Exam Associate Cloud Engineer topic 1 question 59 discussion

Option A is correct, as we don't want the engineering team to link projects to billing account and want only the Finance team. Billing Account User role will help to link projects to the billing account...

for me is C: https://cloud.google.com/billing/docs/how-to/modify-project#permissions_required_for_this_task_2 "Roles with adequate permissions to perform this task: * Project Owner or Project Billing Manager on the project, AND Billing Account Administrator or Billing Account User for the target Cloud Billing account."

The Project Billing Manager role on the organization is unnecessary. The Billing Account User role alone is sufficient to allow the finance team to link projects to the billing account.

From the documentation: "Project Billing Manager (on Organization, folder, or project) when granted in combination with the Billing Account User role (on Organization or billing account) ... lets users attach the project to the billing account, but doesn't grant any rights over resources."

ChatGPT and my opinion also, A

A is a well suited answer and it's in accord with the least privilege principle

A is enough for the given task.

You do not want the engineering team to be able to link projects to the billing account. Think about this, the answer is clearly A

El rol de Usuario de cuenta de facturación permite al equipo de finanzas vincular proyectos a la cuenta de facturación, sin otorgarles otros permisos sobre la administración de proyectos. El rol de Gerente de facturación del proyecto otorga al equipo de finanzas la capacidad de gestionar la facturación de proyectos individuales, pero no permite otros cambios a nivel de proyecto o de organización. Esta combinación permite que solo el equipo de finanzas pueda vincular proyectos a la cuenta de facturación, cumpliendo con la política que el equipo de ingeniería no debe poder hacerlo.

The Billing Account User role in GCP allows a user to view and manage billing accounts, but does not grant permissions to associate projects with billing accounts. The Project Billing Manager role is more focused on associating GCP projects with billing accounts.

C is not good because in this link https://cloud.google.com/billing/docs/how-to/billing-access, the role Project Billing Manager allows "Link/unlink the project to/from a billing account". Unlink is not good in this situation.

When granted in combination with the Billing Account User role, the Project Billing Manager role allows a user to attach the project to the billing account, but does not grant any rights over resources.

To achieve the desired level of access control, where only the finance team can link projects to the billing account while preventing them from making other changes to projects, you should follow these steps: C Explanation: Assigning the finance team the Billing Account User role on the billing account allows them to link projects to the billing account, which is necessary for managing billing. Assigning the Project Billing Manager role on the organization to the finance team allows them to manage billing for projects within the organization without granting them additional permissions to modify projects themselves. This approach ensures that the finance team has the necessary permissions to manage billing-related tasks while restricting their access to project management functionalities, such as creating or deleting projects, which are typically associated with the Project Creator role.

Answer is A. 100%. They are asking for Finance to ONLY be able to link projects to billing (not unlink, etc.). This role has the billing.resourceAssociations.create permission Per documentation for Billing Account User: "When granted in conjunction with the Project Owner role or Project Billing Manager role, provides access to associate projects with billing accounts." https://cloud.google.com/billing/docs/access-control#billing.user

Option C As stated in docs - >§https://cloud.google.com/billing/docs/access-control#tbl_perm projects.updateBillingInfo - > Billing Account Administrator or Billing Account User, AND Project Billing Manager

Option C is not correct because the Project Billing Manager role would give the finance team permissions to manage billing on projects, which is more access than you want to provide. The Billing Account User role is sufficient for the finance team to link projects to the billing account

C is definitely the right answer here. "Cloud Billing Account User when granted in combination with the Project Billing Manager role, the two roles allow a user to link and unlink projects on the billing account on which the Billing Account User role is granted." Source: https://cloud.google.com/billing/docs/how-to/billing-access