Exam Professional Cloud DevOps Engineer topic 1 question 132 discussion

Downloading and setting Env Variable has potential to expose such high-level access to users . where as a dedicated SA attached to VM does not expose any credentials at all. running tf by default would use SA attached to VM.

Not chosing C because this works, but involves manually managing the key, which can be error-prone and less secure compared to using attached service accounts.

Is not C: "Download and copy the secret key value..." lol

https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference#running-terraform-on-google-cloud

Go with A. C introduces risk that if anyone gets your downloaded key that they can spin up any resources they want.

Choose (option C). Creating a dedicated service account for the Terraform instance is a best practice as it allows for fine-grained control over permissions. By downloading and copying the secret key value to the GOOGLE_CREDENTIALS environment variable on the Jenkins server, you securely provide the necessary credentials to Terraform. This approach minimizes security risks associated with manual handling of secret keys and adheres to the principle of least privilege by assigning only the required IAM permissions to the dedicated service account for Terraform automation.

Vote C

using keys with the service account is against best practice but in this case it is the only answer that makes sense I guess...

C is the correct answer. A can't be since the terraform doesn't use the instance's service account for such operations. Think of it as running terraform on your local PC. You still need to somehow provide credentials to the cloud and envariable can be one of the solutions.

The best way to ensure that the Terraform Jenkins instance is authorized to create Google Cloud resources and follow Google-recommended practices is to create a dedicated service account for the Terraform instance and download and copy the secret key value to the GOOGLE_CREDENTIALS environment variable on the Jenkins server.

A is the answer.

I go for A as it looks to be the fundamental thing at least.