Examkin

Question

Difficulty: MediumConfiguring Billing Accounts and Linking Projects

A central infrastructure operations team at a retail company needs to delegate authority to a DevOps engineer to link newly provisioned Google Cloud projects to the company's central Cloud Billing account. The solution must strictly follow the principle of least privilege by avoiding overly permissive or broad administrative access on both the billing account and the projects. Which TWO identity and access management (IAM) roles must be assigned to the DevOps engineer? (Select 2 answers)

  1. Billing Account User (roles/billing.user) on the central Cloud Billing accountAnswer
  2. Project Billing Manager (roles/billing.projectManager) on the target Google Cloud projectAnswer
  3. C
    Billing Account Administrator (roles/billing.admin) on the central Cloud Billing account
  4. D
    Billing Account Viewer (roles/billing.viewer) on the central Cloud Billing account
  5. E
    Billing Account Costs Manager (roles/billing.costsManager) at the Organization level

Answer

To link a Google Cloud project to a Cloud Billing account under the principle of least privilege, two specific permissions across two separate resource levels are required: Billing Account User (roles/billing.user) granted on the Cloud Billing account, and Project Billing Manager (roles/billing.projectManager) granted on the target Google Cloud project.
Linking a project to a Cloud Billing account requires permissions on both the billing account and the project. On the billing account side, Billing Account User (roles/billing.user) grants the capability to associate projects with the billing account. On the project side, Project Billing Manager (roles/billing.projectManager) allows changing the billing account associated with the project. Together, these two roles fulfill the minimal privilege requirement.

Step-by-Step Solution

1
Identify the minimum required permission on the Cloud Billing account level.
The user requires the 'billing.resourceAssociations.create' permission on the billing account, which is provided by the Billing Account User role.
This permission allows linking projects to the specified billing account without granting administrative control over billing configurations or payment methods.
2
Identify the minimum required permission on the target Google Cloud project level.
The user requires the 'resourcemanager.projects.createBillingAssignment' permission on the project, which is provided by the Project Billing Manager role.
This permission permits modifying the project's billing association without requiring full Project Owner or Editor access.

Key Concept

Dual IAM Permission Model for Billing Account Project Linking
Rate this question

Topics

Configuring Billing Accounts and Linking Projects