Examkin

Question

Difficulty: MediumConfiguring Billing Accounts and Linking Projects

A lead researcher at a university data lab creates a new Google Cloud project to analyze genomic datasets. The researcher has already been granted the Project Owner role (roles/owner) on the new project. However, when attempting to link the project to the university's centralized Cloud Billing Account, the researcher receives a permission error. Following Google Cloud least-privilege best practices, which IAM role must the central billing administrator grant to the researcher on the Billing Account?

  1. Billing Account User (roles/billing.user) on the Billing AccountAnswer
  2. B
    Project Billing Manager (roles/billing.projectManager) on the Billing Account
  3. C
    Billing Account Administrator (roles/billing.admin) on the Billing Account
  4. D
    Billing Account Viewer (roles/billing.viewer) on the Billing Account

Answer

Billing Account User (roles/billing.user) on the Billing Account
Linking a Google Cloud project to a billing account requires permissions on both resources: project-level permission to assign billing and billing account-level permission to associate projects. Because the researcher already possesses Project Owner rights on the project, granting Billing Account User (roles/billing.user) on the target Billing Account provides the exact least-privilege permission required to complete the association.

Step-by-Step Solution

1
Identify the dual-permission requirement for linking a Google Cloud project to a Billing Account.
The user requires permissions on both the Project (resourcemanager.projects.createBillingAssignment) and the Billing Account (billing.resourceAssociations.create).
Linking a resource requires authorization on both the source project and target billing destination.
2
Evaluate the user's existing permissions on the project.
The researcher is already a Project Owner (roles/owner), which satisfies the project-level requirement.
Project Owner includes project billing assignment rights.
3
Determine the minimum required role on the Billing Account level.
Granting Billing Account User (roles/billing.user) provides billing.resourceAssociations.create on the billing account.
This enforces least privilege by permitting project association without exposing billing administrative capabilities.

Key Concept

Dual-permission authorization model for GCP project billing account linking
Rate this question

Topics

Configuring Billing Accounts and Linking Projects