad administrative privilege escalation across the cloud environment.