Examkin

Question

Difficulty: MediumConfiguring Billing Accounts and Linking Projects

A cloud administrator needs to delegate authority to a junior engineer to link an unlinked Google Cloud project to an organization's Cloud Billing Account using least-privilege IAM roles. Arrange the steps in the correct chronological order required to grant permissions and complete the linking process.

  1. 1Identify the target Google Cloud Project ID and the Cloud Billing Account ID.
  2. 2Grant the engineer the Billing Account User (`roles/billing.user`) role on the Cloud Billing Account.
  3. 3Grant the engineer the Project Billing Manager (`roles/resourcemanager.projectBillingManager`) role on the target project.
  4. 4Have the engineer execute `gcloud billing projects link PROJECT_ID --billing-account=BILLING_ACCOUNT_ID`.

Answer

The correct sequence begins by identifying the Project ID and Billing Account ID, granting the Billing Account User role on the billing account, granting the Project Billing Manager role on the project, and executing the gcloud billing projects link command.
Linking a project to a billing account requires permissions on two distinct levels in the GCP resource hierarchy: `roles/billing.user` on the Cloud Billing Account and `roles/resourcemanager.projectBillingManager` on the target Project. The workflow proceeds chronologically from identifying resource parameters to granting necessary IAM roles on both scopes, concluding with the CLI invocation to link the project.

Step-by-Step Solution

1
Identify resource parameters
Obtain target Project ID and Cloud Billing Account ID.
Target identifiers are required parameters for granting scoped IAM roles and running gcloud commands.
2
Configure billing account level IAM
Assign `roles/billing.user` to the user on the Cloud Billing Account.
Linking requires permission to use the billing account without granting administrative access over billing settings.
3
Configure project level IAM
Assign `roles/resourcemanager.projectBillingManager` to the user on the target project.
Linking requires permission on the target project to change its billing configuration under least privilege.
4
Execute project linking
Run `gcloud billing projects link` using the engineer's authenticated session.
The CLI operation succeeds because the identity holds required privileges across both resource boundaries.

Key Concept

Least privilege IAM delegation for project billing link configuration
Rate this question

Topics

Configuring Billing Accounts and Linking Projects