Examkin

Question

Difficulty: Very hardManaging Cloud Projects and Resource Hierarchy

A principal security architect is configuring the Google Cloud resource hierarchy for a multi-regional organization. The hierarchy consists of an Organization node, under which sits a top-level folder named 'Production-Workloads' containing two sub-folders: 'App-Services' and 'Data-Analytics'. A DevOps engineer has been assigned the 'Project Creator' role (`roles/resourcemanager.projectCreator`) at the 'Production-Workloads' folder level, and the 'Billing Account User' role (`roles/billing.user`) on the corporate Billing Account. The engineer needs to create a new project named 'analytics-pipeline-prod' under the nested 'Data-Analytics' sub-folder and associate it with the corporate Billing Account. However, an explicit IAM deny policy or missing permission is suspected of blocking the deployment. Based on the Google Cloud resource hierarchy IAM inheritance model and billing requirements, which statement correctly describes the permission behavior for this scenario?

  1. The project creation will succeed because 'roles/resourcemanager.projectCreator' granted at the parent folder ('Production-Workloads') automatically inherits down to the nested 'Data-Analytics' sub-folder, fulfilling the project creation requirement alongside the Billing Account User role.Answer
  2. B
    The project creation will fail because IAM policy inheritance is strictly limited to direct parent-child pairs and does not propagate to nested sub-folders unless explicitly re-granted at each sub-folder level.
  3. C
    The project creation will fail because linking a project to a corporate Billing Account requires the primitive 'Owner' role on the target sub-folder rather than predefined IAM roles.
  4. D
    The project creation will fail because the engineer only holds the 'Billing Account User' role on the Billing Account, but requires 'Billing Account Administrator' permissions on the target sub-folder node to establish project billing links.

Answer

The project creation will succeed because 'roles/resourcemanager.projectCreator' granted at the parent folder level inherits transitively down to the nested sub-folder, providing the necessary project creation rights in combination with the Billing Account User role on the billing account.
In Google Cloud, IAM policies set at parent nodes in the resource hierarchy (such as an Organization or parent Folder) are inherited transitively by all descendant nodes, including nested sub-folders and projects. Because the DevOps engineer has 'roles/resourcemanager.projectCreator' assigned at the 'Production-Workloads' parent folder level, this role inherits down to the 'Data-Analytics' sub-folder. Combined with the 'roles/billing.user' role assigned directly on the Billing Account resource, the engineer possesses all required authorizations to create the project and link it to billing.

Step-by-Step Solution

1
Analyze IAM Policy Inheritance in Google Cloud Resource Hierarchy
Permissions granted at higher hierarchy levels (Organization or parent Folder) automatically propagate down to all child nodes, including nested sub-folders and projects.
Google Cloud IAM follows a transitive inheritance model down the hierarchy tree.
2
Verify Permissions Required for Project Creation and Billing Account Linkage
Creating a project in a folder requires 'resourcemanager.projects.create' (included in 'roles/resourcemanager.projectCreator') on the target folder node. Linking to a billing account requires 'roles/billing.user' on the target Billing Account resource.
These two permissions fulfill the complete requirements for establishing a billed project in the target folder.
3
Evaluate the DevOps Engineer's Effective Rights at the Target Sub-Folder
The engineer holds Project Creator inherited at the 'Data-Analytics' sub-folder and Billing Account User on the Billing Account, enabling successful execution.
Inherited permissions provide full authorization without requiring explicit duplicate role assignments at every sub-folder.

Key Concept

Resource Hierarchy Policy Inheritance and Billing Account Linking Permissions
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic