Examkin

Question

Difficulty: MediumConfiguring Billing Accounts and Linking Projects

A cloud governance specialist at an e-commerce organization needs to set up a new isolated Google Cloud project `vendor-audit-2026` for an external compliance audit team and link it to the organization's central billing account (`012345-6789AB-CDEF01`). Place the operational steps in the correct chronological order to create the project, link the billing account using least-privilege permissions, and verify the billing association.

  1. 1Verify or grant the user the Project Creator role (`roles/resourcemanager.projectCreator`) on the parent folder and the Billing Account User role (`roles/billing.user`) on the target Billing Account.
  2. 2Run `gcloud projects create vendor-audit-2026 --folder=1234567890` to create the project under the dedicated folder.
  3. 3Run `gcloud beta billing projects link vendor-audit-2026 --billing-account=012345-6789AB-CDEF01` to associate the project with the billing account.
  4. 4Run `gcloud beta billing projects describe vendor-audit-2026` to confirm that `billingEnabled` is set to `true`.

Answer

The correct sequence starts with granting the necessary least-privilege IAM permissions (`roles/resourcemanager.projectCreator` on the parent folder and `roles/billing.user` on the Billing Account), followed by creating the project (`gcloud projects create`), linking the billing account (`gcloud beta billing projects link`), and finally verifying the configuration (`gcloud beta billing projects describe`).
The workflow follows a standard admin lifecycle: prerequisite access check/grant (IAM verification), resource provision (project creation), binding resource to billing account (linking), and state verification (describing billing status). Linking a project to a billing account specifically requires `roles/billing.user` on the billing account and `resourcemanager.projects.createBillingAssignment` (contained in `roles/billing.user` or Project Owner/Editor).

Step-by-Step Solution

1
Ensure necessary IAM permissions are assigned.
The identity has `roles/resourcemanager.projectCreator` on the folder and `roles/billing.user` on the Billing Account.
Without these permissions, subsequent `gcloud` commands for project creation or billing linking will fail due to access denied errors.
2
Execute project creation command.
The unlinked project `vendor-audit-2026` is created in the specified resource hierarchy folder.
A project entity must be provisioned before a billing account can be attached to it.
3
Link the project to the central Billing Account.
The project `vendor-audit-2026` is attached to billing account `012345-6789AB-CDEF01`.
Linking billing allows resources created inside the project to consume paid GCP services.
4
Verify billing status via CLI.
Output shows `billingAccountName: billingAccounts/012345-6789AB-CDEF01` and `billingEnabled: true`.
Verification confirms that project setup was successful and billing is actively enabled.

Key Concept

Least-privilege billing account linking requires Billing Account User (`roles/billing.user`) on the billing account and Project Creator (`roles/resourcemanager.projectCreator`) on the parent folder/organization prior to project creation and linking commands.
Rate this question

Topics

Configuring Billing Accounts and Linking Projects