An enterprise automotive company is provisioning a dedicated Google Cloud project for an IoT telemetry processing pipeline. The cloud governance team must authorize a DevOps engineer to link this newly created project to the corporate Cloud Billing Account. The organization strictly enforces the principle of least privilege, ensuring the engineer cannot modify billing account payment settings or manage unrelated resources across the organization. Which of the following IAM roles must be assigned to the DevOps engineer to enable project linking? (Select TWO.)
- Billing Account User (roles/billing.user) on the target Cloud Billing AccountCevap
- Project Billing Manager (roles/billing.projectManager) on the target Google Cloud projectCevap
- CBilling Account Administrator (roles/billing.admin) on the target Cloud Billing Account
- DProject Owner (roles/owner) on the target Google Cloud project
- EBilling Account Viewer (roles/billing.viewer) on the target Cloud Billing Account
Cevap
Linking a Google Cloud project to a billing account requires permissions on both the billing account and the project. Following least privilege, the engineer must be assigned the Billing Account User role on the billing account and the Project Billing Manager role on the project.
Linking a project to a billing account is a dual-authorization action. The user must hold the Billing Account User role on the billing account to consume its funds, and the Project Billing Manager role on the project to manage its billing attachment. Both roles adhere strictly to the principle of least privilege.
Adım Adım Çözüm
Anahtar Kavram
Two-ended IAM permission requirement for linking projects to Cloud Billing Accounts using least-privilege predefined roles.