Examkin

Soru

Zorluk: OrtaManaging Cloud Projects and Resource Hierarchy

A lead developer needs permission to create new Google Cloud projects inside a dedicated folder named `Engineering-Dev`. Additionally, the developer must be able to associate these newly created projects with the organization's central billing account.

Which combination of IAM roles assigned with least privilege allows the developer to fulfill both requirements?

  1. A
    roles/resourcemanager.projectCreator at the Organization level and roles/billing.admin on the central billing account.
  2. B
    roles/resourcemanager.folderAdmin on the Engineering-Dev folder and roles/billing.viewer on the central billing account.
  3. roles/resourcemanager.projectCreator on the Engineering-Dev folder and roles/billing.user on the central billing account.Cevap
  4. D
    roles/resourcemanager.projectCreator on the Engineering-Dev folder and roles/resourcemanager.projectBillingManager on the Engineering-Dev folder only.

Cevap

Grant roles/resourcemanager.projectCreator on the Engineering-Dev folder and roles/billing.user on the central billing account.
To create projects inside a specific folder, `roles/resourcemanager.projectCreator` must be bound to that folder. To link newly created projects to an existing billing account, the user must also hold `roles/billing.user` on the Billing Account resource. This combination minimizes access while fulfilling both administrative tasks.

Adım Adım Çözüm

1
Determine the required permission for creating projects within a specific scope.
The role roles/resourcemanager.projectCreator granted on the Engineering-Dev folder allows creation of projects within that folder only.
IAM permissions inherit down the resource hierarchy. Applying the role at the folder level limits project creation scope according to least privilege.
2
Determine the required permission for linking projects to a central billing account.
The role roles/billing.user granted directly on the Billing Account resource provides permission to link projects to that billing account.
Linking a project to a billing account requires permissions on both the project (or project creation rights) and the target billing account.

Anahtar Kavram

Resource Hierarchy IAM Scoping and Billing Account Linking Permissions
Bu soruyu puanla

Konular

Managing Cloud Projects and Resource Hierarchy

Bu konudan daha fazla soru