Examkin

Question

Difficulty: MediumConfiguring Billing Accounts and Linking Projects

A cloud engineer at a smart precision agriculture startup needs to delegate project billing administration to a newly hired team lead. The team lead must be able to link newly created Google Cloud projects to the company's central Billing Account and unlink projects when necessary, following the principle of least privilege. The team lead should not have permission to modify billing account payment methods or manage overall billing account access. Which combination of Identity and Access Management (IAM) roles provides the minimum necessary permissions?

  1. Billing Account User role on the Billing Account and Project Billing Manager role on the target projectsAnswer
  2. B
    Billing Account Administrator role on the Billing Account and Owner role on the target projects
  3. C
    Billing Account User role on the Billing Account and Viewer role on the target projects
  4. D
    Billing Account Viewer role on the Billing Account and Project Billing Manager role on the target projects

Answer

Granting the Billing Account User role on the Billing Account combined with the Project Billing Manager role on the target projects provides the exact minimum required permissions.
Linking a Google Cloud project to a Billing Account requires permissions on both sides of the relationship. On the Billing Account side, the Billing Account User role allows an identity to associate projects with that billing account. On the Project side, the Project Billing Manager role allows an identity to link or unlink the project from a billing account. This combination satisfies the requirement under the principle of least privilege.

Step-by-Step Solution

1
Identify the permissions needed on the Billing Account
The user requires permission to associate projects with the central billing account, which is granted by the Billing Account User role (roles/billing.user).
Linking a project requires explicit authorization on the billing account side.
2
Identify the permissions needed on the Project level
The user requires permission to attach or detach billing on the specific projects, which is granted by the Project Billing Manager role (roles/resourcemanager.projectBillingManager).
Modifying project billing state requires billing permissions on the project resource itself.
3
Evaluate against the principle of least privilege
Combining roles/billing.user on the Billing Account and roles/resourcemanager.projectBillingManager on the projects grants sufficient privilege without administrative access to payment settings or general project resource management.
Predefined targeted roles should always be preferred over primitive roles (Owner/Editor) or administrative roles.

Key Concept

Two-Sided Permission Requirement for Project Billing Association
Rate this question

Topics

Configuring Billing Accounts and Linking Projects