Kontrol akses untuk Cloud Billing Budget API

Google Cloud menawarkan Identity and Access Management (IAM), yang memungkinkan Anda memberikan akses yang lebih terperinci ke resource Google Cloud dan mencegah akses yang tidak diinginkan ke resource lain. IAM memungkinkan Anda menerapkan prinsip keamanan dengan hak istimewa terendah, sehingga Anda hanya memberikan akses yang diperlukan ke resource Anda.

Dengan IAM, Anda dapat mengontrol siapa (pengguna) yang memiliki akses (peran) ke resource tertentu dengan menetapkan kebijakan IAM. Kebijakan IAM memberikan peran tertentu kepada pengguna yang memberikan izin tertentu kepada pengguna.

Halaman ini menjelaskan peran Identity and Access Management yang tersedia untuk Cloud Billing API. Misalnya, Anda dapat menggunakan IAM untuk memberikan peran, seperti Admin, Pengguna, dan Project Manager, untuk akun Penagihan Cloud. Untuk mengetahui deskripsi mendetail tentang IAM dan fitur-fiturnya, lihat panduan developer Identity and Access Management. Secara khusus, lihat bagian Memberikan, Mengubah, dan Mencabut Akses.

Izin dan Peran

Agar pengguna dapat melihat detail akun Penagihan Cloud di konsol Google Cloud, atau agar metode Cloud Billing API dapat menampilkan informasi akun Penagihan Cloud, pengguna atau pemanggil harus memiliki izin yang diperlukan. Tabel berikut mencantumkan daftar izin dan peran IAM yang diperlukan untuk menggunakan Cloud Billing Budget API.

Izin yang diperlukan untuk Cloud Billing Budget API

Tabel berikut menguraikan izin yang diperlukan untuk memanggil setiap metode Cloud Billing Budget API. Peran Penagihan IAM standar yang secara otomatis memberikan izin tersebut juga disertakan dalam tabel.

Metode API Izin yang diperlukan Peran IAM yang memberikan izin
GetBudget Untuk mendapatkan detail anggaran, pemanggil harus memiliki izin billing.budgets.get di akun Penagihan Cloud anggaran.

Untuk anggaran project tunggal, alih-alih izin akun penagihan, pemanggil dapat memiliki izin berikut pada project: resourcemanager.projects.get dan billing.resourcebudgets.read.

Billing Account Administrator, Billing Account Costs Manager, atau Billing Account Viewer pada akun Penagihan Cloud anggaran.

Untuk anggaran project tunggal, Project Owner, Project Editor, atau Project Viewer pada project.

ListBudgets Untuk menampilkan daftar anggaran yang diterapkan ke akun Penagihan Cloud, pemanggil harus memiliki izin billing.budgets.list di akun Penagihan Cloud.

Untuk anggaran project tunggal, alih-alih izin akun penagihan, pemanggil dapat memiliki izin berikut pada project: resourcemanager.projects.get dan billing.resourcebudgets.read.

Billing Account Administrator, Billing Account Costs Manager, atau Billing Account Viewer pada akun Penagihan Cloud anggaran.

Untuk anggaran project tunggal, Project Owner, Project Editor, atau Project Viewer pada project.

CreateBudget Untuk membuat anggaran baru, pemanggil harus memiliki izin billing.budgets.create di akun Penagihan Cloud anggaran.

Untuk anggaran project tunggal, alih-alih izin akun penagihan, pemanggil dapat memiliki izin berikut pada project: resourcemanager.projects.get, billing.resourcebudgets.read, dan billing.resourcebudgets.write.

Billing Account Administrator atau Billing Account Costs Manager di akun Penagihan Cloud anggaran.

Untuk anggaran project tunggal, Project Owner atau Project Editor pada project.

UpdateBudget Untuk memperbarui anggaran yang ada, pemanggil harus memiliki izin billing.budgets.update di akun Penagihan Cloud anggaran.

Untuk anggaran project tunggal, alih-alih izin akun penagihan, pemanggil dapat memiliki izin berikut pada project: resourcemanager.projects.get, billing.resourcebudgets.read, dan billing.resourcebudgets.write.

Billing Account Administrator atau Billing Account Costs Manager di akun Penagihan Cloud anggaran.

Untuk anggaran project tunggal, Project Owner atau Project Editor pada project.

DeleteBudget Untuk menghapus anggaran yang ada, pemanggil harus memiliki izin billing.budgets.delete di akun Penagihan Cloud anggaran.

Untuk anggaran project tunggal, alih-alih izin akun penagihan, pemanggil dapat memiliki izin berikut pada project: resourcemanager.projects.get, billing.resourcebudgets.read, dan billing.resourcebudgets.write.

Billing Account Administrator atau Billing Account Costs Manager di akun Penagihan Cloud anggaran.

Untuk anggaran project tunggal, Project Owner atau Project Editor pada project.

Peran

Anda tidak secara langsung memberikan izin kepada pengguna; tetapi, Anda memberikan peran kepada pengguna, yang memiliki satu atau beberapa izin yang dipaketkan di dalamnya.

Anda dapat memberikan satu atau beberapa peran pada resource yang sama.

Tabel berikut mencantumkan peran Penagihan IAM standar yang dapat Anda berikan untuk mengakses Cloud Billing API, deskripsi fungsi peran tersebut, dan izin yang dipaketkan dalam peran tersebut.

Role Permissions

(roles/billing.admin)

Provides access to see and manage all aspects of billing accounts.

Lowest-level resources where you can grant this role:

  • Billing Account

billing.accounts.close

billing.accounts.get

billing.accounts.getCarbonInformation

billing.accounts.getIamPolicy

billing.accounts.getPaymentInfo

billing.accounts.getPricing

billing.accounts.getSpendingInformation

billing.accounts.getUsageExportSpec

billing.accounts.list

billing.accounts.move

billing.accounts.redeemPromotion

billing.accounts.removeFromOrganization

billing.accounts.reopen

billing.accounts.setIamPolicy

billing.accounts.update

billing.accounts.updatePaymentInfo

billing.accounts.updateUsageExportSpec

billing.billingAccountPrice.get

billing.billingAccountPrices.list

billing.billingAccountServices.*

  • billing.billingAccountServices.get
  • billing.billingAccountServices.list

billing.billingAccountSkuGroupSkus.*

  • billing.billingAccountSkuGroupSkus.get
  • billing.billingAccountSkuGroupSkus.list

billing.billingAccountSkuGroups.*

  • billing.billingAccountSkuGroups.get
  • billing.billingAccountSkuGroups.list

billing.billingAccountSkus.*

  • billing.billingAccountSkus.get
  • billing.billingAccountSkus.list

billing.budgets.*

  • billing.budgets.create
  • billing.budgets.delete
  • billing.budgets.get
  • billing.budgets.list
  • billing.budgets.update

billing.credits.list

billing.finOpsBenchmarkInformation.get

billing.finOpsHealthInformation.get

billing.resourceAssociations.*

  • billing.resourceAssociations.create
  • billing.resourceAssociations.delete
  • billing.resourceAssociations.list

billing.subscriptions.*

  • billing.subscriptions.create
  • billing.subscriptions.get
  • billing.subscriptions.list
  • billing.subscriptions.update

cloudasset.assets.searchAllResources

cloudnotifications.activities.list

cloudsupport.properties.get

cloudsupport.techCases.*

  • cloudsupport.techCases.create
  • cloudsupport.techCases.escalate
  • cloudsupport.techCases.get
  • cloudsupport.techCases.list
  • cloudsupport.techCases.update

commerceoffercatalog.*

  • commerceoffercatalog.agreements.get
  • commerceoffercatalog.agreements.list
  • commerceoffercatalog.documents.get
  • commerceoffercatalog.documents.list
  • commerceoffercatalog.offers.get

compute.commitments.*

  • compute.commitments.create
  • compute.commitments.get
  • compute.commitments.list
  • compute.commitments.update
  • compute.commitments.updateReservations

consumerprocurement.accounts.*

  • consumerprocurement.accounts.create
  • consumerprocurement.accounts.delete
  • consumerprocurement.accounts.get
  • consumerprocurement.accounts.list

consumerprocurement.consents.check

consumerprocurement.consents.grant

consumerprocurement.consents.list

consumerprocurement.consents.revoke

consumerprocurement.events.*

  • consumerprocurement.events.get
  • consumerprocurement.events.list

consumerprocurement.licensePools.*

  • consumerprocurement.licensePools.assign
  • consumerprocurement.licensePools.enumerateLicensedUsers
  • consumerprocurement.licensePools.get
  • consumerprocurement.licensePools.unassign
  • consumerprocurement.licensePools.update

consumerprocurement.orderAttributions.*

  • consumerprocurement.orderAttributions.get
  • consumerprocurement.orderAttributions.list
  • consumerprocurement.orderAttributions.update

consumerprocurement.orders.*

  • consumerprocurement.orders.cancel
  • consumerprocurement.orders.get
  • consumerprocurement.orders.list
  • consumerprocurement.orders.modify
  • consumerprocurement.orders.place

dataprocessing.datasources.get

dataprocessing.datasources.list

dataprocessing.groupcontrols.get

dataprocessing.groupcontrols.list

logging.logEntries.list

logging.logServiceIndexes.list

logging.logServices.list

logging.logs.list

logging.privateLogEntries.list

recommender.cloudsqlIdleInstanceRecommendations.get

recommender.cloudsqlIdleInstanceRecommendations.list

recommender.cloudsqlOverprovisionedInstanceRecommendations.get

recommender.cloudsqlOverprovisionedInstanceRecommendations.list

recommender.commitmentUtilizationInsights.*

  • recommender.commitmentUtilizationInsights.get
  • recommender.commitmentUtilizationInsights.list
  • recommender.commitmentUtilizationInsights.update

recommender.computeAddressIdleResourceRecommendations.get

recommender.computeAddressIdleResourceRecommendations.list

recommender.computeDiskIdleResourceRecommendations.get

recommender.computeDiskIdleResourceRecommendations.list

recommender.computeImageIdleResourceRecommendations.get

recommender.computeImageIdleResourceRecommendations.list

recommender.computeInstanceGroupManagerMachineTypeRecommendations.get

recommender.computeInstanceGroupManagerMachineTypeRecommendations.list

recommender.computeInstanceIdleResourceRecommendations.get

recommender.computeInstanceIdleResourceRecommendations.list

recommender.computeInstanceMachineTypeRecommendations.get

recommender.computeInstanceMachineTypeRecommendations.list

recommender.costInsights.*

  • recommender.costInsights.get
  • recommender.costInsights.list
  • recommender.costInsights.update

recommender.costRecommendations.*

  • recommender.costRecommendations.listAll
  • recommender.costRecommendations.summarizeAll

recommender.resourcemanagerProjectUtilizationRecommendations.get

recommender.resourcemanagerProjectUtilizationRecommendations.list

recommender.spendBasedCommitmentInsights.*

  • recommender.spendBasedCommitmentInsights.get
  • recommender.spendBasedCommitmentInsights.list
  • recommender.spendBasedCommitmentInsights.update

recommender.spendBasedCommitmentRecommendations.*

  • recommender.spendBasedCommitmentRecommendations.get
  • recommender.spendBasedCommitmentRecommendations.list
  • recommender.spendBasedCommitmentRecommendations.update

recommender.spendBasedCommitmentRecommenderConfig.*

  • recommender.spendBasedCommitmentRecommenderConfig.get
  • recommender.spendBasedCommitmentRecommenderConfig.update

recommender.usageCommitmentRecommendations.*

  • recommender.usageCommitmentRecommendations.get
  • recommender.usageCommitmentRecommendations.list
  • recommender.usageCommitmentRecommendations.update

resourcemanager.projects.createBillingAssignment

resourcemanager.projects.deleteBillingAssignment

resourcemanager.projects.get

resourcemanager.projects.list

(roles/billing.costsManager)

Manage budgets for a billing account, and view, analyze, and export cost information of a billing account.

Lowest-level resources where you can grant this role:

  • Billing Account

billing.accounts.get

billing.accounts.getIamPolicy

billing.accounts.getSpendingInformation

billing.accounts.getUsageExportSpec

billing.accounts.list

billing.accounts.updateUsageExportSpec

billing.budgets.*

  • billing.budgets.create
  • billing.budgets.delete
  • billing.budgets.get
  • billing.budgets.list
  • billing.budgets.update

billing.resourceAssociations.list

recommender.costInsights.*

  • recommender.costInsights.get
  • recommender.costInsights.list
  • recommender.costInsights.update

(roles/billing.creator)

Provides access to create billing accounts.

Lowest-level resources where you can grant this role:

  • Organization

billing.accounts.create

resourcemanager.organizations.get

(roles/billing.projectManager)

When granted in conjunction with the Billing Account User role, provides access to assign a project's billing account or disable its billing.

Lowest-level resources where you can grant this role:

  • Project

resourcemanager.projects.createBillingAssignment

resourcemanager.projects.deleteBillingAssignment

(roles/billing.user)

When granted in conjunction with the Project Owner role or Project Billing Manager role, provides access to associate projects with billing accounts.

Lowest-level resources where you can grant this role:

  • Billing Account

billing.accounts.get

billing.accounts.getIamPolicy

billing.accounts.list

billing.accounts.redeemPromotion

billing.credits.list

billing.resourceAssociations.create

(roles/billing.viewer)

View billing account cost and pricing information, transactions, and billing and commitment recommendations.

Lowest-level resources where you can grant this role:

  • Billing Account

billing.accounts.get

billing.accounts.getCarbonInformation

billing.accounts.getIamPolicy

billing.accounts.getPaymentInfo

billing.accounts.getPricing

billing.accounts.getSpendingInformation

billing.accounts.getUsageExportSpec

billing.accounts.list

billing.billingAccountPrice.get

billing.billingAccountPrices.list

billing.billingAccountServices.*

  • billing.billingAccountServices.get
  • billing.billingAccountServices.list

billing.billingAccountSkuGroupSkus.*

  • billing.billingAccountSkuGroupSkus.get
  • billing.billingAccountSkuGroupSkus.list

billing.billingAccountSkuGroups.*

  • billing.billingAccountSkuGroups.get
  • billing.billingAccountSkuGroups.list

billing.billingAccountSkus.*

  • billing.billingAccountSkus.get
  • billing.billingAccountSkus.list

billing.budgets.get

billing.budgets.list

billing.credits.list

billing.finOpsBenchmarkInformation.get

billing.finOpsHealthInformation.get

billing.resourceAssociations.list

billing.subscriptions.get

billing.subscriptions.list

commerceoffercatalog.*

  • commerceoffercatalog.agreements.get
  • commerceoffercatalog.agreements.list
  • commerceoffercatalog.documents.get
  • commerceoffercatalog.documents.list
  • commerceoffercatalog.offers.get

consumerprocurement.accounts.get

consumerprocurement.accounts.list

consumerprocurement.consents.check

consumerprocurement.consents.list

consumerprocurement.orderAttributions.get

consumerprocurement.orderAttributions.list

consumerprocurement.orders.get

consumerprocurement.orders.list

dataprocessing.datasources.get

dataprocessing.datasources.list

dataprocessing.groupcontrols.get

dataprocessing.groupcontrols.list

recommender.commitmentUtilizationInsights.get

recommender.commitmentUtilizationInsights.list

recommender.costInsights.get

recommender.costInsights.list

recommender.costRecommendations.*

  • recommender.costRecommendations.listAll
  • recommender.costRecommendations.summarizeAll

recommender.spendBasedCommitmentInsights.get

recommender.spendBasedCommitmentInsights.list

recommender.spendBasedCommitmentRecommendations.get

recommender.spendBasedCommitmentRecommendations.list

recommender.spendBasedCommitmentRecommenderConfig.get

recommender.usageCommitmentRecommendations.get

recommender.usageCommitmentRecommendations.list

Perhatikan bahwa peran roles/billing.admin, roles/billing.costsManager, roles/billing.viewer, dan roles/billing.projectManager juga mencakup izin untuk layanan Google Cloud lainnya.