Examkin

Soru

Zorluk: ZorConfiguring Billing Accounts and Linking Projects

An organization recently completed the acquisition of a startup and is integrating its standalone Google Cloud project (`analytics-pipeline-prod`) into the corporate environment. An SRE engineer has been tasked with unlinking this project from the startup's legacy credit card billing account and linking it to the parent company's primary corporate Cloud Billing account (`01A2B3-4C5D6E-7F8901`). Following Google Cloud least-privilege best practices, which minimal pair of predefined IAM roles must be granted to the SRE engineer to complete this billing link operation?

  1. Billing Account User (`roles/billing.user`) on the target Cloud Billing account and Project Billing Manager (`roles/resourcemanager.projectBillingManager`) on the projectCevap
  2. B
    Billing Account Administrator (`roles/billing.admin`) on the target Cloud Billing account and Project Billing Manager (`roles/resourcemanager.projectBillingManager`) on the project
  3. C
    Billing Account User (`roles/billing.user`) on the target Cloud Billing account and Project Owner (`roles/owner`) on the project
  4. D
    Billing Account Viewer (`roles/billing.viewer`) on the target Cloud Billing account and Project Billing Manager (`roles/resourcemanager.projectBillingManager`) on the project

Cevap

Granting Billing Account User (`roles/billing.user`) on the target Cloud Billing account and Project Billing Manager (`roles/resourcemanager.projectBillingManager`) on the target project.
Linking a Google Cloud project to a Cloud Billing account requires permissions on both resources simultaneously. The Billing Account User (`roles/billing.user`) role grants permission to link projects to the billing account (`billing.resourceAssociations.create`). The Project Billing Manager (`roles/resourcemanager.projectBillingManager`) role grants permission to attach or detach billing accounts on the specified project (`resourcemanager.projects.createBillingAssignment`). This combination satisfies least privilege.

Adım Adım Çözüm

1
Identify the required billing account permission.
The engineer requires `billing.resourceAssociations.create` on the target Cloud Billing account to attach projects to it.
Without permissions on the billing account itself, a user cannot authorize spending against that account.
2
Identify the required project permission.
The engineer requires `resourcemanager.projects.createBillingAssignment` on the target Google Cloud project to change its linked billing account.
Without permissions on the project, a user cannot modify the project's administrative configurations.
3
Map required permissions to minimal predefined roles adhering to least privilege.
Assign `roles/billing.user` on the billing account and `roles/resourcemanager.projectBillingManager` on the project.
These predefined roles contain the necessary API actions without granting excessive admin privileges like `roles/billing.admin` or `roles/owner`.

Anahtar Kavram

Dual-sided IAM requirements for linking GCP Billing Accounts to Projects under Least Privilege
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Configuring Billing Accounts and Linking Projects