Examkin

Question

Difficulty: HardManaging Cloud Projects and Resource Hierarchy

A platform automation service account named `[email protected]` is tasked with creating new Google Cloud projects under the `Engineering` folder and associating them with the enterprise Billing Account `01A2B3-456C78-9DEF01`. The service account has already been granted the Project Creator (`roles/resourcemanager.projectCreator`) role on the `Engineering` folder. However, automated deployments fail when attempting to link newly created projects to the billing account. Following the principle of least privilege, which additional IAM role configuration is required to enable the service account to complete project-to-billing linking?

  1. Grant the service account the Billing Account User (`roles/billing.user`) role directly on Billing Account `01A2B3-456C78-9DEF01`.Answer
  2. B
    No additional roles are required because Project Creator on the folder automatically inherits billing assignment permissions for all billing accounts owned by the organization.
  3. C
    Grant the service account the Owner (`roles/owner`) role on the Organization node so that billing management capabilities inherit downward through the resource hierarchy.
  4. D
    Configure an Organization Policy constraint on the `Engineering` folder that enables billing account association for the service account identity.

Answer

Grant the service account the Billing Account User (`roles/billing.user`) role directly on Billing Account `01A2B3-456C78-9DEF01`.
To link a Google Cloud project to a billing account, an identity must hold specific permissions on both target resources: Project Creator (or Project Owner/Editor) on the parent folder or project, and Billing Account User (`roles/billing.user`) on the specific billing account. Granting `roles/billing.user` directly on the billing account fulfills the least privilege principle while enabling the required association capability.

Step-by-Step Solution

1
Analyze the permission requirements for linking a Google Cloud project to a billing account.
Linking requires dual permissions: project creation/management rights on the project/folder AND billing association rights on the billing account.
Security boundary isolation ensures that project administrators cannot arbitrarily attach projects to billing accounts without explicit authorization on the billing resource.
2
Evaluate existing service account permissions.
The service account has `roles/resourcemanager.projectCreator` on the target folder, satisfying the folder-level project creation requirement.
This allows project instantiation under the `Engineering` folder but does not grant rights on external billing account resources.
3
Determine the least-privilege predefined role needed on the billing account.
Assigning `roles/billing.user` directly on the billing account provides `billing.resourceAssociations.create` without over-granting billing administrative access.
This role grants permission to link projects to the specified billing account without giving rights to manage billing account payment methods or user access.

Key Concept

Dual-permission requirement for GCP Billing Account linking across the Resource Hierarchy
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic