Examkin

Question

Difficulty: MediumConfiguring Billing Accounts and Linking Projects

A DevOps engineer at a logistics company needs to link a newly provisioned project, `supply-chain-analytics-prod`, to the corporate Cloud Billing Account. Organizational security policies mandate strict adherence to the principle of least privilege, ensuring the engineer cannot view financial invoices for other projects linked to the billing account or modify billing payment settings. Which combination of IAM roles grants the minimum required permissions to complete this task?

  1. Billing Account User (`roles/billing.user`) on the Cloud Billing Account and Project Billing Manager (`roles/resourcemanager.projectBillingManager`) on the target projectAnswer
  2. B
    Billing Account Administrator (`roles/billing.admin`) on the Cloud Billing Account and Project Owner (`roles/owner`) on the target project
  3. C
    Project Billing Manager (`roles/resourcemanager.projectBillingManager`) on the Cloud Billing Account and Project Viewer (`roles/viewer`) on the target project
  4. D
    Billing Account User (`roles/billing.user`) on the parent Organization node only, without explicit roles on the project or billing account

Answer

The correct role combination is Billing Account User (`roles/billing.user`) bound on the Cloud Billing Account resource and Project Billing Manager (`roles/resourcemanager.projectBillingManager`) bound on the target project.
Linking a Google Cloud project to a billing account requires permissions on two distinct resources: permission to use the billing account (provided by Billing Account User on the billing account) and permission to change billing configuration on the project (provided by Project Billing Manager on the project). This combination enforces least privilege.

Step-by-Step Solution

1
Identify the minimum billing account permission required to link projects
The identity needs `resourcemanager.projects.createBillingAssignment` capability on the billing account, provided by the predefined Billing Account User (`roles/billing.user`) role.
This permission allows associating projects to the billing account without giving rights to manage payment methods or view overall account spending across all linked projects.
2
Identify the minimum project-level permission required to modify project billing settings
The identity needs `resourcemanager.projects.createBillingAssignment` on the project resource, provided by the Project Billing Manager (`roles/resourcemanager.projectBillingManager`) role.
Linking requires permission on both sides: the billing account and the target project.
3
Evaluate against least-privilege constraints
Combining Billing Account User on the billing account and Project Billing Manager on the project satisfies both requirements with minimal permissions.
Primitive roles like Project Owner or broad roles like Billing Account Administrator grant unnecessary privileges.

Key Concept

Two-Sided Permission Requirement for Project Billing Account Linking
Rate this question

Topics

Configuring Billing Accounts and Linking Projects