Terraform Backend Configuration for Concurrent Access and Security
You are managing Google Cloud infrastructure with Terraform. The Terraform configuration files are stored in a Git repository. You need to implement a solution that enables multiple team members to work on the Terraform configurations concurrently without conflicts and ensures that sensitive values are not persisted to local machines. What should you do?
Community Insight
The core concept tested is the distinction between local and remote backends, with the common trap being the selection of local storage methods that fail to provide locking or security features.
This question addresses the critical role of Terraform backends in managing state files securely and enabling team collaboration. It establishes that a remote backend like Cloud Storage is required to prevent local state persistence and support concurrent operations.
Candidates often choose option C (storing state in Git) because they associate Git with version control, failing to realize that Git is not designed for binary state file locking and can expose sensitive data.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Configuring a Cloud Storage backend (Option B) allows Terraform to store the state file remotely. This setup typically integrates with Cloud Storage object versioning and lifecycle policies, but more importantly, it enables the use of backend-specific locking mechanisms (often via Cloud Datastore or Firestore alongside GCS, or native GCS locking if supported/configured correctly in modern setups) to prevent concurrent modifications. Crucially, storing the state remotely ensures that sensitive values (like passwords or API keys) are never written to the local filesystem of individual developers.Why the Other Options Are Wrong
Option A suggests using a shared bastion account, which violates the principle of least privilege and makes auditing impossible due to lack of individual attribution. Option C stores the state in Git, which is a bad practice because Git is not a database; it lacks transactional locking, leading to potential state corruption during concurrent edits, and Git history is not always encrypted by default, risking exposure of secrets. Option D relies on manual sharing, which is prone to human error, race conditions, and does not solve the security issue of local persistence.Community Comment Notes
Community feedback strongly supports Option B, highlighting that a remote backend is the standard solution for both concurrency (via locking) and security (avoiding local state files). One user noted that this configuration directly addresses the need to work concurrently without conflicts while keeping sensitive data off local machines.Exam Strategy
Always look for keywords like 'concurrent', 'team', and 'security' when selecting a Terraform backend. If multiple users are involved, a remote backend is almost always the correct choice over local storage.
Frequently Asked Questions
Why can't I store Terraform state in a Git repository?
Git is not designed for high-concurrency writes or locking. Storing state there can lead to corruption and may inadvertently commit sensitive plaintext secrets into version history.
Does Cloud Storage alone handle locking?
Cloud Storage provides durable object storage. For robust locking, it is often paired with Cloud Datastore/Firestore or uses backend-specific locking implementations provided by the Terraform provider.
Related Analysis
Practice All ACE Questions
Access 84 questions with complete answers and detailed explanations.
View Full ACE Practice Test →