Examkin

Question

Difficulty: MediumConfiguring Billing Accounts and Linking Projects

A software architect needs to enable an environment engineer to link a newly provisioned Google Cloud project to the organization's central Cloud Billing Account. Following the principle of least privilege, which combination of IAM roles must be granted to the engineer?

  1. Project Billing Manager (roles/billing.projectManager) on the target project, and Billing Account User (roles/billing.user) on the Cloud Billing AccountAnswer
  2. B
    Billing Account Administrator (roles/billing.admin) on the Cloud Billing Account, and Project Owner (roles/owner) on the target project
  3. C
    Billing Account Creator (roles/billing.creator) at the organization level, and Project Editor (roles/editor) on the target project
  4. D
    Billing Account User (roles/billing.user) on the Cloud Billing Account, and Project Viewer (roles/viewer) on the target project

Answer

The correct role combination is Project Billing Manager on the target project and Billing Account User on the Cloud Billing Account.
Linking a project to a Cloud Billing Account requires permissions on both resources: Project Billing Manager (roles/billing.projectManager) grants resourcemanager.projects.createBillingAssignment on the project, while Billing Account User (roles/billing.user) grants billing.resourceAssociations.create on the billing account. This fulfills least-privilege security requirements.

Step-by-Step Solution

1
Identify the project-level permission requirement
Linking a project requires the resourcemanager.projects.createBillingAssignment permission on the project, provided by Project Billing Manager (roles/billing.projectManager) or Project Owner.
The user must have permission to modify billing configuration for that specific project.
2
Identify the billing account-level permission requirement
Linking to a billing account requires the billing.resourceAssociations.create permission on the billing account, provided by Billing Account User (roles/billing.user).
The user must be authorized to attach resource costs to the specified billing account.
3
Apply the principle of least privilege
Combining Project Billing Manager on the project with Billing Account User on the billing account provides the minimal viable access.
This avoids granting full Project Owner or Billing Account Administrator permissions.

Key Concept

Linking Google Cloud projects to a billing account requires dual permissions: Project Billing Manager on the project and Billing Account User on the billing account.
Rate this question

Topics

Configuring Billing Accounts and Linking Projects