Examkin

Question

Difficulty: HardManaging IAM Roles and Resource Access Permissions

A centralized accounting department manages a primary Google Cloud Billing Account for your company. To support decentralized resource deployment, project managers require the ability to associate their newly created Google Cloud projects with this central billing account. However, organizational security policies mandate that project managers must not be allowed to view invoice payment histories, change billing account settings, or manage billing permissions. Which IAM role should be assigned to the project managers on the billing account to satisfy these requirements while adhering to the principle of least privilege?

  1. Billing Account User (roles/billing.user)Answer
  2. B
    Billing Account Viewer (roles/billing.viewer)
  3. C
    Billing Account Administrator (roles/billing.admin)
  4. D
    Editor (roles/editor)

Answer

Billing Account User (roles/billing.user)
The Billing Account User (roles/billing.user) role provides users with the precise permission needed to link projects to a billing account (resourcemanager.projects.createBillingAssignment) without exposing billing transaction history, credit card details, or administrative settings.

Step-by-Step Solution

1
Identify the operation being performed
The operation is associating (linking) a newly created Google Cloud project to an existing Billing Account.
Linking a project requires permission on both the project (Project Creator/Owner) and the target Billing Account.
2
Analyze permission boundaries on the Billing Account
The requirement mandates granting only the ability to link projects without allowing access to view financial invoices or modify billing management settings.
Least privilege dictates selecting a predefined role tailored specifically to project-to-billing association.
3
Select the appropriate IAM role on the Billing Account resource
Billing Account User (roles/billing.user) provides the exact permission (resourcemanager.projects.createBillingAssignment) needed to link projects without extra privileges.
Billing Account Viewer lacks assignment rights, Billing Account Administrator is overly permissive, and project-level roles do not grant permissions on the Billing Account resource.

Key Concept

Least Privilege Billing Account IAM Role Assignment
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic