Examkin

Question

Difficulty: MediumConfiguring Billing Accounts and Linking Projects

A fintech company is setting up a new Google Cloud project named `payment-clearing-dev` for a team of external contractors. A cloud administrator needs to grant an external contractor the minimum necessary IAM permissions required to link this newly created project to the company's central Cloud Billing Account. The contractor should not have administrative control over the billing account or overall ownership of the project. Following Google Cloud least-privilege best practices, which configuration of roles should be granted to the contractor?

  1. Grant the Billing Account User role (roles/billing.user) on the Cloud Billing Account, and grant the Project Billing Manager role (roles/billing.projectManager) on the project.Answer
  2. B
    Grant the Billing Account Administrator role (roles/billing.admin) on the Cloud Billing Account, and grant the Owner role (roles/owner) on the project.
  3. C
    Grant the Billing Account Viewer role (roles/billing.viewer) on the Cloud Billing Account, and grant the Project Billing Manager role (roles/billing.projectManager) on the project.
  4. D
    Grant the Billing Account User role (roles/billing.user) at the parent Organization level only, relying on policy inheritance to automatically grant project-level billing linkage rights.

Answer

Grant the Billing Account User role (roles/billing.user) on the Cloud Billing Account, and grant the Project Billing Manager role (roles/billing.projectManager) on the project.
Linking a Google Cloud project to a billing account requires two distinct sets of permissions: `roles/billing.user` granted on the Cloud Billing Account (which grants permission to attach projects to that billing account) and `roles/billing.projectManager` granted on the target Project (which permits attaching a billing account to that project). This combination enforces the principle of least privilege.

Step-by-Step Solution

1
Identify the permissions required on the Cloud Billing Account side.
The user needs the `billing.resourceAssociations.create` permission on the billing account, which is included in the predefined `roles/billing.user` (Billing Account User) role.
Linking a project to a billing account requires authorization from the billing account to attach new projects to it.
2
Identify the permissions required on the GCP Project side.
The user needs the `resourcemanager.projects.createBillingAssignment` permission on the target project, which is provided by the predefined `roles/billing.projectManager` (Project Billing Manager) role.
The project itself must permit changing its associated billing account.
3
Apply the principle of least privilege.
Combining `roles/billing.user` on the billing account with `roles/billing.projectManager` on the project satisfies both requirements without over-granting administrative permissions like Billing Administrator or Project Owner.
Minimizes security risk while fulfilling procedural requirements.

Key Concept

Two-Sided IAM Permissions for Project Billing Linkage
Rate this question

Topics

Configuring Billing Accounts and Linking Projects