Examkin

Question

Difficulty: HardManaging Cloud Projects and Resource Hierarchy

A company is configuring a multi-tier Google Cloud resource hierarchy. A centralized platform infrastructure team requires authorization to provision new cloud projects exclusively within a dedicated folder named `Production-Apps` and to associate these newly created projects with the corporate Billing Account `019283-475610-892014`. The security manager mandates adhering strictly to the principle of least privilege without granting permissions over unrelated folders or full billing administration privileges. Which set of IAM role assignments must be configured for the platform infrastructure team?

  1. Grant Project Creator (`roles/resourcemanager.projectCreator`) on the `Production-Apps` folder and Billing Account User (`roles/billing.user`) on the Billing Account `019283-475610-892014`.Answer
  2. B
    Grant Project Creator (`roles/resourcemanager.projectCreator`) and Billing Account User (`roles/billing.user`) both directly on the `Production-Apps` folder.
  3. C
    Grant Folder Admin (`roles/resourcemanager.folderAdmin`) at the Organization node level and Billing Account Administrator (`roles/billing.admin`) on the Billing Account `019283-475610-892014`.
  4. D
    Grant Owner (`roles/owner`) on the `Production-Apps` folder and rely on resource hierarchy policy inheritance to automatically grant billing link rights.

Answer

Grant Project Creator (`roles/resourcemanager.projectCreator`) on the `Production-Apps` folder and Billing Account User (`roles/billing.user`) on the Billing Account `019283-475610-892014`.
To create projects inside a specific folder while associating them with a billing account under least-privilege constraints, two distinct role bindings are required: Project Creator (`roles/resourcemanager.projectCreator`) scoped on the destination Folder, and Billing Account User (`roles/billing.user`) scoped directly on the target Billing Account.

Step-by-Step Solution

1
Identify the minimum required IAM role for project creation within a specific folder.
Assigning `roles/resourcemanager.projectCreator` scoped directly to the target folder allows project creation within that folder only.
Permissions inherit downward from the folder level, isolating creation capabilities to the intended scope.
2
Identify the minimum required IAM role for linking newly created projects to a billing account.
Assigning `roles/billing.user` directly on the Billing Account resource permits linking projects to that billing account.
Billing Accounts exist outside the resource hierarchy container structure, so billing roles must be assigned directly on the Billing Account object itself.
3
Combine both scoped predefined roles to meet least-privilege requirements.
The platform team receives exact project creation rights in `Production-Apps` and billing linking rights on `019283-475610-892014`.
This avoids granting broad primitive roles or organization-wide administration rights.

Key Concept

Managing Google Cloud Resource Hierarchy and Billing Account IAM Scoping
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic