Examkin

Question

Difficulty: HardManaging Cloud Projects and Resource Hierarchy

An enterprise DevOps team needs to set up a new environment within their Google Cloud resource hierarchy. The team requires authorization to create new projects exclusively under a designated folder named 'Mobile-Backend' and link those projects to the company's central Billing Account. Following the principle of least privilege, which TWO IAM roles must be granted to the DevOps team principal?

  1. Project Creator (roles/resourcemanager.projectCreator) on the 'Mobile-Backend' folderAnswer
  2. Billing Account User (roles/billing.user) on the central Billing AccountAnswer
  3. C
    Billing Account Administrator (roles/billing.admin) on the Organization node
  4. D
    Folder Admin (roles/resourcemanager.folderAdmin) on the Organization node
  5. E
    Project IAM Admin (roles/resourcemanager.projectIamAdmin) on the 'Mobile-Backend' folder

Answer

To allow creating projects in a specific folder and linking them to a central billing account under least privilege, the DevOps team must be granted the Project Creator role scoped to the 'Mobile-Backend' folder and the Billing Account User role on the target Billing Account.
Creating a project inside a specific folder requires the Project Creator role granted on that folder resource. Linking any project to a billing account requires the Billing Account User role granted directly on the target billing account resource. Together, these two roles achieve the goal using least privilege.

Step-by-Step Solution

1
Determine the role required to create projects within a specific resource hierarchy folder.
The Project Creator role (roles/resourcemanager.projectCreator) provides the resourcemanager.projects.create permission.
Scoping this role to the 'Mobile-Backend' folder ensures project creation is constrained only to that directory.
2
Determine the role required to associate newly created projects with a billing account.
The Billing Account User role (roles/billing.user) provides the billing.resourceAssociations.create permission on the billing account.
Granting this on the specific Billing Account allows linking projects without exposing payment settings or account administration.

Key Concept

Least privilege IAM role delegation for Google Cloud project creation and billing account linking.
Estimated Time:2m 0s
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic