Examkin

Question

Difficulty: HardConfiguring Billing Accounts and Linking Projects

A cloud engineer must create a new project named `finance-analytics-prod` within a corporate folder and link it to an existing Cloud Billing Account (`012345-6789AB-CDEF01`) using the `gcloud` CLI while following Google Cloud least-privilege IAM principles. What is the correct sequence of steps required to successfully provision the project and establish the billing connection?

  1. 1Acquire the Project Creator (`roles/resourcemanager.projectCreator`) role on the parent folder and the Billing Account User (`roles/billing.user`) role on the Cloud Billing Account.
  2. 2Execute `gcloud projects create finance-analytics-prod --folder=FOLDER_ID` to instantiate the project resource in the hierarchy.
  3. 3Verify or grant the Project Billing Manager (`roles/billing.projectManager`) role on the newly created `finance-analytics-prod` project.
  4. 4Execute `gcloud billing projects link finance-analytics-prod --billing-account=012345-6789AB-CDEF01` to finalize the attachment.

Answer

The correct procedural sequence is: 1) Acquire Project Creator on the folder and Billing Account User on the billing account; 2) Execute `gcloud projects create` to instantiate the project; 3) Ensure Project Billing Manager role is held on the new project; 4) Execute `gcloud billing projects link` to complete the association.
The workflow follows least-privilege IAM validation and resource lifecycle management. First, the administrator must hold `roles/resourcemanager.projectCreator` on the parent folder to create projects and `roles/billing.user` on the billing account to use it. Second, the project must be created (`gcloud projects create`). Third, the administrator needs `roles/billing.projectManager` on the newly created project to modify its billing configuration. Finally, running `gcloud billing projects link` associates the project with the billing account.

Step-by-Step Solution

1
Ensure initial organization and billing account IAM roles are assigned.
User has rights to create projects in the folder (`roles/resourcemanager.projectCreator`) and use the billing account (`roles/billing.user`).
Without folder-level project creation privileges and billing account usage privileges, subsequent project creation and billing linkage commands will fail.
2
Provision the project resource using the Google Cloud CLI.
The project `finance-analytics-prod` is created under the specified folder.
A project ID must exist as an active resource within the GCP resource hierarchy before billing accounts can be associated with it.
3
Validate project-level billing permissions.
User holds `roles/billing.projectManager` (or `roles/owner`) on `finance-analytics-prod`.
Linking a project to a billing account requires dual permissions: `billing.resourceAssociations.create` on the billing account AND `resourcemanager.projects.createBillingAssignment` on the project.
4
Run the gcloud billing link command.
Project `finance-analytics-prod` is linked to Cloud Billing Account `012345-6789AB-CDEF01`.
Executing `gcloud billing projects link` completes the association once permission checks on both the project and billing account pass.

Key Concept

Least-Privilege Billing Account and Project Linking Workflow
Rate this question

Topics

Configuring Billing Accounts and Linking Projects