Examkin

Soru

Zorluk: OrtaConfiguring Billing Accounts and Linking Projects

A lead software engineer at a telehealth organization needs to migrate the billing for an existing project, `care-telehealth-prod`, by linking it to a newly established central corporate Cloud Billing Account. The engineer has already been granted the Billing Account User role (`roles/billing.user`) on the target corporate Cloud Billing Account. However, when trying to change the project's billing account in the Google Cloud Console, the action is denied. Following Google Cloud's principle of least privilege, which IAM role should be assigned to the engineer on the `care-telehealth-prod` project resource to allow this linking?

  1. Project Billing Manager (`roles/billing.projectManager`)Cevap
  2. B
    Billing Account Administrator (`roles/billing.admin`)
  3. C
    Project Owner (`roles/owner`)
  4. D
    Organization Administrator (`roles/resourcemanager.organizationAdmin`)

Cevap

Project Billing Manager (`roles/billing.projectManager`) on the project
Linking an existing Google Cloud project to a Cloud Billing Account requires two distinct permissions: `roles/billing.user` on the billing account (which allows using the account) and `resourcemanager.projects.createBillingAssignment` on the project (which allows attaching billing to the project). The Project Billing Manager predefined role (`roles/billing.projectManager`) grants this exact project permission without conveying full project administration capabilities, adhering strictly to the principle of least privilege.

Adım Adım Çözüm

1
Identify dual-permission requirements for billing account linking
Linking a project requires permissions on both the target Cloud Billing Account and the specific Google Cloud Project.
Security controls require authorization to spend money from the billing account AND authorization to attach cost responsibilities to the project.
2
Evaluate existing permissions against requirements
The engineer already possesses the Billing Account User role (`roles/billing.user`) on the Cloud Billing Account, satisfying the billing side requirement.
The missing permission is on the project side (`resourcemanager.projects.createBillingAssignment`).
3
Select the appropriate predefined role enforcing least privilege
The Project Billing Manager role (`roles/billing.projectManager`) provides the exact project-level billing linkage permission without over-granting resource access.
Predefined roles should always be preferred over primitive roles like Owner.

Anahtar Kavram

Two-sided permission model for linking Google Cloud Projects to Cloud Billing Accounts
Bu soruyu puanla

Konular

Configuring Billing Accounts and Linking Projects