Examkin

Question

Difficulty: HardConfiguring Billing Accounts and Linking Projects

A cloud engineer is tasked with configuring billing for a newly provisioned Google Cloud project (`staging-microservices-prod`). The project must be linked to an existing corporate billing account (`01A2B3-4C5D6E-7F8901`). Adhering strictly to Google Cloud least-privilege security principles, which TWO IAM roles must be granted to the cloud engineer to perform this linking operation? (Select TWO.)

  1. Billing Account User (`roles/billing.user`) on the target Cloud Billing accountAnswer
  2. Project Billing Manager (`roles/resourcemanager.projectBillingManager`) on the target projectAnswer
  3. C
    Project Owner (`roles/owner`) on the target project
  4. D
    Billing Account Administrator (`roles/billing.admin`) on the target Cloud Billing account
  5. E
    Organization Administrator (`roles/resourcemanager.organizationAdmin`) at the organization level

Answer

To associate a Google Cloud project with a Cloud Billing account under least privilege, the user requires two specific predefined roles: Billing Account User (`roles/billing.user`) assigned on the Cloud Billing account, and Project Billing Manager (`roles/resourcemanager.projectBillingManager`) assigned on the target project.
Linking a project to a Cloud Billing account requires permissions on both target entities. On the billing account level, Billing Account User (`roles/billing.user`) authorizes spending and linking. On the project level, Project Billing Manager (`roles/resourcemanager.projectBillingManager`) authorizes attaching the billing account. Together, these two predefined roles provide the exact set of minimum permissions needed.

Step-by-Step Solution

1
Identify the required privileges on the Cloud Billing account resource.
Determined that the user needs authorization to associate the billing account with projects, which is fulfilled by `roles/billing.user` on the billing account.
Permissions on the billing account itself control who is authorized to spend against that billing account.
2
Identify the required privileges on the target Google Cloud project resource.
Determined that the user needs authorization to change billing properties on the project, fulfilled by `roles/resourcemanager.projectBillingManager` on the target project.
Permissions on the project resource control who is authorized to modify project-level configuration such as billing linking.
3
Evaluate candidate roles against the least-privilege mandate.
Selected predefined roles (`roles/billing.user` and `roles/resourcemanager.projectBillingManager`) instead of excessive broad roles like `roles/billing.admin`, `roles/owner`, or `roles/resourcemanager.organizationAdmin`.
Google Cloud security guidance requires applying predefined roles scoped to specific administrative tasks rather than broad primitive or administrative roles.

Key Concept

Least-privilege permission matrix for linking Google Cloud projects to Cloud Billing accounts
Estimated Time:2m 0s
Rate this question

Topics

Configuring Billing Accounts and Linking Projects