Examkin

Soru

Zorluk: Çok zorConfiguring Billing Accounts and Linking Projects

An enterprise organization maintains a centralized Google Cloud Billing Account managed by a finance operations team. A DevOps consultant needs to link several existing, unlinked Google Cloud projects to this central Billing Account. Organization security policies enforce strict least-privilege access: the consultant must not be allowed to view invoice history or modify payment methods on the Billing Account, nor should they have permissions to create, modify, or delete infrastructure resources within the projects. Which minimal combination of predefined IAM roles must be granted to the DevOps consultant?

  1. Grant roles/billing.user on the Billing Account and roles/billing.projectManager on the target Projects.Cevap
  2. B
    Grant roles/billing.admin on the Billing Account and roles/owner on the target Projects.
  3. C
    Grant roles/billing.projectManager on the target Projects only.
  4. D
    Grant roles/billing.user on the parent Folder and roles/resourcemanager.projectCreator on the target Projects.

Cevap

Granting the Billing Account User role (roles/billing.user) on the Billing Account and the Project Billing Manager role (roles/billing.projectManager) on the target Projects provides the minimal required permissions.
To successfully link an existing Google Cloud project to a Billing Account under the principle of least privilege, two specific predefined IAM roles are required: the Billing Account User role (roles/billing.user) on the Billing Account, and the Project Billing Manager role (roles/billing.projectManager) on the target Project. The Billing Account User role permits associating projects with the billing account without exposing sensitive financial settings, while the Project Billing Manager role allows updating project billing attachments without granting permissions to alter project resources.

Adım Adım Çözüm

1
Identify the required actions for project linking
Linking a project requires permissions on two distinct Google Cloud resource boundaries: the Billing Account and the Google Cloud Project.
Google Cloud IAM enforces permissions separately for billing account resource operations and project resource operations.
2
Determine the least-privilege role for the Billing Account
roles/billing.user (Billing Account User) grants the resourcemanager.projects.createBillingAssignment permission without allowing access to billing account configuration, credit cards, or financial statements.
This satisfies the requirement to attach projects to the billing account while restricting access to financial management.
3
Determine the least-privilege role for the target Projects
roles/billing.projectManager (Project Billing Manager) grants permissions to link and unlink billing accounts for specific projects without granting access to project resources, code, or compute instances.
Using broad roles like Owner or Editor would violate the constraint against modifying project infrastructure or access policies.

Anahtar Kavram

Least-Privilege Project Billing Account Association
Bu soruyu puanla

Konular

Configuring Billing Accounts and Linking Projects