Examkin

Question

Difficulty: Very hardManaging Cloud Projects and Resource Hierarchy

A financial enterprise is establishing its Google Cloud resource hierarchy. A Cloud Operations team must configure access so that a group of developers can create new projects inside a specific folder named Analytics-Dev and link those newly created projects to the central corporate billing account 012345-6789AB-CDEF01. The solution must strictly adhere to the principle of least privilege without granting billing administration or organization-wide project creation rights. Which TWO IAM role assignments must be implemented to fulfill these requirements?

  1. Grant the developer group the Project Creator (roles/resourcemanager.projectCreator) role on the Analytics-Dev folder.Answer
  2. Grant the developer group the Billing Account User (roles/billing.user) role directly on billing account 012345-6789AB-CDEF01.Answer
  3. C
    Grant the developer group the Owner (roles/owner) primitive role on the Analytics-Dev folder.
  4. D
    Grant the developer group the Billing Account Administrator (roles/billing.admin) role on the Analytics-Dev folder.
  5. E
    Configure an Organization Policy constraint at the Analytics-Dev folder level to grant project creation permissions to the developer group.

Answer

To allow developers to create projects under a specific folder and link them to a billing account, grant the Project Creator role on the target folder and the Billing Account User role directly on the billing account.
To create projects under a specific folder, principals require the Project Creator (roles/resourcemanager.projectCreator) role scoped to that folder. To attach those new projects to an enterprise billing account, principals also require the Billing Account User (roles/billing.user) role granted on the specific billing account. Together, these two roles grant the exact permissions needed to execute the workflow while maintaining least privilege.

Step-by-Step Solution

1
Determine the minimal IAM role required for creating projects in a target folder.
Identify roles/resourcemanager.projectCreator applied at the Analytics-Dev folder resource level.
Permissions inherit down the hierarchy, so scope project creation to the folder level to avoid organization-wide creation rights.
2
Determine the minimal IAM role required for linking projects to a Google Cloud Billing Account.
Identify roles/billing.user applied directly to the target Billing Account resource.
Linking a project to a billing account requires resourcemanager.projects.create on the project container (or folder) AND billing.resourceAssociations.create on the billing account.
3
Validate against least privilege and resource hierarchy constraints.
Confirm that roles/resourcemanager.projectCreator on the folder and roles/billing.user on the billing account satisfy both conditions with minimal access.
This avoids primitive roles, excessive billing permissions, and structural IAM placement misconfigurations.

Key Concept

Project creation requires the Project Creator role on the parent resource container (folder or organization), and linking a billing account requires the Billing Account User role bound directly to the billing account.
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic