Examkin

Soru

Zorluk: OrtaManaging Cloud Projects and Resource Hierarchy

A retail enterprise uses an automated provisioning script executed by a service account named `[email protected]`. The script is designed to create new workload projects within a specific organizational folder named `Digital-Storefronts` and link those newly created projects to the company's central Cloud Billing Account. Which IAM role assignments are required for the service account to execute this workflow while adhering to the principle of least privilege? (Select TWO.)

  1. Grant the Project Creator role (roles/resourcemanager.projectCreator) to the service account on the Digital-Storefronts folder.Cevap
  2. Grant the Billing Account User role (roles/billing.user) to the service account on the central Cloud Billing Account.Cevap
  3. C
    Grant the Editor primitive role (roles/editor) to the service account at the Organization root level.
  4. D
    Grant the Billing Account User role (roles/billing.user) to the service account on the Digital-Storefronts folder.
  5. E
    Grant the Project Creator role (roles/resourcemanager.projectCreator) at the individual project level after disabling parent policy inheritance.

Cevap

The service account requires the Project Creator role (roles/resourcemanager.projectCreator) granted on the Digital-Storefronts folder and the Billing Account User role (roles/billing.user) granted on the central Cloud Billing Account.
Creating a project inside a specific folder requires the Project Creator role (roles/resourcemanager.projectCreator) assigned at that target folder level. Linking any newly created project to a Cloud Billing Account requires the Billing Account User role (roles/billing.user) assigned directly on the Cloud Billing Account resource itself.

Adım Adım Çözüm

1
Identify the permission required to create projects in a specific container.
The permission `resourcemanager.projects.create` is contained in the Project Creator role (`roles/resourcemanager.projectCreator`).
Assigning this role at the `Digital-Storefronts` folder level scopes project creation rights exclusively to that folder under least privilege.
2
Identify the permission required to link projects to a billing account.
Linking a project to a billing account requires `resourcemanager.projects.createBillingAssignment` on the project (inherent during project creation) and `billing.resourceAssociations.create` on the billing account.
The Billing Account User role (`roles/billing.user`) granted directly on the Cloud Billing Account resource provides the necessary billing association permission.

Anahtar Kavram

Assigning scoped predefined IAM roles for project creation within resource hierarchy folders and billing account association.
Bu soruyu puanla

Konular

Managing Cloud Projects and Resource Hierarchy

Bu konudan daha fazla soru