A lead cloud engineer at a renewable energy analytics firm needs to authorize a junior site reliability engineer (SRE) to link a newly created project, grid-telemetry-prod, to the company's central Cloud Billing account. Following the Google Cloud principle of least privilege, which combination of IAM roles must be granted to the SRE?
- Billing Account User (roles/billing.user) on the Cloud Billing account and Project Billing Manager (roles/resourcemanager.projectBillingManager) on the grid-telemetry-prod projectCevap
- BBilling Account User (roles/billing.user) on the Cloud Billing account and Viewer (roles/viewer) on the grid-telemetry-prod project
- CBilling Account Administrator (roles/billing.admin) on the Cloud Billing account with no explicit roles granted on the grid-telemetry-prod project
- DProject Owner (roles/owner) on the grid-telemetry-prod project and Billing Account Creator (roles/billing.creator) at the organization level
Cevap
The correct answer specifies granting Billing Account User (roles/billing.user) on the Cloud Billing account and Project Billing Manager (roles/resourcemanager.projectBillingManager) on the target project.
Linking a Google Cloud project to a Cloud Billing account requires permissions on both resource levels: billing.resourceAssociations.create on the billing account (granted by roles/billing.user) and resourcemanager.projects.createBillingAssignment on the target project (granted by roles/resourcemanager.projectBillingManager). Using these two specific predefined roles strictly satisfies least privilege.
Adım Adım Çözüm
Anahtar Kavram
Two-sided IAM permission requirement for linking GCP projects to Cloud Billing accounts under least privilege