Examkin

Question

Difficulty: MediumConfiguring Billing Accounts and Linking Projects

A cloud security administrator at a healthcare software firm needs to enable a lead developer to provision a new isolated Google Cloud project named `hc-analytics-prod` and associate it with the company's central Cloud Billing account under the principle of least privilege. What is the correct sequence of administrative and operational steps required to grant permissions and complete the project billing configuration?

  1. 1Grant the developer the Project Creator (`roles/resourcemanager.projectCreator`) role on the organization or target folder.
  2. 2Grant the developer the Billing Account User (`roles/billing.user`) role on the specific Cloud Billing Account.
  3. 3Execute `gcloud projects create hc-analytics-prod` to provision the new GCP project.
  4. 4Execute `gcloud billing projects link hc-analytics-prod --billing-account=01A2B3-456789-DEF123` to attach billing.

Answer

The correct order begins with granting the Project Creator role at the folder/organization level, followed by granting the Billing Account User role on the billing account, then creating the GCP project via CLI, and finally linking the project to the billing account.
Establishing a new project and linking it to billing under least privilege requires granting `roles/resourcemanager.projectCreator` on the parent folder/org and `roles/billing.user` on the Cloud Billing account prior to creating the project (`gcloud projects create`) and linking it (`gcloud billing projects link`).

Step-by-Step Solution

1
Assign the Project Creator (`roles/resourcemanager.projectCreator`) role on the parent Folder or Organization resource.
The target identity gains permission to invoke `resourcemanager.projects.create`.
Permissions must be configured prior to executing CLI provisioning commands.
2
Assign the Billing Account User (`roles/billing.user`) role on the target Cloud Billing account.
The target identity receives `billing.resourceAssociations.create` authority on the billing resource.
Linking a project to a billing account requires authorization on the billing account itself, enforcing least privilege over broader administrative roles like Billing Account Administrator.
3
Run `gcloud projects create hc-analytics-prod`.
The GCP project `hc-analytics-prod` is created, automatically assigning project management rights to the creator.
The project resource must exist before a billing association can be established.
4
Run `gcloud billing projects link hc-analytics-prod --billing-account=ACCOUNT_ID`.
The project is successfully linked to the Cloud Billing account.
This final command links the created project resource with the authorized billing account.

Key Concept

Least-Privilege Billing Account and Project Creation Workflow
Rate this question

Topics

Configuring Billing Accounts and Linking Projects