Examkin

Soru

Zorluk: ZorManaging IAM Roles and Resource Access Permissions

A cloud engineer must configure access for a finance team member who needs to link newly provisioned Google Cloud projects to the company's central Billing Account and monitor project cost data. The finance team member must not be allowed to modify project infrastructure resources or manage billing account administrators and budgets. Which IAM role assignment strategy adheres to the principle of least privilege?

  1. Grant the Billing Account User (roles/billing.user) role on the Billing Account, and grant the Project Billing Manager (roles/resourcemanager.projectBillingManager) role on the target projects.Cevap
  2. B
    Grant the Project Editor (roles/editor) role on the target projects only.
  3. C
    Grant the Billing Account Administrator (roles/billing.admin) role on the Billing Account, and grant the Project Owner (roles/owner) role on the target projects.
  4. D
    Grant the Billing Account User (roles/billing.user) role at the Organization level only.

Cevap

Grant the Billing Account User role on the Billing Account and the Project Billing Manager role on the target projects.
Linking a Google Cloud project to a Billing Account requires explicit authorization on two separate resources. The principal must hold the Billing Account User (roles/billing.user) role on the central Billing Account resource and the Project Billing Manager (roles/resourcemanager.projectBillingManager) role on the project resource. This combination grants exact rights to link billing and view costs without granting infrastructural administrative rights or full billing account management.

Adım Adım Çözüm

1
Identify the required actions
The user needs to link a project to a Billing Account and view project cost data without managing project infrastructure or modifying billing account administration.
Determining exact action boundaries helps select least-privilege predefined roles.
2
Determine Billing Account level permission requirement
The principal needs roles/billing.user on the specific Billing Account object.
Linking a project to a billing account requires permission to use the billing account.
3
Determine Project level permission requirement
The principal needs roles/resourcemanager.projectBillingManager on the target project.
Linking requires project-level authorization to associate billing to that specific project.

Anahtar Kavram

Billing Account Project Linking IAM Requirements
Bu soruyu puanla

Konular

Managing IAM Roles and Resource Access Permissions

Bu konudan daha fazla soru