Examkin

Question

Difficulty: Very hardManaging Cloud Projects and Resource Hierarchy

An enterprise DevOps team needs to configure an automated service account, [email protected], to provision new Google Cloud projects inside a designated folder named Engineering-Apps. Additionally, these newly created projects must be linked to the company central billing account (ID: 01ABCD-EF1234-567890). Following the principle of least privilege, which configuration of IAM roles should be assigned to the service account?

  1. Grant Project Creator (roles/resourcemanager.projectCreator) on the Engineering-Apps folder and Billing Account User (roles/billing.user) on the central billing account.Answer
  2. B
    Grant Owner (roles/owner) on the Engineering-Apps folder and Project Creator (roles/resourcemanager.projectCreator) on the central billing account.
  3. C
    Grant Project Creator (roles/resourcemanager.projectCreator) on the Engineering-Apps folder only, relying on folder permission inheritance to automatically authorize billing account linking.
  4. D
    Grant Project Creator (roles/resourcemanager.projectCreator) at the Organization root level and Billing Account Administrator (roles/billing.admin) on the Engineering-Apps folder.

Answer

Grant Project Creator (roles/resourcemanager.projectCreator) on the Engineering-Apps folder and Billing Account User (roles/billing.user) on the central billing account.
To create projects within a specific folder and link them to a billing account, an identity requires Project Creator (roles/resourcemanager.projectCreator) bound on that target folder and Billing Account User (roles/billing.user) bound on the specific Billing Account. This configuration satisfies the principle of least privilege by scoping project creation rights to the intended folder and limiting billing interaction to user-level linking.

Step-by-Step Solution

1
Identify the minimum permission needed to create projects in a specific resource container.
The Project Creator role (roles/resourcemanager.projectCreator) granted on the target folder (Engineering-Apps) allows creating projects within that folder without granting global organization-wide privileges.
Applying the role at the folder level adheres to the principle of least privilege.
2
Identify the minimum permission required to associate newly created projects with an enterprise billing account.
The Billing Account User role (roles/billing.user) must be bound directly on the billing account resource (01ABCD-EF1234-567890).
Project creation permissions do not automatically grant rights to attach billing accounts.

Key Concept

Scope-specific IAM role assignment for project creation and billing account linking in GCP resource hierarchy
Estimated Time:1m 30s
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic