Examkin

Soru

Zorluk: OrtaConfiguring Billing Accounts and Linking Projects

A lead financial operations manager at a digital publishing firm needs to authorize an environment manager to link an existing unlinked project, `media-archival-service`, to the enterprise Cloud Billing Account while adhering strictly to the principle of least privilege. Which TWO IAM roles should be granted to the environment manager?

  1. Billing Account User (`roles/billing.user`) on the Cloud Billing AccountCevap
  2. Project Billing Manager (`roles/billing.projectManager`) on the projectCevap
  3. C
    Billing Account Administrator (`roles/billing.admin`) on the Cloud Billing Account
  4. D
    Project Owner (`roles/owner`) on the project
  5. E
    Billing Account Viewer (`roles/billing.viewer`) on the Cloud Billing Account

Cevap

The user must be granted the Billing Account User role on the Cloud Billing Account and the Project Billing Manager role on the target project.
Linking an existing project to a Cloud Billing Account requires the `resourcemanager.projects.createBillingAssignment` permission on both resources. The Billing Account User (`roles/billing.user`) role supplies this permission for the billing account, and the Project Billing Manager (`roles/billing.projectManager`) role supplies this permission for the project, adhering strictly to least privilege.

Adım Adım Çözüm

1
Identify the permission required to link a project to a Cloud Billing Account
The `resourcemanager.projects.createBillingAssignment` permission is required on both the project and the billing account.
Google Cloud authorization controls require permission on both the target resource (project) and the paying entity (billing account).
2
Select the least-privilege predefined role for the Cloud Billing Account
Billing Account User (`roles/billing.user`) provides the necessary permission on the billing account.
Billing Account Administrator grants unnecessary extra permissions such as managing payment profiles and billing permissions.
3
Select the least-privilege predefined role for the Cloud Project
Project Billing Manager (`roles/billing.projectManager`) provides the necessary permission on the project.
Project Owner grants full control over all project resources and IAM policies, violating least privilege.

Anahtar Kavram

Configuring least privilege permissions on both billing accounts and projects for billing association
Bu soruyu puanla

Konular

Configuring Billing Accounts and Linking Projects