Billing access in Google Cloud is managed independently from access to the resources running inside your projects. That separation matters more than it sounds, and the Professional Cloud Architect exam tests whether you understand which role grants which billing capability.
I want to walk through the specific roles you need to know, what each one lets a person do, and the scope where each role gets granted. The list is short, but the exam questions tend to be precise about which role is the minimum required for a given action.
The first concept to internalize is that billing accounts and projects have separate IAM policies. A user can have full control over a billing account without having any access to the projects attached to that billing account. The reverse is also true. You can be an Owner of a project and still have no permission to view, modify, or attach a billing account to it.
This separation is intentional. Finance teams often need to manage budgets, view invoices, and set alerts without seeing the contents of Cloud Storage buckets or BigQuery datasets. Engineering teams often need to build and deploy resources without authority to change which billing account funds the work. Decoupling the two policies lets each group operate with the access they actually need.
The role you reach for most often is Project Billing Manager. This role lets a user associate a project with a billing account, or detach a project from one. It does not grant any access to the resources inside the project, and it does not grant the ability to manage the billing account itself.
Project Billing Manager can be granted at the project level or the organization level. Granting it at the organization level lets a user attach or detach billing accounts across every project in the org. Granting it at the project level limits that authority to a specific project.
If an exam question asks for the minimum role required to link a new project to an existing billing account, Project Billing Manager is the answer.
Billing Administrator is the broader role. At the organization level, it includes the ability to associate projects with billing accounts, so it covers what Project Billing Manager does and more. Billing Administrator can also manage billing accounts directly, view costs, and configure billing exports.
If a question asks which role at the organization level can both manage billing accounts and link projects to them, Billing Administrator is correct. If the question asks for the minimum role to do only the linking, Project Billing Manager is the better answer because it follows least privilege.
Setting a budget alert on a billing account requires the Billing Account Administrator role. This is granted at the billing account itself, not at the project or organization level. Budget alerts are a property of the billing account, so the role that controls them lives there.
Billing Account Administrator can create budgets, configure thresholds, set up notification channels, and modify the billing account's settings. If a finance lead needs to be alerted when monthly spend crosses a number, this is the role they need.
Here is the practical mapping I keep in my head when I see a Professional Cloud Architect question about billing roles.
To attach a project to a billing account, grant Project Billing Manager on the project or organization, or Billing Administrator on the organization.
To create or modify a budget alert, grant Billing Account Administrator on the billing account.
To view billing reports without changing anything, grant Billing Account Viewer on the billing account.
To manage the billing account itself, including who has access to it, grant Billing Account Administrator.
The Professional Cloud Architect exam puts a lot of weight on least-privilege role assignments. Billing roles are a clean test of that principle because the differences are narrow. Project Billing Manager and Billing Administrator both let a user attach a project to a billing account, but only one of them is the minimum role for that single task. Billing Account Administrator and Billing Administrator sound similar but live at different scopes and grant different powers.
When you see a billing question, slow down and check three things. What action is the user being asked to perform. At what scope are you granting the role. Which role is the minimum that covers exactly that action without overreaching.
My Professional Cloud Architect course covers billing account roles alongside the rest of the IAM and governance material.
