A DevOps automation engineer at a satellite imaging startup is configuring a custom CI/CD service account. The service account needs to automatically link newly provisioned isolated Google Cloud projects to the company's central Cloud Billing account. Following Google Cloud least-privilege security best practices, which TWO predefined IAM roles must be granted to the service account?
- Billing Account User (roles/billing.user) on the Cloud Billing accountCevap
- BBilling Account Viewer (roles/billing.viewer) on the Cloud Billing account
- Project Billing Manager (roles/billing.projectManager) on the target projectCevap
- DProject Owner (roles/owner) on the target project
- EBilling Account Administrator (roles/billing.admin) on the Cloud Billing account
Cevap
To link a Google Cloud project to a Cloud Billing account following least privilege, the identity requires Billing Account User (roles/billing.user) on the billing account and Project Billing Manager (roles/billing.projectManager) on the target project.
Linking a project to a Cloud Billing account requires permissions on both sides of the relationship. On the billing account side, Billing Account User (roles/billing.user) grants permission to bind projects to the account. On the project side, Project Billing Manager (roles/billing.projectManager) grants permission to attach or detach billing accounts for that specific project. Together, these two predefined roles enforce least privilege.
Adım Adım Çözüm
Anahtar Kavram
Dual-permission requirement for project billing account linking under least privilege