A lead developer needs permission to create new Google Cloud projects inside a dedicated folder named `Engineering-Dev`. Additionally, the developer must be able to associate these newly created projects with the organization's central billing account.
Which combination of IAM roles assigned with least privilege allows the developer to fulfill both requirements?
- Aroles/resourcemanager.projectCreator at the Organization level and roles/billing.admin on the central billing account.
- Broles/resourcemanager.folderAdmin on the Engineering-Dev folder and roles/billing.viewer on the central billing account.
- roles/resourcemanager.projectCreator on the Engineering-Dev folder and roles/billing.user on the central billing account.Answer
- Droles/resourcemanager.projectCreator on the Engineering-Dev folder and roles/resourcemanager.projectBillingManager on the Engineering-Dev folder only.
Answer
Grant roles/resourcemanager.projectCreator on the Engineering-Dev folder and roles/billing.user on the central billing account.
To create projects inside a specific folder, `roles/resourcemanager.projectCreator` must be bound to that folder. To link newly created projects to an existing billing account, the user must also hold `roles/billing.user` on the Billing Account resource. This combination minimizes access while fulfilling both administrative tasks.
Step-by-Step Solution
Key Concept
Resource Hierarchy IAM Scoping and Billing Account Linking Permissions