Examkin

Question

Difficulty: HardManaging IAM Roles and Resource Access Permissions

A cloud engineer must configure access for a finance team member who needs to link newly provisioned Google Cloud projects to the company's central Billing Account and monitor project cost data. The finance team member must not be allowed to modify project infrastructure resources or manage billing account administrators and budgets. Which IAM role assignment strategy adheres to the principle of least privilege?

  1. Grant the Billing Account User (roles/billing.user) role on the Billing Account, and grant the Project Billing Manager (roles/resourcemanager.projectBillingManager) role on the target projects.Answer
  2. B
    Grant the Project Editor (roles/editor) role on the target projects only.
  3. C
    Grant the Billing Account Administrator (roles/billing.admin) role on the Billing Account, and grant the Project Owner (roles/owner) role on the target projects.
  4. D
    Grant the Billing Account User (roles/billing.user) role at the Organization level only.

Answer

Grant the Billing Account User role on the Billing Account and the Project Billing Manager role on the target projects.
Linking a Google Cloud project to a Billing Account requires explicit authorization on two separate resources. The principal must hold the Billing Account User (roles/billing.user) role on the central Billing Account resource and the Project Billing Manager (roles/resourcemanager.projectBillingManager) role on the project resource. This combination grants exact rights to link billing and view costs without granting infrastructural administrative rights or full billing account management.

Step-by-Step Solution

1
Identify the required actions
The user needs to link a project to a Billing Account and view project cost data without managing project infrastructure or modifying billing account administration.
Determining exact action boundaries helps select least-privilege predefined roles.
2
Determine Billing Account level permission requirement
The principal needs roles/billing.user on the specific Billing Account object.
Linking a project to a billing account requires permission to use the billing account.
3
Determine Project level permission requirement
The principal needs roles/resourcemanager.projectBillingManager on the target project.
Linking requires project-level authorization to associate billing to that specific project.

Key Concept

Billing Account Project Linking IAM Requirements
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic