Examkin

Question

Difficulty: EasyConfiguring Billing Accounts and Linking Projects

You are tasked with linking a newly created Google Cloud project to an existing corporate Cloud Billing account. Following Google Cloud's principle of least privilege, which pair of IAM roles must be granted to your user account to complete this task?

  1. Billing Account User on the Cloud Billing account and Project Billing Manager on the projectAnswer
  2. B
    Billing Account User on the Cloud Billing account only
  3. C
    Billing Account Administrator on the Cloud Billing account and Owner on the project
  4. D
    Project Billing Manager on the project only

Answer

To link a project to a Cloud Billing account under least privilege, you must have the Billing Account User role on the billing account and the Project Billing Manager role on the project.
Linking a Google Cloud project to a Cloud Billing account requires permissions on both entities. The Billing Account User role (roles/billing.user) grants the ability to associate projects with the billing account, and the Project Billing Manager role (roles/billing.projectManager) grants the ability to manage billing associations on the specific project. Together, these predefined roles fulfill the task while adhering to the principle of least privilege.

Step-by-Step Solution

1
Identify the resource permission requirements for linking a project to a billing account.
Linking requires permissions on two distinct Google Cloud resources: the Cloud Billing account and the Cloud Project.
Google Cloud IAM evaluates access control separately for billing account objects and project hierarchy objects.
2
Select the least-privilege predefined role for the Cloud Billing account.
Billing Account User (roles/billing.user) provides the resourcemanager.projects.createBillingAssignment permission without granting full administration rights.
Billing Account Administrator grants broad administrative rights over payment methods and agreements, which are unnecessary for simple project linking.
3
Select the least-privilege predefined role for the Cloud Project.
Project Billing Manager (roles/billing.projectManager) allows linking and unlinking the project to a billing account.
Using Project Billing Manager avoids granting broad primitive Owner or Editor permissions on the project.

Key Concept

Project to Billing Account Linking Permissions
Estimated Time:50s
Rate this question

Topics

Configuring Billing Accounts and Linking Projects