Examkin

Soru

Zorluk: ZorConfiguring Billing Accounts and Linking Projects

A centralized platform security team is auditing permission boundaries for an infrastructure automation service account (`[email protected]`). The service account is designated solely to attach newly onboarded, existing Google Cloud projects to the enterprise Cloud Billing Account without possessing permissions to modify billing account financial settings or manage compute workloads inside the projects.

Which TWO predefined IAM roles represent the minimum necessary privileges required for this service account to successfully link the projects to the Cloud Billing Account? (Select TWO.)

  1. Billing Account User (`roles/billing.user`) on the Cloud Billing AccountCevap
  2. Project Billing Manager (`roles/billing.projectManager`) on the target projects or parent folderCevap
  3. C
    Billing Account Administrator (`roles/billing.admin`) on the Cloud Billing Account
  4. D
    Project Owner (`roles/owner`) on the target projects
  5. E
    Billing Account Viewer (`roles/billing.viewer`) on the Cloud Billing Account

Cevap

To link an existing Google Cloud project to a Cloud Billing Account under the principle of least privilege, a principal requires Billing Account User (`roles/billing.user`) on the billing account and Project Billing Manager (`roles/billing.projectManager`) on the target project or parent resource container.
Linking a project to a Cloud Billing Account requires permissions on both sides of the relationship: the Billing Account User role grants the necessary `billing.resourceAssociations.create` permission on the billing account, while the Project Billing Manager role grants `resourcemanager.projects.createBillingAssignment` on the target project without exposing underlying workload resources or payment settings.

Adım Adım Çözüm

1
Identify the required billing account permission for project linking.
The principal needs `billing.resourceAssociations.create` on the target Cloud Billing Account.
Linking a project requires explicit permission on the billing account to associate it with resource costs.
2
Select the least-privilege predefined role for the billing account.
Billing Account User (`roles/billing.user`) provides `billing.resourceAssociations.create` without granting full administrative privileges.
Adhering to least-privilege security mandates avoids broad management roles when association access is sufficient.
3
Identify the required project-level permission for billing assignment.
The principal needs `resourcemanager.projects.createBillingAssignment` on the target project or folder level.
Linking a project also requires explicit authorization on the project side to modify its billing account attachment.
4
Select the least-privilege predefined role for the project level.
Project Billing Manager (`roles/billing.projectManager`) provides project billing configuration rights without granting primitive Owner or Editor permissions.
Project Billing Manager allows attaching or detaching billing accounts without granting access to manage underlying compute resources.

Anahtar Kavram

Dual-sided IAM requirement and least-privilege role selection for linking Google Cloud projects to Cloud Billing Accounts
Bu soruyu puanla

Konular

Configuring Billing Accounts and Linking Projects