Examkin

Question

Difficulty: MediumManaging IAM Roles and Resource Access Permissions

A DevOps team member needs to link several newly created Google Cloud projects to an existing corporate Billing Account. The team member must be able to associate projects with the billing account, but should not be permitted to modify payment methods, view billing details for unrelated projects, or manage billing account users. Which IAM role should be granted to the team member on the Billing Account to satisfy the principle of least privilege?

  1. Billing Account User (roles/billing.user)Answer
  2. B
    Billing Account Administrator (roles/billing.admin)
  3. C
    Billing Account Viewer (roles/billing.viewer)
  4. D
    Project Owner (roles/owner)

Answer

Billing Account User (roles/billing.user) is the correct role because it grants permissions to link Google Cloud projects to the billing account without providing administrative or full billing viewing capabilities.
The Billing Account User (roles/billing.user) role provides the exact privilege required to bind projects to a billing account without exposing sensitive financial settings, payment configurations, or permission management capabilities.

Step-by-Step Solution

1
Identify the required operational task
The user needs to link GCP projects to an existing Billing Account.
Linking a project to a billing account requires specific IAM permissions on both the project and the billing account.
2
Evaluate required billing account permissions
The billing.resourceAssociations.create permission is required on the Billing Account.
Associating resources with a billing account requires resource association privileges.
3
Select the predefined IAM role adhering to least privilege
Billing Account User (roles/billing.user) contains billing.resourceAssociations.create while omitting admin and viewer-broad access.
Using predefined least-privilege roles prevents unauthorized access to payment settings and global billing records.

Key Concept

Least Privilege IAM Role Assignment for GCP Billing Accounts
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic