Examkin

Question

Difficulty: HardConfiguring Billing Accounts and Linking Projects

An enterprise organization is establishing a secure sandbox environment for external partners. A automated service account needs to provision new Google Cloud projects inside a designated folder named 'Partner-Sandboxes' and immediately link each new project to the organization's central Billing Account. The security policy requires enforcing the principle of least privilege without granting excessive administrative permissions across the billing account or folder resource hierarchy. Which pair of predefined IAM roles should be granted to the service account to meet these requirements?

  1. Project Creator (roles/resourcemanager.projectCreator) on the 'Partner-Sandboxes' folder and Billing Account User (roles/billing.user) on the target Billing AccountAnswer
  2. B
    Project Creator (roles/resourcemanager.projectCreator) on the 'Partner-Sandboxes' folder and Billing Account Administrator (roles/billing.admin) on the target Billing Account
  3. C
    Project Billing Manager (roles/billing.projectManager) on the 'Partner-Sandboxes' folder and Billing Account Viewer (roles/billing.viewer) on the target Billing Account
  4. D
    Folder Editor (roles/resourcemanager.folderEditor) on the 'Partner-Sandboxes' folder and Project Billing Manager (roles/billing.projectManager) on the Organization node

Answer

Project Creator (roles/resourcemanager.projectCreator) on the 'Partner-Sandboxes' folder and Billing Account User (roles/billing.user) on the target Billing Account
Linking a project to a Cloud Billing Account requires two distinct privileges: the permission to create or manage billing links on the target project/folder (satisfied by Project Creator on the folder) and the permission to link projects to the billing account (satisfied by Billing Account User on the billing account). This combination satisfies least privilege.

Step-by-Step Solution

1
Identify the project creation requirement
The identity requires Project Creator (roles/resourcemanager.projectCreator) scoped to the specific folder to create new projects.
Permissions must be scoped to the targeted folder resource rather than higher levels in the hierarchy.
2
Identify the billing account linking requirement
The identity requires Billing Account User (roles/billing.user) on the specific Cloud Billing Account.
Linking a project to a billing account requires explicit permission on the billing account resource itself to spend against that billing account.
3
Combine requirements enforcing least privilege
Pairing Project Creator on the folder with Billing Account User on the billing account provides the minimal necessary permissions without granting full billing administration rights.
Both role assignments together satisfy the dual-permission check enforced by Google Cloud resource management for billing association.

Key Concept

Two-sided permission model for linking Google Cloud projects to Cloud Billing Accounts
Rate this question

Topics

Configuring Billing Accounts and Linking Projects