Examkin

Question

Difficulty: MediumConfiguring Billing Accounts and Linking Projects

A cloud security administrator at a global freight logistics company needs to authorize a DevOps engineer to link a newly provisioned project, `logistics-telematics-prod`, to the enterprise central Cloud Billing Account (`01A2B3-4C5D6E-7F8990`). The task must adhere strictly to Google Cloud least-privilege guidelines. Place the administrative authorization and CLI execution steps in the correct sequential order required to successfully perform this billing link.

  1. 1Grant the DevOps engineer the Billing Account User role (roles/billing.user) on the central Cloud Billing Account resource.
  2. 2Grant the DevOps engineer the Project Billing Manager role (roles/resourcemanager.projectBillingManager) on the logistics-telematics-prod project.
  3. 3Authenticate to the Google Cloud CLI using the DevOps engineer's user credentials.
  4. 4Execute gcloud billing projects link logistics-telematics-prod --billing-account 01A2B3-4C5D6E-7F8990.

Answer

The correct sequence begins by granting the Billing Account User role on the central Cloud Billing Account resource, followed by granting the Project Billing Manager role on the target project resource, authenticating to the gcloud CLI with the engineer's credentials, and finally executing the gcloud billing projects link command.
Linking a Google Cloud project to a Cloud Billing Account requires permissions on both the billing account resource and the project resource. Under least-privilege principles, the user needs Billing Account User (roles/billing.user) on the billing account and Project Billing Manager (roles/resourcemanager.projectBillingManager) on the project. Once both roles are assigned, authenticating and executing the gcloud billing projects link command completes the process.

Step-by-Step Solution

1
Assign Billing Account IAM role
The engineer gains resourcemanager.projects.createBillingAssignment permission on the billing account resource.
To attach any project to a billing account, the user must be a Billing Account User on that billing account.
2
Assign Project IAM role
The engineer gains billing modification privileges on the target project resource.
The Project Billing Manager predefined role provides least-privilege access to link or unlink billing on the target project.
3
Authenticate CLI environment
The gcloud CLI session is authenticated with the authorized engineer account.
CLI commands run under the active authenticated identity's privileges.
4
Execute billing link command
The project logistics-telematics-prod is linked to billing account 01A2B3-4C5D6E-7F8990.
The command completes the association between the target project and the billing account.

Key Concept

Least-privilege IAM configuration for linking projects to Cloud Billing Accounts
Rate this question

Topics

Configuring Billing Accounts and Linking Projects