Examkin

Question

Difficulty: HardConfiguring Billing Accounts and Linking Projects

A DevOps automation principal needs to grant a service account the minimum necessary IAM roles and execute the appropriate gcloud commands to create a new workload project inside a corporate folder and link it to an existing Cloud Billing Account. Arrange the steps in the correct operational sequence from first to last to complete this task under the principle of least privilege.

  1. 1Grant the service account the Project Creator (`roles/resourcemanager.projectCreator`) role on the target Folder.
  2. 2Grant the service account the Billing Account User (`roles/billing.user`) role on the target Cloud Billing Account.
  3. 3Execute `gcloud projects create PROJECT_ID --folder=FOLDER_ID` to provision the new project inside the designated folder.
  4. 4Execute `gcloud billing projects link PROJECT_ID --billing-account=BILLING_ACCOUNT_ID` to attach billing to the newly created project.

Answer

The correct operational sequence begins with granting `roles/resourcemanager.projectCreator` on the target folder, followed by granting `roles/billing.user` on the Cloud Billing Account, creating the project using `gcloud projects create`, and finally linking the billing account using `gcloud billing projects link`.
Permissions must be configured prior to executing CLI commands. First, folder-level project creation rights (`roles/resourcemanager.projectCreator`) and billing account consumption rights (`roles/billing.user`) are established. Second, the project is created under the folder via `gcloud projects create`. Finally, billing is attached via `gcloud billing projects link`.

Step-by-Step Solution

1
Assign folder creation privileges
Service account gains authorization to create projects within the specific folder.
Google Cloud IAM requires permission propagation at the target hierarchy node before resource provisioning commands can succeed.
2
Assign billing authorization privileges
Service account gains authorization to link projects to the specified billing account.
Least-privilege guidelines mandate granting `roles/billing.user` on the billing account rather than broad primitive roles like Owner or Project Billing Manager.
3
Provision the target project
New project ID is created under the specified folder ID.
The project resource must exist before billing association can take place.
4
Associate billing account to project
Project status is updated to enable paid API services and compute resource provisioning.
Linking requires permissions on both the billing account (`roles/billing.user`) and the target project (inherently held by project creation or project management roles).

Key Concept

Configuring least-privilege IAM roles (`roles/resourcemanager.projectCreator` and `roles/billing.user`) and executing the gcloud tool sequence for project creation and billing link association.
Rate this question

Topics

Configuring Billing Accounts and Linking Projects