What's changed: Created Professional Cloud Architect Chapter 3 (Domain 2 "Manage and provision" part 1: IaC = Terraform/Infrastructure Manager, state/modules, CI/CD/PR, avoid clickops, Config Connector; networking = VPC/subnets/firewall, Shared VPC, load balancer types, Cloud NAT, Private Google Access, VPC Service Controls).
3.1Provisioning with Infrastructure as Code
Understand reproducible provisioning with Infrastructure as Code (Terraform, Infrastructure Manager), state management and modularization, integration into CI/CD, and avoiding manual clickops to gain consistency and reviewability.
Once the design is set, build infrastructure reproducibly and reviewably. Manual clickops breeds errors and drift. The architect designs operations around Infrastructure as Code (IaC).
3.1.1IaC tools and state management
In Google Cloud, define infrastructure as code with industry-standard Terraform or its managed form Infrastructure Manager. Code maps to real resources via state, and modules structure it for reuse. This lets you reproduce the same setup across environments (prod/dev), with changes reviewed via pull requests. Map "reproducible infrastructure = IaC (Terraform/Infrastructure Manager)."
3.1.2Integrating into CI/CD and consistency
Integrate IaC into CI/CD pipelines (e.g., Cloud Build) to validate and apply changes automatically. This makes who-changed-what-when traceable (audit) and governs production changes. Avoid manual changes that cause drift (code vs. reality divergence), keeping IaC the single source of truth. Map "consistency, audit, governance = IaC in CI/CD" and "manual changes cause drift."
Common: requirement → means. E.g., "reproduce the same setup across environments" = IaC + modules; "review/track changes" = IaC in CI/CD + PRs; "managed Terraform" = Infrastructure Manager; "prevent clickops drift" = make IaC the single source of truth; "manage GCP resources the Kubernetes way" = Config Connector.
Watch the mix-ups: (1) Manual changes cause drift from IaC—change via IaC by default. (2) Design protection/sharing of state (remote backend). (3) Infrastructure Manager is managed Terraform execution, not a different language replacing Terraform.
3.1.3Section summary
- IaC = Terraform/Infrastructure Manager codify infrastructure for reproducibility
- Structure with state and modules; validate/review/audit via CI/CD + PRs
- Manual clickops causes drift; keep IaC the single source of truth
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To reproducibly build the same infrastructure in prod and dev and review changes, which best fits?
Q2. Which managed Terraform execution service does Google Cloud provide?
Q3. What is the main problem with making changes directly via the console by hand?
Q4. To auto-validate/apply IaC changes and track who changed what, which best fits?
Q5. Which correctly describes the role of Terraform "state"?
Q6. To manage Google Cloud resources the Kubernetes declarative way, what do you use?