A finance analyst holds the Billing Account User role on the company billing account but no roles on a newly created project. They try to link that project to the billing account and are denied. Which single grant lets them complete the link with least privilege?
- AGrant the analyst the Project Owner role on the target project so they hold full control over its resources.
- BGrant the analyst the Billing Account Administrator role so they can manage payment settings on the account.
- CGrant the analyst the Project Viewer role on the target project so they can see its configuration and billing state.
- DGrant the analyst the Project Billing Manager role on the target project to pair with their existing billing account access. Correct
Why A is wrong: Owner is broad and does include the ability to change a project's billing, which makes it tempting, but it grants far more than needed and violates least privilege for a task that only requires the billing-manager permission.
Why B is wrong: Billing Account Administrator manages the account itself and can assign it, but the analyst already has account-side access; the missing piece is a project-side role, so this adds account power without fixing the denial.
Why C is wrong: Viewer confers read-only access, which feels adequate for a settings change, but it carries no permission to modify the project's billing link, so the association still fails.
Why D is correct: Linking a project needs the permission to associate it, held by Project Billing Manager on the project, combined with Billing Account User on the account, which the analyst already has; together these are the least-privilege pairing.