Examkin

Soru

Zorluk: ZorManaging IAM Roles and Resource Access Permissions

A centralized accounting department manages a primary Google Cloud Billing Account for your company. To support decentralized resource deployment, project managers require the ability to associate their newly created Google Cloud projects with this central billing account. However, organizational security policies mandate that project managers must not be allowed to view invoice payment histories, change billing account settings, or manage billing permissions. Which IAM role should be assigned to the project managers on the billing account to satisfy these requirements while adhering to the principle of least privilege?

  1. Billing Account User (roles/billing.user)Cevap
  2. B
    Billing Account Viewer (roles/billing.viewer)
  3. C
    Billing Account Administrator (roles/billing.admin)
  4. D
    Editor (roles/editor)

Cevap

Billing Account User (roles/billing.user)
The Billing Account User (roles/billing.user) role provides users with the precise permission needed to link projects to a billing account (resourcemanager.projects.createBillingAssignment) without exposing billing transaction history, credit card details, or administrative settings.

Adım Adım Çözüm

1
Identify the operation being performed
The operation is associating (linking) a newly created Google Cloud project to an existing Billing Account.
Linking a project requires permission on both the project (Project Creator/Owner) and the target Billing Account.
2
Analyze permission boundaries on the Billing Account
The requirement mandates granting only the ability to link projects without allowing access to view financial invoices or modify billing management settings.
Least privilege dictates selecting a predefined role tailored specifically to project-to-billing association.
3
Select the appropriate IAM role on the Billing Account resource
Billing Account User (roles/billing.user) provides the exact permission (resourcemanager.projects.createBillingAssignment) needed to link projects without extra privileges.
Billing Account Viewer lacks assignment rights, Billing Account Administrator is overly permissive, and project-level roles do not grant permissions on the Billing Account resource.

Anahtar Kavram

Least Privilege Billing Account IAM Role Assignment
Bu soruyu puanla

Konular

Managing IAM Roles and Resource Access Permissions

Bu konudan daha fazla soru