Question

A financial services company runs a Cloud Build CI/CD pipeline that deploys to production several times a day. An external auditor requires that every production deployment be traceable to a specific approved change request, and that the identity of the approver, the artifact version, and the timestamp be independently verifiable and retained for seven years. The engineering team wants to satisfy this requirement while keeping deployments fully automated where possible. Which approach best meets the audit and process requirements?

Accepted Answer

Introduce a manual approval gate in the release pipeline that records approver identity, then export Cloud Build and Cloud Audit Logs of each deployment to a retention-locked Cloud Storage bucket for the required period.

Answer

Require developers to email a manager before each deployment and keep the email threads in a shared inbox as the audit record.

Answer

Enable verbose logging in Cloud Build and rely on the 400-day default log retention in Cloud Logging to provide the deployment history.

Answer

Grant the auditor the Cloud Build Editor role so they can inspect build triggers and configurations whenever a review is needed.