Examkin

Soru

Zorluk: ZorManaging Cloud Projects and Resource Hierarchy

A company is configuring a multi-tier Google Cloud resource hierarchy. A centralized platform infrastructure team requires authorization to provision new cloud projects exclusively within a dedicated folder named `Production-Apps` and to associate these newly created projects with the corporate Billing Account `019283-475610-892014`. The security manager mandates adhering strictly to the principle of least privilege without granting permissions over unrelated folders or full billing administration privileges. Which set of IAM role assignments must be configured for the platform infrastructure team?

  1. Grant Project Creator (`roles/resourcemanager.projectCreator`) on the `Production-Apps` folder and Billing Account User (`roles/billing.user`) on the Billing Account `019283-475610-892014`.Cevap
  2. B
    Grant Project Creator (`roles/resourcemanager.projectCreator`) and Billing Account User (`roles/billing.user`) both directly on the `Production-Apps` folder.
  3. C
    Grant Folder Admin (`roles/resourcemanager.folderAdmin`) at the Organization node level and Billing Account Administrator (`roles/billing.admin`) on the Billing Account `019283-475610-892014`.
  4. D
    Grant Owner (`roles/owner`) on the `Production-Apps` folder and rely on resource hierarchy policy inheritance to automatically grant billing link rights.

Cevap

Grant Project Creator (`roles/resourcemanager.projectCreator`) on the `Production-Apps` folder and Billing Account User (`roles/billing.user`) on the Billing Account `019283-475610-892014`.
To create projects inside a specific folder while associating them with a billing account under least-privilege constraints, two distinct role bindings are required: Project Creator (`roles/resourcemanager.projectCreator`) scoped on the destination Folder, and Billing Account User (`roles/billing.user`) scoped directly on the target Billing Account.

Adım Adım Çözüm

1
Identify the minimum required IAM role for project creation within a specific folder.
Assigning `roles/resourcemanager.projectCreator` scoped directly to the target folder allows project creation within that folder only.
Permissions inherit downward from the folder level, isolating creation capabilities to the intended scope.
2
Identify the minimum required IAM role for linking newly created projects to a billing account.
Assigning `roles/billing.user` directly on the Billing Account resource permits linking projects to that billing account.
Billing Accounts exist outside the resource hierarchy container structure, so billing roles must be assigned directly on the Billing Account object itself.
3
Combine both scoped predefined roles to meet least-privilege requirements.
The platform team receives exact project creation rights in `Production-Apps` and billing linking rights on `019283-475610-892014`.
This avoids granting broad primitive roles or organization-wide administration rights.

Anahtar Kavram

Managing Google Cloud Resource Hierarchy and Billing Account IAM Scoping
Bu soruyu puanla

Konular

Managing Cloud Projects and Resource Hierarchy

Bu konudan daha fazla soru