Google Associate Cloud EngineerSetting up a cloud solution environmentMedium
A financial services company needs to ensure that all Google Cloud projects created within their organization are automatically linked to a specific billing account for cost tracking and compliance. Which Identity and Access Management (IAM) role should be granted at the organization level to a designated service account to enable this automation?
- AProject Creator
- BBilling Account Administrator
- CBilling Account User
- DBilling Account Linker
Show answer & explanationAnswer & explanation
Correct answer: D. Billing Account Linker
The 'Billing Account Linker' role (roles/billing.projectManager) is specifically designed to allow an identity to link projects to billing accounts. Granting this role at the organization level to a service account enables automated project creation and billing linkage.
Why the other options are wrong
- A. The 'Project Creator' role allows creating new projects but does not grant permissions to link them to a billing account.
- B. The 'Billing Account Administrator' role manages the billing account itself, including users and budgets, but is not the specific role for linking projects.
- C. The 'Billing Account User' role allows viewing billing information and using a billing account, but not linking projects to it.
Billing Account Linker Role
The 'Billing Account Linker' role (roles/billing.projectManager) allows an identity to link projects to a billing account. This is crucial for automated project provisioning.
- Required to link projects to billing accounts.
- Often assigned to service accounts for automation.
- Can be granted at project, folder, or organization level.
Memory trick: To link a project to a bill, use the Linker role, it's the thrill!