Examkin

Question

Difficulty: Very hardConfiguring Billing Accounts and Linking Projects

An enterprise organization is setting up a centralized governance model in Google Cloud. A financial operations specialist needs to create new GCP projects within a specific organizational folder and associate those newly created projects with the company's master Cloud Billing account. The security policy mandates strict adherence to the principle of least privilege, preventing the user from managing billing account permissions, modifying organization policies, or gaining administrative control over existing projects. Which TWO Identity and Access Management (IAM) roles must be granted to the specialist to enable these actions? Select 2 options.

  1. Billing Account User (roles/billing.user) on the target Cloud Billing accountAnswer
  2. Project Creator (roles/resourcemanager.projectCreator) on the target organizational FolderAnswer
  3. C
    Billing Account Administrator (roles/billing.admin) on the target Cloud Billing account
  4. D
    Project Billing Manager (roles/billing.projectManager) on the target Cloud Billing account
  5. E
    Owner (roles/owner) on the target organizational Folder

Answer

To allow creating projects and linking them to a billing account under least-privilege access, grant the Billing Account User role on the Cloud Billing account and the Project Creator role on the parent Folder.
Linking a project to a Cloud Billing account requires two sets of rights: project-level permissions (granted automatically upon project creation to the creator) and billing account-level permissions. The Billing Account User role on the billing account grants permission to attach projects to that billing account, while the Project Creator role on the folder provides the ability to create projects within that folder scope.

Step-by-Step Solution

1
Identify the project creation requirement.
Creating new projects within a specific resource hierarchy container requires the Project Creator role (roles/resourcemanager.projectCreator) bound at the target Folder or Organization level.
This predefined role grants resourcemanager.projects.create permission without exposing broader folder management capabilities.
2
Identify the billing association requirement.
Linking a GCP project to a billing account requires permissions on both the billing account and the project.
The user automatically becomes Project Owner of newly created projects, giving them project-level billing permissions. To associate the project with the master billing account, they must explicitly hold the Billing Account User role (roles/billing.user) on that billing account.
3
Verify least-privilege constraints.
Combining Billing Account User on the billing account and Project Creator on the folder fulfills all operational requirements while preventing unauthorized administration.
Broader roles like Billing Account Administrator or primitive Owner roles violate strict security requirements.

Key Concept

Dual IAM Permission Requirement for Project Billing Account Association
Rate this question

Topics

Configuring Billing Accounts and Linking Projects