Examkin

Question

Difficulty: MediumCreating Billing Budgets, Alerts, and BigQuery Exports

A financial operations analyst needs to create and manage spend budgets and budget threshold email alerts for a company's primary Google Cloud Billing account. To adhere to the principle of least privilege, the analyst must not be granted permissions to modify payment details, link or unlink projects, or manage billing account IAM roles. Which IAM role should be assigned to the analyst on the Cloud Billing account?

  1. Billing Account Costs Manager (roles/billing.costsManager)Answer
  2. B
    Billing Account Viewer (roles/billing.viewer)
  3. C
    Project Owner (roles/owner) on all linked projects
  4. D
    Billing Account Administrator (roles/billing.admin)

Answer

Billing Account Costs Manager (roles/billing.costsManager)
The Billing Account Costs Manager role (roles/billing.costsManager) grants the precise permissions required to create, update, and manage budgets and budget alerts on a Cloud Billing account. It does not grant broader administrative privileges such as managing payment accounts or assigning roles, satisfying the least-privilege requirement.

Step-by-Step Solution

1
Identify the resource level where budgets and budget alerts are created in Google Cloud.
Budgets are defined and managed at the Cloud Billing account level, not at the project level.
Cloud Billing budgets track expenditure across billing account scopes or linked project subsets, requiring billing account IAM permissions.
2
Evaluate the required administrative actions against the requested restrictions.
The user needs to create/edit budgets, but must not manage payment instruments or user permissions.
Applying the principle of least privilege requires choosing a role tailored specifically to cost management tasks.
3
Select the least-privilege predefined role matching these capabilities.
Billing Account Costs Manager (roles/billing.costsManager) fits the exact requirement.
This role explicitly permits managing budget thresholds and cost reports while restricting full administrative operations on the billing account.

Key Concept

Cloud Billing IAM Roles and Least-Privilege Budget Management
Estimated Time:1m 15s
Rate this question

Topics

Creating Billing Budgets, Alerts, and BigQuery Exports

More questions from this topic