Access control for Cloud Billing APIs

Stay organized with collections Save and categorize content based on your preferences.

Google Cloud offers Identity and Access Management (IAM), which lets you give access to specific Google Cloud resources but not others. IAM lets you adopt the security principle of least privilege, so you grant only the necessary access to your resources.

IAM lets you control who (users) has what access (roles) to which resources by setting IAM allow policies. Allow policies grant specific roles to a user, which gives the user the permissions in those roles.

This page explains the IAM roles that are available for the Cloud Billing APIs. For example, you can use IAM to grant roles such as Billing Account Costs Manager or Billing Account Viewer on a Cloud Billing account. For a detailed description of IAM and its features, see the IAM documentation. In particular, see Manage access to projects, folders, and organizations and Manage access to other resources.

Permissions and roles

For a user to view Cloud Billing account details in the Google Cloud console, or for a Cloud Billing API method to return Cloud Billing account information, the user or caller must have the necessary permissions.

Required permissions for the Cloud Billing Catalog API

No permissions are required to use the Cloud Billing Catalog API (Services list and SKUs list). All of the data that this API returns is public.

Required permissions for the Cloud Billing Budget API

The following table lists the required permissions to call each Cloud Billing Budget API method, as well as the IAM roles for Cloud Billing that include those permissions.

API method Required permission IAM roles that include permission
GetBudget To get the details of a budget, the caller must have the billing.budgets.get permission on the budget's Cloud Billing account. Billing Account Administrator, Billing Account Costs Manager, or Billing Account Viewer
ListBudgets To return a list of budgets applied to a Cloud Billing account, the caller must have the billing.budgets.list permission on the Cloud Billing account. Billing Account Administrator, Billing Account Costs Manager, or Billing Account Viewer
CreateBudget To create a new budget, the caller must have the billing.budgets.create permission on the budget's Cloud Billing account. Billing Account Administrator or Billing Account Costs Manager
UpdateBudget To update an existing budget, the caller must have the billing.budgets.update permission on the budget's Cloud Billing account. Billing Account Administrator or Billing Account Costs Manager
DeleteBudget To delete an existing budget, the caller must have the billing.budgets.delete permission on the budget's Cloud Billing account. Billing Account Administrator or Billing Account Costs Manager

Required permissions for the Cloud Billing Account API

The following table lists the required permissions to call each Cloud Billing Account API method, as well as the IAM roles for Cloud Billing that include those permissions.

API method Required permissions IAM roles that include permission
billingAccounts.create Method is used to create new Cloud Billing subaccounts. The caller must have billing.accounts.update on the subaccount's parent Cloud Billing account. Billing Account Administrator
billingAccounts.get billing.accounts.get on a Cloud Billing account. Billing Account Administrator, Billing Account Costs Manager, Billing Account Viewer, or Billing Account User
billingAccounts.list None. This method returns all accounts that the caller has permission to access. Billing Account Administrator, Billing Account Costs Manager, Billing Account Viewer, or Billing Account User on the Cloud Billing accounts, or Project Billing Manager on the projects.
billingAccounts.getIamPolicy billing.accounts.getIamPolicy on a Cloud Billing account. Billing Account Administrator, Billing Account Costs Manager, Billing Account Viewer, or Billing Account User
billingAccounts.setIamPolicy billing.accounts.setIamPolicy on a Cloud Billing account. Billing Account Administrator
billingAccounts.testIamPermissions None. This method is used to determine the permissions that a caller has on a Cloud Billing account. n/a
billingAccounts.patch billing.accounts.update on a Cloud Billing account. Billing Account Administrator
billingAccounts.projects.list billing.resourceAssociations.list on a Cloud Billing account. Billing Account Administrator, Billing Account Costs Manager, or Billing Account Viewer
projects.getBillingInfo resourcemanager.projects.get on the project.
For more information, see Access Control for Projects.		 Project Owner, Project Editor, or Project Viewer
projects.updateBillingInfo billing.resourceAssociations.create on the Cloud Billing account AND resourcemanager.projects.createBillingAssignment on the project. Billing Account Administrator or Billing Account User, AND Project Billing Manager

Roles

You don't directly give users permissions; instead, you grant them roles, which have one or more permissions bundled within them.

You can grant one or more roles on the same resource.

The following table lists the IAM roles that you can grant to access the Cloud Billing APIs, the description of what the role does, and the permissions bundled within that role. Some of these roles also include permissions for other Google Cloud services.

Role Permissions

(roles/billing.admin)

Provides access to see and manage all aspects of billing accounts.

Lowest-level resources where you can grant this role:

  • Billing Account

Contains 33 owner permissions

billing.accounts.close

billing.accounts.get

billing.accounts.getCarbonInformation

billing.accounts.getIamPolicy

billing.accounts.getPaymentInfo

billing.accounts.getPricing

billing.accounts.getSpendingInformation

billing.accounts.getUsageExportSpec

billing.accounts.list

billing.accounts.move

billing.accounts.redeemPromotion

billing.accounts.removeFromOrganization

billing.accounts.reopen

billing.accounts.setIamPolicy

billing.accounts.update

billing.accounts.updatePaymentInfo

billing.accounts.updateUsageExportSpec

billing.budgets.*

  • billing.budgets.create
  • billing.budgets.delete
  • billing.budgets.get
  • billing.budgets.list
  • billing.budgets.update

billing.credits.list

billing.resourceAssociations.*

  • billing.resourceAssociations.create
  • billing.resourceAssociations.delete
  • billing.resourceAssociations.list

billing.subscriptions.*

  • billing.subscriptions.create
  • billing.subscriptions.get
  • billing.subscriptions.list
  • billing.subscriptions.update

cloudnotifications.activities.list

cloudsupport.properties.get

cloudsupport.techCases.*

  • cloudsupport.techCases.create
  • cloudsupport.techCases.escalate
  • cloudsupport.techCases.get
  • cloudsupport.techCases.list
  • cloudsupport.techCases.update

commerceoffercatalog.*

  • commerceoffercatalog.documents.get
  • commerceoffercatalog.offers.get

compute.commitments.*

  • compute.commitments.create
  • compute.commitments.get
  • compute.commitments.list
  • compute.commitments.update
  • compute.commitments.updateReservations

consumerprocurement.accounts.*

  • consumerprocurement.accounts.create
  • consumerprocurement.accounts.delete
  • consumerprocurement.accounts.get
  • consumerprocurement.accounts.list

consumerprocurement.consents.check

consumerprocurement.consents.grant

consumerprocurement.consents.list

consumerprocurement.consents.revoke

consumerprocurement.orderAttributions.*

  • consumerprocurement.orderAttributions.get
  • consumerprocurement.orderAttributions.list
  • consumerprocurement.orderAttributions.update

consumerprocurement.orders.*

  • consumerprocurement.orders.cancel
  • consumerprocurement.orders.get
  • consumerprocurement.orders.list
  • consumerprocurement.orders.modify
  • consumerprocurement.orders.place

dataprocessing.datasources.get

dataprocessing.datasources.list

dataprocessing.groupcontrols.get

dataprocessing.groupcontrols.list

logging.logEntries.list

logging.logServiceIndexes.list

logging.logServices.list

logging.logs.list

logging.privateLogEntries.list

recommender.commitmentUtilizationInsights.*

  • recommender.commitmentUtilizationInsights.get
  • recommender.commitmentUtilizationInsights.list
  • recommender.commitmentUtilizationInsights.update

recommender.costInsights.*

  • recommender.costInsights.get
  • recommender.costInsights.list
  • recommender.costInsights.update

recommender.spendBasedCommitmentInsights.*

  • recommender.spendBasedCommitmentInsights.get
  • recommender.spendBasedCommitmentInsights.list
  • recommender.spendBasedCommitmentInsights.update

recommender.spendBasedCommitmentRecommendations.*

  • recommender.spendBasedCommitmentRecommendations.get
  • recommender.spendBasedCommitmentRecommendations.list
  • recommender.spendBasedCommitmentRecommendations.update

recommender.spendBasedCommitmentRecommenderConfig.*

  • recommender.spendBasedCommitmentRecommenderConfig.get
  • recommender.spendBasedCommitmentRecommenderConfig.update

recommender.usageCommitmentRecommendations.*

  • recommender.usageCommitmentRecommendations.get
  • recommender.usageCommitmentRecommendations.list
  • recommender.usageCommitmentRecommendations.update

resourcemanager.projects.createBillingAssignment

resourcemanager.projects.deleteBillingAssignment

resourcemanager.projects.get

resourcemanager.projects.list

(roles/billing.costsManager)

Manage budgets for a billing account, and view, analyze, and export cost information of a billing account.

Lowest-level resources where you can grant this role:

  • Billing Account

Contains 12 owner permissions

billing.accounts.get

billing.accounts.getIamPolicy

billing.accounts.getSpendingInformation

billing.accounts.getUsageExportSpec

billing.accounts.list

billing.accounts.updateUsageExportSpec

billing.budgets.*

  • billing.budgets.create
  • billing.budgets.delete
  • billing.budgets.get
  • billing.budgets.list
  • billing.budgets.update

billing.resourceAssociations.list

recommender.costInsights.*

  • recommender.costInsights.get
  • recommender.costInsights.list
  • recommender.costInsights.update

(roles/billing.creator)

Provides access to create billing accounts.

Lowest-level resources where you can grant this role:

  • Organization

Contains 1 owner permission

billing.accounts.create

resourcemanager.organizations.get

(roles/billing.projectManager)

When granted in conjunction with the Billing Account User role, provides access to assign a project's billing account or disable its billing.

Lowest-level resources where you can grant this role:

  • Project

Contains 2 owner permissions

resourcemanager.projects.createBillingAssignment

resourcemanager.projects.deleteBillingAssignment

(roles/billing.user)

When granted in conjunction with the Project Owner role or Project Billing Manager role, provides access to associate projects with billing accounts.

Lowest-level resources where you can grant this role:

  • Billing Account

Contains 6 owner permissions

billing.accounts.get

billing.accounts.getIamPolicy

billing.accounts.list

billing.accounts.redeemPromotion

billing.credits.list

billing.resourceAssociations.create

(roles/billing.viewer)

View billing account cost and pricing information, transactions, and billing and commitment recommendations.

Lowest-level resources where you can grant this role:

  • Billing Account

Contains 14 owner permissions

billing.accounts.get

billing.accounts.getCarbonInformation

billing.accounts.getIamPolicy

billing.accounts.getPaymentInfo

billing.accounts.getPricing

billing.accounts.getSpendingInformation

billing.accounts.getUsageExportSpec

billing.accounts.list

billing.budgets.get

billing.budgets.list

billing.credits.list

billing.resourceAssociations.list

billing.subscriptions.get

billing.subscriptions.list

commerceoffercatalog.*

  • commerceoffercatalog.documents.get
  • commerceoffercatalog.offers.get

consumerprocurement.accounts.get

consumerprocurement.accounts.list

consumerprocurement.consents.check

consumerprocurement.consents.list

consumerprocurement.orderAttributions.get

consumerprocurement.orderAttributions.list

consumerprocurement.orders.get

consumerprocurement.orders.list

dataprocessing.datasources.get

dataprocessing.datasources.list

dataprocessing.groupcontrols.get

dataprocessing.groupcontrols.list

recommender.commitmentUtilizationInsights.get

recommender.commitmentUtilizationInsights.list

recommender.costInsights.get

recommender.costInsights.list

recommender.spendBasedCommitmentInsights.get

recommender.spendBasedCommitmentInsights.list

recommender.spendBasedCommitmentRecommendations.get

recommender.spendBasedCommitmentRecommendations.list

recommender.spendBasedCommitmentRecommenderConfig.get

recommender.usageCommitmentRecommendations.get

recommender.usageCommitmentRecommendations.list