Examkin

Question

Difficulty: MediumConfiguring Billing Accounts and Linking Projects

A cloud security administrator at a biotechnology firm needs to grant a lead bio-informatician the required privileges to link a newly provisioned Google Cloud project, `genomics-pipeline-prod`, to the enterprise Cloud Billing Account. The administrator must strictly adhere to the principle of least privilege, ensuring the bio-informatician cannot manage payment details or alter billing account permissions. Which IAM role combination should be granted to the bio-informatician?

  1. Billing Account User (roles/billing.user) on the Cloud Billing Account and Project Billing Manager (roles/resourcemanager.projectBillingManager) on the target projectAnswer
  2. B
    Billing Account Administrator (roles/billing.admin) on the Cloud Billing Account and Owner (roles/owner) on the target project
  3. C
    Billing Account User (roles/billing.user) on the Cloud Billing Account only
  4. D
    Project Billing Manager (roles/resourcemanager.projectBillingManager) on the target project only

Answer

Grant Billing Account User (roles/billing.user) on the Cloud Billing Account and Project Billing Manager (roles/resourcemanager.projectBillingManager) on the target project.
Linking a Google Cloud project to a Cloud Billing Account requires permissions on both entities. The predefined role Billing Account User (`roles/billing.user`) gives the permission `billing.resourceAssociations.create` on the billing account. The predefined role Project Billing Manager (`roles/resourcemanager.projectBillingManager`) gives the permission `resourcemanager.projects.createBillingAssignment` on the project. This combination grants the exact rights required without over-privileging the user.

Step-by-Step Solution

1
Identify the minimum permission required on the Cloud Billing Account
The permission `billing.resourceAssociations.create` is needed, which is provided by the predefined role Billing Account User (`roles/billing.user`).
This allows the user to associate projects with the billing account without granting administrative access over payment settings or billing administration.
2
Identify the minimum permission required on the target Google Cloud Project
The permission `resourcemanager.projects.createBillingAssignment` is needed, which is provided by the predefined role Project Billing Manager (`roles/resourcemanager.projectBillingManager`).
This allows the user to link or unlink the billing account on that specific project without granting broad primitive roles like Owner or Editor.
3
Combine both permissions to achieve least privilege compliance
Pairing Billing Account User on the billing account with Project Billing Manager on the project provides exact, dual-side authorization required for project-billing linking.
Google Cloud requires explicit authorization on both resource entities (the billing account and the project).

Key Concept

Dual-sided IAM requirements for linking Google Cloud Projects to Cloud Billing Accounts
Rate this question

Topics

Configuring Billing Accounts and Linking Projects