Question

Your organization uses Cloud Build to deploy applications to production Cloud Run services. The security team requires that any deployment targeting the production environment must be manually reviewed and explicitly approved by an authorized release manager before it executes, while builds to staging should continue to run automatically. You need to implement this control natively within the CI/CD pipeline with an auditable record of who approved each production deployment. What should you do?

Accepted Answer

Configure a Cloud Build trigger for production with manual approval required, and grant the release managers the Cloud Build Approver role so they can approve pending builds.

Answer

Enable Binary Authorization on the production Cloud Run service and require the release manager to sign each container image with a KMS key before deployment.

Answer

Add a wait step in the production build configuration that pauses for 24 hours and send an email to the release manager asking them to cancel it if the deployment is not authorized.

Answer

Create a Pub/Sub notification on the production trigger and require the release manager to publish an approval message to the topic before the build proceeds.