Examkin

Question

Difficulty: MediumConfiguring Billing Accounts and Linking Projects

A cloud administrator at an online gaming company needs to enable a lead external game developer to link a newly provisioned Google Cloud project, `game-telemetry-prod`, to the organization's central Google Cloud Billing Account. The developer already possesses the Project Owner role (`roles/owner`) on `game-telemetry-prod`. Following the principle of least privilege, which IAM role should the administrator grant to the developer, and on which resource?

  1. Grant the Billing Account User role (`roles/billing.user`) on the central Billing Account.Answer
  2. B
    Grant the Billing Account Administrator role (`roles/billing.admin`) on the central Billing Account.
  3. C
    Grant the Project Billing Manager role (`roles/resourcemanager.projectBillingManager`) on the Organization resource.
  4. D
    Grant the Billing Account Viewer role (`roles/billing.viewer`) on the central Billing Account.

Answer

Grant the Billing Account User role (`roles/billing.user`) on the central Billing Account.
Linking a Google Cloud project to a billing account requires two separate authorization rights: permission to manage billing on the project (`resourcemanager.projects.createBillingAssignment`) and permission to associate projects with the billing account (`billing.resourceAssociations.create`). Because the user already holds Project Owner permissions on the project, granting the Billing Account User role (`roles/billing.user`) on the central Billing Account supplies the missing billing account association permission with minimum necessary privilege.

Step-by-Step Solution

1
Identify the two required permissions for project-to-billing-account linking.
Linking a project requires `resourcemanager.projects.createBillingAssignment` on the project resource and `billing.resourceAssociations.create` on the billing account resource.
Google Cloud enforces explicit permission checks on both the target project and the target billing account to prevent unauthorized billing link changes.
2
Evaluate the permissions already held by the developer.
The developer is already a Project Owner (`roles/owner`) on `game-telemetry-prod`, which includes `resourcemanager.projects.createBillingAssignment`.
No additional project-level IAM roles are needed for the developer on `game-telemetry-prod`.
3
Select the minimal predefined role on the Billing Account.
`roles/billing.user` (Billing Account User) grants `billing.resourceAssociations.create` on the billing account without allowing administrative billing modifications.
Granting `roles/billing.user` on the Billing Account fulfills least-privilege administrative requirements.

Key Concept

Configuring Billing Accounts and Linking Projects
Rate this question

Topics

Configuring Billing Accounts and Linking Projects