Examkin

Soru

Zorluk: Çok zorManaging Cloud Projects and Resource Hierarchy

An enterprise DevOps team needs to configure an automated service account, [email protected], to provision new Google Cloud projects inside a designated folder named Engineering-Apps. Additionally, these newly created projects must be linked to the company central billing account (ID: 01ABCD-EF1234-567890). Following the principle of least privilege, which configuration of IAM roles should be assigned to the service account?

  1. Grant Project Creator (roles/resourcemanager.projectCreator) on the Engineering-Apps folder and Billing Account User (roles/billing.user) on the central billing account.Cevap
  2. B
    Grant Owner (roles/owner) on the Engineering-Apps folder and Project Creator (roles/resourcemanager.projectCreator) on the central billing account.
  3. C
    Grant Project Creator (roles/resourcemanager.projectCreator) on the Engineering-Apps folder only, relying on folder permission inheritance to automatically authorize billing account linking.
  4. D
    Grant Project Creator (roles/resourcemanager.projectCreator) at the Organization root level and Billing Account Administrator (roles/billing.admin) on the Engineering-Apps folder.

Cevap

Grant Project Creator (roles/resourcemanager.projectCreator) on the Engineering-Apps folder and Billing Account User (roles/billing.user) on the central billing account.
To create projects within a specific folder and link them to a billing account, an identity requires Project Creator (roles/resourcemanager.projectCreator) bound on that target folder and Billing Account User (roles/billing.user) bound on the specific Billing Account. This configuration satisfies the principle of least privilege by scoping project creation rights to the intended folder and limiting billing interaction to user-level linking.

Adım Adım Çözüm

1
Identify the minimum permission needed to create projects in a specific resource container.
The Project Creator role (roles/resourcemanager.projectCreator) granted on the target folder (Engineering-Apps) allows creating projects within that folder without granting global organization-wide privileges.
Applying the role at the folder level adheres to the principle of least privilege.
2
Identify the minimum permission required to associate newly created projects with an enterprise billing account.
The Billing Account User role (roles/billing.user) must be bound directly on the billing account resource (01ABCD-EF1234-567890).
Project creation permissions do not automatically grant rights to attach billing accounts.

Anahtar Kavram

Scope-specific IAM role assignment for project creation and billing account linking in GCP resource hierarchy
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Managing Cloud Projects and Resource Hierarchy

Bu konudan daha fazla soru