Examkin

Soru

Zorluk: ZorConfiguring Billing Accounts and Linking Projects

An organization isolates client vulnerability assessments inside dedicated Google Cloud projects. A newly onboarded security engineer, assigned the Cloud Identity identity `[email protected]`, needs to associate an existing project (`client-eval-sec-99`) with the centralized Cloud Billing account (`01AB23-45CD67-89EF01`). The engineer has already been granted the Billing Account User (`roles/billing.user`) role directly on the Cloud Billing account. When running the `gcloud beta billing projects link` command, the request fails with an IAM permission denied error on the project resource. Following Google Cloud's principle of least privilege, which IAM role should be granted to `[email protected]` on the target project to resolve this failure?

  1. Project Billing Manager (roles/billing.projectManager) on the target projectCevap
  2. B
    Project Owner (roles/owner) on the target project
  3. C
    Billing Account Administrator (roles/billing.admin) on the Cloud Billing account
  4. D
    Project Creator (roles/resourcemanager.projectCreator) on the parent Organization node

Cevap

Granting Project Billing Manager (`roles/billing.projectManager`) on the target project resource provides the minimum necessary permission (`resourcemanager.projects.createBillingAssignment`) required to link an existing project to a billing account.
Linking a Cloud Billing account to a project requires permissions on both sides of the association. On the billing account side, `roles/billing.user` grants `billing.resourceAssociations.create`. On the project side, the user must have `resourcemanager.projects.createBillingAssignment`. The predefined role Project Billing Manager (`roles/billing.projectManager`) provides this exact project permission without conferring unnecessary management capabilities over compute, storage, or security settings.

Adım Adım Çözüm

1
Analyze the permission requirements for project-billing linking
Linking a project requires `billing.resourceAssociations.create` on the Billing Account AND `resourcemanager.projects.createBillingAssignment` on the Project.
Google Cloud IAM enforces dual-sided authorization to prevent unauthorized projects from consuming billing account credits.
2
Evaluate the user's existing permissions
The user already has `roles/billing.user` on the Billing Account, providing `billing.resourceAssociations.create`.
The missing permission is on the target project resource side (`resourcemanager.projects.createBillingAssignment`).
3
Apply the principle of least privilege to select the target role
Assign `roles/billing.projectManager` on the target project.
`roles/billing.projectManager` grants `resourcemanager.projects.createBillingAssignment` without granting broad primitive permissions like Owner or Editor.

Anahtar Kavram

Dual-sided IAM permissions for linking Google Cloud projects to Cloud Billing accounts under least privilege
Bu soruyu puanla

Konular

Configuring Billing Accounts and Linking Projects