Exam Associate Cloud Engineer topic 1 question 247 discussion

It seems, you all just use chat gpt to get the answer. But did you even notice it says one they need to move only one pipeline?

Option D combines the principle of least privilege with granular permissions, secure credential management, and controlled access during pipeline execution.

Options A and C both involve attaching a single service account to the compute instances, which goes against the principle of least privilege and increases the risk if that single account is compromised. Option B introduces human approval into the CI/CD pipeline, which could slow down the deployment process and might not be feasible for fully automated deployments. Therefore, option D is the most suitable choice for ensuring both security and efficiency in the CI/CD pipeline setup.

Principle of Least Privilege: Creating separate service accounts for different aspects of your CI/CD pipeline allows you to adhere to the principle of least privilege. This means each service account is granted only the permissions necessary for its specific role in the pipeline. Security and Organization: Using multiple service accounts makes it easier to manage permissions, track activities, and audit usage for specific tasks or components of your CI/CD process. Secret Management: Storing the service account key files in a secret manager service (like Google Cloud Secret Manager) enhances security. This approach securely manages and accesses these keys, reducing the risk of unauthorized access or exposure. Dynamic Access: Allowing the CI/CD pipeline to request the appropriate secrets during execution ensures that credentials are provided only when needed and aren't unnecessarily exposed or stored in less secure environments.

ChatGPT says Option D, By following this approach, you can ensure that your CI/CD pipeline has appropriate permissions while adhering to security best practices, including the principle of least privilege and secure management of credentials.