Examkin

Question

Difficulty: MediumConfiguring Billing Accounts and Linking Projects

A lead financial operations manager at a digital publishing firm needs to authorize an environment manager to link an existing unlinked project, `media-archival-service`, to the enterprise Cloud Billing Account while adhering strictly to the principle of least privilege. Which TWO IAM roles should be granted to the environment manager?

  1. Billing Account User (`roles/billing.user`) on the Cloud Billing AccountAnswer
  2. Project Billing Manager (`roles/billing.projectManager`) on the projectAnswer
  3. C
    Billing Account Administrator (`roles/billing.admin`) on the Cloud Billing Account
  4. D
    Project Owner (`roles/owner`) on the project
  5. E
    Billing Account Viewer (`roles/billing.viewer`) on the Cloud Billing Account

Answer

The user must be granted the Billing Account User role on the Cloud Billing Account and the Project Billing Manager role on the target project.
Linking an existing project to a Cloud Billing Account requires the `resourcemanager.projects.createBillingAssignment` permission on both resources. The Billing Account User (`roles/billing.user`) role supplies this permission for the billing account, and the Project Billing Manager (`roles/billing.projectManager`) role supplies this permission for the project, adhering strictly to least privilege.

Step-by-Step Solution

1
Identify the permission required to link a project to a Cloud Billing Account
The `resourcemanager.projects.createBillingAssignment` permission is required on both the project and the billing account.
Google Cloud authorization controls require permission on both the target resource (project) and the paying entity (billing account).
2
Select the least-privilege predefined role for the Cloud Billing Account
Billing Account User (`roles/billing.user`) provides the necessary permission on the billing account.
Billing Account Administrator grants unnecessary extra permissions such as managing payment profiles and billing permissions.
3
Select the least-privilege predefined role for the Cloud Project
Project Billing Manager (`roles/billing.projectManager`) provides the necessary permission on the project.
Project Owner grants full control over all project resources and IAM policies, violating least privilege.

Key Concept

Configuring least privilege permissions on both billing accounts and projects for billing association
Rate this question

Topics

Configuring Billing Accounts and Linking Projects