Examkin

Question

Difficulty: HardConfiguring Billing Accounts and Linking Projects

An enterprise cloud operations engineer is tasked with linking a newly created Google Cloud project named `analytics-prod-data` to the company's central Cloud Billing account (`01A2B3-4C5D6E-7F8901`). Organization policy mandates strict adherence to the principle of least privilege using predefined IAM roles. Which combination of roles must be assigned to the engineer to enable project billing link management?

  1. Project Billing Manager (`roles/billing.projectManager`) on the project and Billing Account User (`roles/billing.user`) on the Cloud Billing accountAnswer
  2. B
    Billing Account User (`roles/billing.user`) on the Cloud Billing account only
  3. C
    Billing Account Administrator (`roles/billing.admin`) on the Cloud Billing account and Project Owner (`roles/owner`) on the project
  4. D
    Project Billing Manager (`roles/billing.projectManager`) assigned at the Organization node without explicit roles on the Cloud Billing account

Answer

The engineer must be assigned the Project Billing Manager role (`roles/billing.projectManager`) on the project (or parent folder/organization) and the Billing Account User role (`roles/billing.user`) on the Cloud Billing account.
To link a Google Cloud project to a Cloud Billing account, two distinct permissions are required: `resourcemanager.projects.createBillingAssignment` on the target project and `billing.resourceAssociations.create` on the Cloud Billing account. The predefined role `roles/billing.projectManager` supplies the project permission, while `roles/billing.user` grants the billing account permission. Combining these two predefined roles satisfies the requirement with minimum necessary permissions.

Step-by-Step Solution

1
Identify project-side permission requirements
The user needs the `resourcemanager.projects.createBillingAssignment` permission on the project to modify its billing link.
Google Cloud requires explicit authorization on the project resource to attach or detach billing.
2
Identify billing-account-side permission requirements
The user needs the `billing.resourceAssociations.create` permission on the target Cloud Billing account.
Authorization on the billing account resource ensures that unauthorized users cannot link projects to incur costs on an account.
3
Map required permissions to predefined IAM roles enforcing least privilege
The combination of `roles/billing.projectManager` on the project and `roles/billing.user` on the Cloud Billing account provides both required permissions without excess privileges.
Primitive roles like Owner or broad roles like Billing Account Administrator grant excess capabilities, violating organizational least-privilege policies.

Key Concept

Dual-sided IAM permission requirements for Cloud Billing project linking
Estimated Time:2m 0s
Rate this question

Topics

Configuring Billing Accounts and Linking Projects