Examkin

Soru

Zorluk: ZorConfiguring Billing Accounts and Linking Projects

A CI/CD automated deployment pipeline uses a dedicated service account to link newly provisioned workload projects to an enterprise Cloud Billing Account. To comply with corporate compliance policies following the principle of least privilege, which pair of predefined IAM roles must be granted to this service account?

  1. roles/billing.user on the Cloud Billing Account and roles/resourcemanager.projectBillingManager on the target projectCevap
  2. B
    roles/billing.user on the Cloud Billing Account and roles/browser on the target project
  3. C
    roles/billing.admin on the Cloud Billing Account and roles/owner on the target project
  4. D
    roles/billing.viewer at the Organization level and roles/editor on the target project

Cevap

Granting roles/billing.user on the Cloud Billing Account and roles/resourcemanager.projectBillingManager on the target project.
To link a project to a Cloud Billing Account, an identity requires permissions on both resources: roles/billing.user (or Billing Account Administrator) on the billing account itself, and roles/resourcemanager.projectBillingManager (or Project Owner/Editor) on the project. Under the principle of least privilege, using roles/billing.user alongside roles/resourcemanager.projectBillingManager is the exact predefined combination recommended by Google Cloud.

Adım Adım Çözüm

1
Identify the required billing account permission
Determined that billing.resourceCosts.use (included in roles/billing.user) is required on the billing account.
Linking a project to a billing account consumes the billing account's funds, which requires user-level billing account permissions.
2
Identify the required project permission
Determined that resourcemanager.projects.createBillingAssignment (included in roles/resourcemanager.projectBillingManager) is required on the project.
Modifying a project's billing association requires specific project-level administrative permissions for billing management.
3
Evaluate least privilege compliance
Selected the combination of roles/billing.user and roles/resourcemanager.projectBillingManager.
Predefined narrow roles must be favored over broad primitive roles (like Owner/Editor) or overly broad administrative roles (like Billing Admin).

Anahtar Kavram

Dual-resource IAM permission requirements for project billing association under least privilege
Bu soruyu puanla

Konular

Configuring Billing Accounts and Linking Projects