Examkin

Question

Difficulty: EasyConfiguring Billing Accounts and Linking Projects

A cloud administrator needs to grant a user the minimum predefined IAM roles required to link an existing Google Cloud project to an active Cloud Billing account. Which combination of IAM roles should be assigned to fulfill this requirement according to the principle of least privilege?

  1. Billing Account User (roles/billing.user) on the billing account and Project Billing Manager (roles/billing.projectManager) on the projectAnswer
  2. B
    Billing Account User (roles/billing.user) on the billing account and Project Viewer (roles/viewer) on the project
  3. C
    Billing Account Administrator (roles/billing.admin) on the billing account and Project Owner (roles/owner) on the project
  4. D
    Billing Account Creator (roles/billing.creator) on the organization and Project Billing Manager (roles/billing.projectManager) on the project

Answer

Assigning Billing Account User on the billing account and Project Billing Manager on the project provides the minimum required permissions to link a project to an existing billing account.
Linking an existing project to a Cloud Billing account requires permissions on both resources: Billing Account User (roles/billing.user) grants authority to associate the billing account with projects, while Project Billing Manager (roles/billing.projectManager) grants authority to manage the billing link on the project itself. This combination adheres strictly to the principle of least privilege.

Step-by-Step Solution

1
Identify the permission required on the billing account
The principal requires billing.accounts.get and billing.accounts.usePermissions, provided by the predefined role Billing Account User (roles/billing.user).
Users must be authorized to attach charges to the target billing account.
2
Identify the permission required on the target project
The principal requires resourcemanager.projects.createBillingAssignment permission, provided by the predefined role Project Billing Manager (roles/billing.projectManager).
Users must be authorized to modify the billing association on the specific project.
3
Evaluate options for least privilege compliance
Combining Billing Account User and Project Billing Manager satisfies both permission requirements without granting excess primitive or administrative access.
Google Cloud security best practices dictate using specific predefined roles over broad administrative or primitive roles.

Key Concept

Least-privilege IAM roles required for linking Google Cloud projects to billing accounts
Estimated Time:45s
Rate this question

Topics

Configuring Billing Accounts and Linking Projects