A CI/CD automated deployment pipeline uses a dedicated service account to link newly provisioned workload projects to an enterprise Cloud Billing Account. To comply with corporate compliance policies following the principle of least privilege, which pair of predefined IAM roles must be granted to this service account?
- roles/billing.user on the Cloud Billing Account and roles/resourcemanager.projectBillingManager on the target projectAnswer
- Broles/billing.user on the Cloud Billing Account and roles/browser on the target project
- Croles/billing.admin on the Cloud Billing Account and roles/owner on the target project
- Droles/billing.viewer at the Organization level and roles/editor on the target project
Answer
Granting roles/billing.user on the Cloud Billing Account and roles/resourcemanager.projectBillingManager on the target project.
To link a project to a Cloud Billing Account, an identity requires permissions on both resources: roles/billing.user (or Billing Account Administrator) on the billing account itself, and roles/resourcemanager.projectBillingManager (or Project Owner/Editor) on the project. Under the principle of least privilege, using roles/billing.user alongside roles/resourcemanager.projectBillingManager is the exact predefined combination recommended by Google Cloud.
Step-by-Step Solution
Key Concept
Dual-resource IAM permission requirements for project billing association under least privilege