Examkin

Soru

Zorluk: Çok zorManaging IAM Roles and Resource Access Permissions

A finance specialist in your organization must be given the capability to link newly provisioned Google Cloud projects to the organization's central Billing Account and monitor project cost metrics. Following Google recommended security practices of least privilege, the specialist must not have administrative authority to alter billing account policies or permissions to modify cloud infrastructure resources within the projects. Which pair of IAM role assignments correctly fulfills these requirements?

  1. Grant the user the Billing Account User role (roles/billing.user) on the Billing Account, and the Project Billing Manager role (roles/resourcemanager.projectBillingManager) on the target projects.Cevap
  2. B
    Grant the user the Billing Account Administrator role (roles/billing.admin) on the Billing Account, and the Editor role (roles/editor) on the target projects.
  3. C
    Grant the user the Billing Account Viewer role (roles/billing.viewer) on the Billing Account, and rely on the Project IAM Admin role (roles/resourcemanager.projectIamAdmin) inherited from the Organization level to link billing.
  4. D
    Grant the user the Billing Account User role (roles/billing.user) on the parent Folder containing the projects, and the Billing Account Viewer role (roles/billing.viewer) on the Billing Account.

Cevap

To associate a project with a billing account under least privilege principles, assign the Billing Account User role (roles/billing.user) on the Billing Account resource and the Project Billing Manager role (roles/resourcemanager.projectBillingManager) on the target projects.
Linking a Google Cloud project to a Billing Account requires explicit IAM permissions on both distinct resources. On the Billing Account, the user needs the 'roles/billing.user' role to use the billing account. On the target project, the user needs the 'roles/resourcemanager.projectBillingManager' role to modify the project's billing configuration. This combination satisfies least privilege without granting compute modification or billing administration capabilities.

Adım Adım Çözüm

1
Identify the required permissions on the Billing Account resource.
Determined that associating projects with a billing account requires resourcemanager.projects.createBillingAssignment, contained within roles/billing.user assigned on the billing account.
Users must be authorized users of the billing account to attach financial liability to it.
2
Identify the required permissions on the Project resource.
Determined that updating a project's billing link requires resourcemanager.projects.updateBillingInfo, provided by roles/resourcemanager.projectBillingManager on the project.
Users must have authorization to modify configuration properties of the project.
3
Evaluate candidate role pairings against the principle of least privilege.
Selected roles/billing.user on the billing account and roles/resourcemanager.projectBillingManager on the projects, as they grant exactly the necessary scope without over-granting administrative or compute editing rights.
Avoids using primitive roles like Editor or administrative roles like Billing Account Admin.

Anahtar Kavram

Dual-Resource Authorization for GCP Billing Account Project Linking
Bu soruyu puanla

Konular

Managing IAM Roles and Resource Access Permissions

Bu konudan daha fazla soru