Explanation:
The principle of least privilege requires granting only the permissions necessary. Granting roles/resourcemanager.projectCreator at the folder level allows project creation under the Development folder without org-wide impact. roles/billing.user on the specific billing account allows linking to that billing account. Broader roles like Org Admin or Owner violate least privilege.
Ultimate access to all questions.
Your organization requires that all new projects be created under a "Development" folder with a specific billing account. You want teams to self-serve. Which pair of roles do you grant a team lead, scoped as narrowly as possible?
A
Org Admin at the org
B
resourcemanager.projectCreator on the Development folder + billing.user on the billing account
C
resourcemanager.projectCreator at the org + billing.admin
D
Owner on the folder
No comments yet.