Examkin

Question

Difficulty: MediumManaging Cloud Projects and Resource Hierarchy

A department lead needs to delegate project creation rights to a team of developers. The developers must be allowed to create new Google Cloud projects within a designated folder named `Department-Dev` and link those newly created projects to the company's central billing account. However, they should not be able to create projects anywhere else in the organization or alter billing account settings. Following the principle of least privilege, which combination of IAM role assignments should be configured?

  1. Grant Project Creator (roles/resourcemanager.projectCreator) on the Department-Dev folder, and Billing Account User (roles/billing.user) on the central billing account.Answer
  2. B
    Grant Project Creator (roles/resourcemanager.projectCreator) on the Organization node, and Billing Account User (roles/billing.user) on the Department-Dev folder.
  3. C
    Grant Editor (roles/editor) on the Department-Dev folder only.
  4. D
    Grant Project Creator (roles/resourcemanager.projectCreator) on the Department-Dev folder only.

Answer

Grant Project Creator (roles/resourcemanager.projectCreator) on the Department-Dev folder, and Billing Account User (roles/billing.user) on the central billing account.
To create projects inside a specific folder and link them to a billing account under the principle of least privilege, a user requires `roles/resourcemanager.projectCreator` scoped to that target folder, as well as `roles/billing.user` scoped to the target Billing Account.

Step-by-Step Solution

1
Determine the required permission for project creation within a specific folder.
Assign roles/resourcemanager.projectCreator directly on the target folder (`Department-Dev`).
Permissions inherit downward. Placing the role at the folder level limits project creation scope strictly to that folder.
2
Determine the required permission for linking projects to an enterprise billing account.
Assign roles/billing.user on the Billing Account resource.
Linking a project to a billing account requires `resourcemanager.projects.create` on the parent folder and `billing.resourceAssociations.create` on the billing account itself.

Key Concept

Folder-Scoped Project Creation and Billing Account IAM Scoping
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic