Terraform Backend Configuration for Concurrent Access and Security
Short answer
B Configure a Cloud Storage backend in Terraform to manage state remotely, ensuring secure access and conflict-free concurrency for multiple team members.
Question
Key Takeaways
The core concept tested is the distinction between local and remote backends, with the common trap being the selection of local storage methods that fail to provide locking or security features.
This question addresses the critical role of Terraform backends in managing state files securely and enabling team collaboration. It establishes that a remote backend like Cloud Storage is required to prevent local state persistence and support concurrent operations.
Common mistake: Candidates often choose option C (storing state in Git) because they associate Git with version control, failing to realize that Git is not designed for binary state file locking and can expose sensitive data.
Expert Analysis
Why the Answer Is Correct
Configuring a Cloud Storage backend (Option B) allows Terraform to store the state file remotely. This setup typically integrates with Cloud Storage object versioning and lifecycle policies, but more importantly, it enables the use of backend-specific locking mechanisms (often via Cloud Datastore or Firestore alongside GCS, or native GCS locking if supported/configured correctly in modern setups) to prevent concurrent modifications. Crucially, storing the state remotely ensures that sensitive values (like passwords or API keys) are never written to the local filesystem of individual developers.
Why the Other Options Are Wrong
Option A suggests using a shared bastion account, which violates the principle of least privilege and makes auditing impossible due to lack of individual attribution. Option C stores the state in Git, which is a bad practice because Git is not a database; it lacks transactional locking, leading to potential state corruption during concurrent edits, and Git history is not always encrypted by default, risking exposure of secrets. Option D relies on manual sharing, which is prone to human error, race conditions, and does not solve the security issue of local persistence.
Community Comment Notes
Community feedback strongly supports Option B, highlighting that a remote backend is the standard solution for both concurrency (via locking) and security (avoiding local state files). One user noted that this configuration directly addresses the need to work concurrently without conflicts while keeping sensitive data off local machines.
Exam Strategy
Always look for keywords like 'concurrent', 'team', and 'security' when selecting a Terraform backend. If multiple users are involved, a remote backend is almost always the correct choice over local storage.
Frequently Asked Questions
Why can't I store Terraform state in a Git repository?
Does Cloud Storage alone handle locking?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Mr_MIXER007 👍 1 Answered BB (Configure a Cloud Storage backend in Terraform). «work... concurrently without conflicts» «sensitive values are not persisted to local machines»
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All ACE Questions
Access 84 questions with complete answers and detailed explanations.
View Full ACE Practice Test →