Question

Your platform team runs an automated project factory using Terraform. A new business unit requests projects, and finance requires that every newly provisioned project is automatically linked to a specific billing account and cannot be moved to a different billing account by project-level users. Which approach best enforces this requirement while keeping the factory fully automated?

Accepted Answer

Have the factory's service account hold roles/billing.user on the billing account, set the billing_account in the google_project resource, and grant project users only roles/viewer so they cannot change billing linkage.

Answer

Grant each project owner the roles/billing.admin role so they can attach the correct billing account during onboarding.

Answer

Manually link billing in the Cloud Console after each Terraform apply and rely on documentation to prevent changes.

Answer

Assign the factory service account roles/billing.creator and let project teams self-manage billing linkage through org policies.