Esta página se ha traducido con Cloud Translation API.

Control de acceso para la API Budget de Facturación de Cloud

Google Cloud ofrece Gestión de Identidades y Accesos (IAM), que te permite dar un acceso más granular a recursos específicos Google Cloud y evita el acceso no deseado a otros recursos. IAM te permite adoptar el principio de seguridad de mínimos accesos, de forma que solo concedas el acceso necesario a tus recursos.

En Cloud IAM puedes configurar las políticas de gestión de identidades y accesos para controlar quién (es decir, qué usuarios) tiene qué tipo de acceso (es decir, funciones) a qué recursos. Las políticas de gestión de identidades y accesos (IAM) asignan roles específicos a un usuario, lo que le otorga determinados permisos.

En esta página se explican los roles de Gestión de Identidades y Accesos disponibles para las APIs de Cloud Billing. Por ejemplo, puedes usar IAM para asignar roles como Administrador, Usuario y Gestor de proyectos a una cuenta de facturación de Cloud. Para obtener una descripción detallada de IAM y de sus características, consulta la guía para desarrolladores de Identity and Access Management. En concreto, consulta la sección Conceder, cambiar y revocar el acceso.

Permisos y funciones

Para que un usuario pueda ver los detalles de una cuenta de facturación de Cloud en la consola deGoogle Cloud , o para que un método de la API Cloud Billing devuelva información de una cuenta de facturación de Cloud, el usuario o la persona que llama debe tener los permisos necesarios. En la siguiente tabla se indican los permisos y roles de gestión de identidades y accesos necesarios para usar la API Budget de Facturación de Cloud.

Permisos necesarios para la API Budget de Facturación de Cloud

En la siguiente tabla se indica qué permisos son necesarios para llamar a cada método de la API Cloud Billing Budget. También se incluyen los roles de facturación estándar de gestión de identidades y accesos, que conceden esos permisos automáticamente.

Método de API	Permiso obligatorio	Rol de gestión de identidades y accesos que concede permisos
`GetBudget`	Para obtener los detalles de un presupuesto, el llamante debe tener el permiso `billing.budgets.get` en la cuenta de facturación de Cloud del presupuesto. En el caso de los presupuestos de un solo proyecto, en lugar de permisos de cuenta de facturación, el llamante puede tener los siguientes permisos en el proyecto: `resourcemanager.projects.get` y `billing.resourcebudgets.read`.	Administrador de cuenta de facturación, gestor de costes de cuenta de facturación o lector de cuenta de facturación en la cuenta de facturación de Cloud del presupuesto. En el caso de los presupuestos de un solo proyecto, debes tener el rol de propietario, editor o lector del proyecto.
`ListBudgets`	Para devolver una lista de presupuestos aplicados a una cuenta de Facturación de Cloud, el llamante debe tener el permiso `billing.budgets.list` en la cuenta de Facturación de Cloud. En el caso de los presupuestos de un solo proyecto, en lugar de permisos de cuenta de facturación, el llamante puede tener los siguientes permisos en el proyecto: `resourcemanager.projects.get` y `billing.resourcebudgets.read`.	Administrador de cuenta de facturación, gestor de costes de cuenta de facturación o lector de cuenta de facturación en la cuenta de facturación de Cloud del presupuesto. En el caso de los presupuestos de un solo proyecto, debes tener el rol de propietario, editor o lector del proyecto.
`CreateBudget`	Para crear un presupuesto, el llamador debe tener el permiso `billing.budgets.create` en la cuenta de Facturación de Cloud del presupuesto. En el caso de los presupuestos de un solo proyecto, en lugar de permisos de cuenta de facturación, el llamante puede tener los siguientes permisos en el proyecto: `resourcemanager.projects.get`, `billing.resourcebudgets.read` y `billing.resourcebudgets.write`.	Administrador de cuenta de facturación o Gestor de costes de cuenta de facturación en la cuenta de facturación de Cloud del presupuesto. En el caso de los presupuestos de un solo proyecto, debes tener el rol de propietario o editor del proyecto.
`UpdateBudget`	Para actualizar un presupuesto, el llamante debe tener el permiso `billing.budgets.update` en la cuenta de Facturación de Cloud del presupuesto. En el caso de los presupuestos de un solo proyecto, en lugar de permisos de cuenta de facturación, el llamante puede tener los siguientes permisos en el proyecto: `resourcemanager.projects.get`, `billing.resourcebudgets.read` y `billing.resourcebudgets.write`.	Administrador de cuenta de facturación o Gestor de costes de cuenta de facturación en la cuenta de facturación de Cloud del presupuesto. En el caso de los presupuestos de un solo proyecto, debes tener el rol de propietario o editor del proyecto.
`DeleteBudget`	Para eliminar un presupuesto, el llamante debe tener el permiso `billing.budgets.delete` en la cuenta de Facturación de Cloud del presupuesto. En el caso de los presupuestos de un solo proyecto, en lugar de permisos de cuenta de facturación, el llamante puede tener los siguientes permisos en el proyecto: `resourcemanager.projects.get`, `billing.resourcebudgets.read` y `billing.resourcebudgets.write`.	Administrador de cuenta de facturación o Gestor de costes de cuenta de facturación en la cuenta de facturación de Cloud del presupuesto. En el caso de los presupuestos de un solo proyecto, debes tener el rol de propietario o editor del proyecto.

Roles

No se conceden permisos directamente a los usuarios, sino que se les asignan roles, que incluyen uno o varios permisos.

Puedes designar una o más funciones en el mismo recurso.

En la siguiente tabla se indican los roles de facturación de IAM estándar que puedes asignar para acceder a las APIs Cloud Billing, la descripción de lo que hace cada rol y los permisos incluidos en él.

Role Permissions

Role	Permissions
Billing Account Administrator (`roles/billing.admin`) Provides access to see and manage all aspects of billing accounts. Lowest-level resources where you can grant this role: Billing Account	`billing.accounts.close` `billing.accounts.get` `billing.accounts.getCarbonInformation` `billing.accounts.getIamPolicy` `billing.accounts.getPaymentInfo` `billing.accounts.getPricing` `billing.accounts.getSpendingInformation` `billing.accounts.getUsageExportSpec` `billing.accounts.list` `billing.accounts.move` `billing.accounts.redeemPromotion` `billing.accounts.removeFromOrganization` `billing.accounts.reopen` `billing.accounts.setIamPolicy` `billing.accounts.update` `billing.accounts.updatePaymentInfo` `billing.accounts.updateUsageExportSpec` `billing.anomalies.` `billing.anomalies.get` `billing.anomalies.list` `billing.anomalies.submitFeedback` `billing.anomaliesConfigs.` `billing.anomaliesConfigs.get` `billing.anomaliesConfigs.update` `billing.billingAccountPrice.get` `billing.billingAccountPrices.list` `billing.billingAccountServices.` `billing.billingAccountServices.get` `billing.billingAccountServices.list` `billing.billingAccountSkuGroupSkus.` `billing.billingAccountSkuGroupSkus.get` `billing.billingAccountSkuGroupSkus.list` `billing.billingAccountSkuGroups.` `billing.billingAccountSkuGroups.get` `billing.billingAccountSkuGroups.list` `billing.billingAccountSkus.` `billing.billingAccountSkus.get` `billing.billingAccountSkus.list` `billing.budgets.` `billing.budgets.create` `billing.budgets.delete` `billing.budgets.get` `billing.budgets.list` `billing.budgets.update` `billing.credits.list` `billing.finOpsBenchmarkInformation.get` `billing.finOpsHealthInformation.get` `billing.resourceAssociations.` `billing.resourceAssociations.create` `billing.resourceAssociations.delete` `billing.resourceAssociations.list` `billing.subscriptions.` `billing.subscriptions.create` `billing.subscriptions.get` `billing.subscriptions.list` `billing.subscriptions.update` `cloudasset.assets.searchAllResources` `cloudnotifications.activities.list` `cloudsupport.properties.get` `cloudsupport.techCases.` `cloudsupport.techCases.create` `cloudsupport.techCases.escalate` `cloudsupport.techCases.get` `cloudsupport.techCases.list` `cloudsupport.techCases.update` `commerceoffercatalog.` `commerceoffercatalog.agreements.get` `commerceoffercatalog.agreements.list` `commerceoffercatalog.documents.get` `commerceoffercatalog.documents.list` `commerceoffercatalog.offers.get` `compute.commitments.` `compute.commitments.create` `compute.commitments.get` `compute.commitments.list` `compute.commitments.update` `compute.commitments.updateReservations` `consumerprocurement.accounts.` `consumerprocurement.accounts.create` `consumerprocurement.accounts.delete` `consumerprocurement.accounts.get` `consumerprocurement.accounts.list` `consumerprocurement.consents.check` `consumerprocurement.consents.grant` `consumerprocurement.consents.list` `consumerprocurement.consents.revoke` `consumerprocurement.events.` `consumerprocurement.events.get` `consumerprocurement.events.list` `consumerprocurement.licensePools.` `consumerprocurement.licensePools.assign` `consumerprocurement.licensePools.enumerateLicensedUsers` `consumerprocurement.licensePools.get` `consumerprocurement.licensePools.unassign` `consumerprocurement.licensePools.update` `consumerprocurement.orderAttributions.` `consumerprocurement.orderAttributions.get` `consumerprocurement.orderAttributions.list` `consumerprocurement.orderAttributions.update` `consumerprocurement.orders.` `consumerprocurement.orders.cancel` `consumerprocurement.orders.get` `consumerprocurement.orders.list` `consumerprocurement.orders.modify` `consumerprocurement.orders.place` `dataprocessing.datasources.get` `dataprocessing.datasources.list` `dataprocessing.groupcontrols.get` `dataprocessing.groupcontrols.list` `logging.logEntries.list` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.list` `logging.privateLogEntries.list` `recommender.cloudsqlIdleInstanceRecommendations.get` `recommender.cloudsqlIdleInstanceRecommendations.list` `recommender.cloudsqlOverprovisionedInstanceRecommendations.get` `recommender.cloudsqlOverprovisionedInstanceRecommendations.list` `recommender.commitmentUtilizationInsights.` `recommender.commitmentUtilizationInsights.get` `recommender.commitmentUtilizationInsights.list` `recommender.commitmentUtilizationInsights.update` `recommender.computeAddressIdleResourceRecommendations.get` `recommender.computeAddressIdleResourceRecommendations.list` `recommender.computeDiskIdleResourceRecommendations.get` `recommender.computeDiskIdleResourceRecommendations.list` `recommender.computeImageIdleResourceRecommendations.get` `recommender.computeImageIdleResourceRecommendations.list` `recommender.computeInstanceGroupManagerMachineTypeRecommendations.get` `recommender.computeInstanceGroupManagerMachineTypeRecommendations.list` `recommender.computeInstanceIdleResourceRecommendations.get` `recommender.computeInstanceIdleResourceRecommendations.list` `recommender.computeInstanceMachineTypeRecommendations.get` `recommender.computeInstanceMachineTypeRecommendations.list` `recommender.costInsights.` `recommender.costInsights.get` `recommender.costInsights.list` `recommender.costInsights.update` `recommender.costRecommendations.` `recommender.costRecommendations.listAll` `recommender.costRecommendations.summarizeAll` `recommender.resourcemanagerProjectUtilizationRecommendations.get` `recommender.resourcemanagerProjectUtilizationRecommendations.list` `recommender.spendBasedCommitmentInsights.` `recommender.spendBasedCommitmentInsights.get` `recommender.spendBasedCommitmentInsights.list` `recommender.spendBasedCommitmentInsights.update` `recommender.spendBasedCommitmentRecommendations.` `recommender.spendBasedCommitmentRecommendations.get` `recommender.spendBasedCommitmentRecommendations.list` `recommender.spendBasedCommitmentRecommendations.update` `recommender.spendBasedCommitmentRecommenderConfig.` `recommender.spendBasedCommitmentRecommenderConfig.get` `recommender.spendBasedCommitmentRecommenderConfig.update` `recommender.usageCommitmentRecommendations.` `recommender.usageCommitmentRecommendations.get` `recommender.usageCommitmentRecommendations.list` `recommender.usageCommitmentRecommendations.update` `resourcemanager.projects.createBillingAssignment` `resourcemanager.projects.deleteBillingAssignment` `resourcemanager.projects.get` `resourcemanager.projects.list`
Carbon Footprint Viewer (`roles/billing.carbonViewer`)	`billing.accounts.get` `billing.accounts.getCarbonInformation` `billing.accounts.list`
Billing Account Costs Manager (`roles/billing.costsManager`) Manage budgets for a billing account, and view, analyze, and export cost information of a billing account. Lowest-level resources where you can grant this role: Billing Account	`billing.accounts.get` `billing.accounts.getIamPolicy` `billing.accounts.getSpendingInformation` `billing.accounts.getUsageExportSpec` `billing.accounts.list` `billing.accounts.updateUsageExportSpec` `billing.anomalies.get` `billing.anomalies.list` `billing.anomaliesConfigs.` `billing.anomaliesConfigs.get` `billing.anomaliesConfigs.update` `billing.budgets.` `billing.budgets.create` `billing.budgets.delete` `billing.budgets.get` `billing.budgets.list` `billing.budgets.update` `billing.resourceAssociations.list` `recommender.costInsights.*` `recommender.costInsights.get` `recommender.costInsights.list` `recommender.costInsights.update`
Billing Account Creator (`roles/billing.creator`) Provides access to create billing accounts. Lowest-level resources where you can grant this role: Organization	`billing.accounts.create` `resourcemanager.organizations.get`
Account Hierarchy Manager (`roles/billing.linkAdmin`) Authorized to manage billing account hierarchy	`billing.accounts.create` `billing.accounts.get` `billing.accounts.getCarbonInformation` `billing.accounts.getIamPolicy` `billing.accounts.getPaymentInfo` `billing.accounts.getPricing` `billing.accounts.getSpendingInformation` `billing.accounts.getUsageExportSpec` `billing.accounts.list` `billing.accounts.move` `billing.accounts.removeFromOrganization` `billing.anomalies.get` `billing.anomalies.list` `billing.anomaliesConfigs.get` `billing.billingAccountPrice.get` `billing.billingAccountPrices.list` `billing.billingAccountServices.` `billing.billingAccountServices.get` `billing.billingAccountServices.list` `billing.billingAccountSkuGroupSkus.` `billing.billingAccountSkuGroupSkus.get` `billing.billingAccountSkuGroupSkus.list` `billing.billingAccountSkuGroups.` `billing.billingAccountSkuGroups.get` `billing.billingAccountSkuGroups.list` `billing.billingAccountSkus.` `billing.billingAccountSkus.get` `billing.billingAccountSkus.list` `billing.budgets.get` `billing.budgets.list` `billing.credits.list` `billing.finOpsBenchmarkInformation.get` `billing.finOpsHealthInformation.get` `billing.resourceAssociations.list` `billing.subscriptions.get` `billing.subscriptions.list` `commerceoffercatalog.` `commerceoffercatalog.agreements.get` `commerceoffercatalog.agreements.list` `commerceoffercatalog.documents.get` `commerceoffercatalog.documents.list` `commerceoffercatalog.offers.get` `consumerprocurement.accounts.get` `consumerprocurement.accounts.list` `consumerprocurement.consents.check` `consumerprocurement.consents.list` `consumerprocurement.orderAttributions.get` `consumerprocurement.orderAttributions.list` `consumerprocurement.orders.get` `consumerprocurement.orders.list` `dataprocessing.datasources.get` `dataprocessing.datasources.list` `dataprocessing.groupcontrols.get` `dataprocessing.groupcontrols.list` `recommender.commitmentUtilizationInsights.get` `recommender.commitmentUtilizationInsights.list` `recommender.costInsights.get` `recommender.costInsights.list` `recommender.costRecommendations.` `recommender.costRecommendations.listAll` `recommender.costRecommendations.summarizeAll` `recommender.spendBasedCommitmentInsights.get` `recommender.spendBasedCommitmentInsights.list` `recommender.spendBasedCommitmentRecommendations.get` `recommender.spendBasedCommitmentRecommendations.list` `recommender.spendBasedCommitmentRecommenderConfig.get` `recommender.usageCommitmentRecommendations.get` `recommender.usageCommitmentRecommendations.list`
Project Billing Costs Manager (`roles/billing.projectCostsManager`) When granted in conjunction with cost view permissions on projects, provides access to billing information scoped to the projects to which the user has cost access. Lowest-level resources where you can grant this role: Billing Account	`billing.accounts.getIamPolicy` `billing.accounts.getSpendingInformationScoped` `billing.costRecommendations.listScoped`
Project Billing Manager (`roles/billing.projectManager`) When granted in conjunction with the Billing Account User role, provides access to assign a project's billing account or disable its billing. Lowest-level resources where you can grant this role: Project	`resourcemanager.projects.createBillingAssignment` `resourcemanager.projects.deleteBillingAssignment`
Billing Account User (`roles/billing.user`) When granted in conjunction with the Project Owner role or Project Billing Manager role, provides access to associate projects with billing accounts. Lowest-level resources where you can grant this role: Billing Account	`billing.accounts.get` `billing.accounts.getIamPolicy` `billing.accounts.list` `billing.accounts.redeemPromotion` `billing.credits.list` `billing.resourceAssociations.create`
Billing Account Viewer (`roles/billing.viewer`) View billing account cost and pricing information, transactions, and billing and commitment recommendations. Lowest-level resources where you can grant this role: Billing Account	`billing.accounts.get` `billing.accounts.getCarbonInformation` `billing.accounts.getIamPolicy` `billing.accounts.getPaymentInfo` `billing.accounts.getPricing` `billing.accounts.getSpendingInformation` `billing.accounts.getUsageExportSpec` `billing.accounts.list` `billing.anomalies.get` `billing.anomalies.list` `billing.anomaliesConfigs.get` `billing.billingAccountPrice.get` `billing.billingAccountPrices.list` `billing.billingAccountServices.` `billing.billingAccountServices.get` `billing.billingAccountServices.list` `billing.billingAccountSkuGroupSkus.` `billing.billingAccountSkuGroupSkus.get` `billing.billingAccountSkuGroupSkus.list` `billing.billingAccountSkuGroups.` `billing.billingAccountSkuGroups.get` `billing.billingAccountSkuGroups.list` `billing.billingAccountSkus.` `billing.billingAccountSkus.get` `billing.billingAccountSkus.list` `billing.budgets.get` `billing.budgets.list` `billing.credits.list` `billing.finOpsBenchmarkInformation.get` `billing.finOpsHealthInformation.get` `billing.resourceAssociations.list` `billing.subscriptions.get` `billing.subscriptions.list` `commerceoffercatalog.` `commerceoffercatalog.agreements.get` `commerceoffercatalog.agreements.list` `commerceoffercatalog.documents.get` `commerceoffercatalog.documents.list` `commerceoffercatalog.offers.get` `consumerprocurement.accounts.get` `consumerprocurement.accounts.list` `consumerprocurement.consents.check` `consumerprocurement.consents.list` `consumerprocurement.orderAttributions.get` `consumerprocurement.orderAttributions.list` `consumerprocurement.orders.get` `consumerprocurement.orders.list` `dataprocessing.datasources.get` `dataprocessing.datasources.list` `dataprocessing.groupcontrols.get` `dataprocessing.groupcontrols.list` `recommender.commitmentUtilizationInsights.get` `recommender.commitmentUtilizationInsights.list` `recommender.costInsights.get` `recommender.costInsights.list` `recommender.costRecommendations.` `recommender.costRecommendations.listAll` `recommender.costRecommendations.summarizeAll` `recommender.spendBasedCommitmentInsights.get` `recommender.spendBasedCommitmentInsights.list` `recommender.spendBasedCommitmentRecommendations.get` `recommender.spendBasedCommitmentRecommendations.list` `recommender.spendBasedCommitmentRecommenderConfig.get` `recommender.usageCommitmentRecommendations.get` `recommender.usageCommitmentRecommendations.list`

Billing Account Administrator

(roles/billing.admin)

Provides access to see and manage all aspects of billing accounts.

Lowest-level resources where you can grant this role:

Billing Account

billing.accounts.close

billing.accounts.get

billing.accounts.getCarbonInformation

billing.accounts.getIamPolicy

billing.accounts.getPaymentInfo

billing.accounts.getPricing

billing.accounts.getSpendingInformation

billing.accounts.getUsageExportSpec

billing.accounts.list

billing.accounts.move

billing.accounts.redeemPromotion

billing.accounts.removeFromOrganization

billing.accounts.reopen

billing.accounts.setIamPolicy

billing.accounts.update

billing.accounts.updatePaymentInfo

billing.accounts.updateUsageExportSpec

billing.anomalies.*

billing.anomalies.get
billing.anomalies.list
billing.anomalies.submitFeedback

billing.anomaliesConfigs.*

billing.anomaliesConfigs.get
billing.anomaliesConfigs.update

billing.billingAccountPrice.get

billing.billingAccountPrices.list

billing.billingAccountServices.*

billing.billingAccountServices.get
billing.billingAccountServices.list

billing.billingAccountSkuGroupSkus.*

billing.billingAccountSkuGroupSkus.get
billing.billingAccountSkuGroupSkus.list

billing.billingAccountSkuGroups.*

billing.billingAccountSkuGroups.get
billing.billingAccountSkuGroups.list

billing.billingAccountSkus.*

billing.billingAccountSkus.get
billing.billingAccountSkus.list

billing.budgets.*

billing.budgets.create
billing.budgets.delete
billing.budgets.get
billing.budgets.list
billing.budgets.update

billing.credits.list

billing.finOpsBenchmarkInformation.get

billing.finOpsHealthInformation.get

billing.resourceAssociations.*

billing.resourceAssociations.create
billing.resourceAssociations.delete
billing.resourceAssociations.list

billing.subscriptions.*

billing.subscriptions.create
billing.subscriptions.get
billing.subscriptions.list
billing.subscriptions.update

cloudasset.assets.searchAllResources

cloudnotifications.activities.list

cloudsupport.properties.get

cloudsupport.techCases.*

cloudsupport.techCases.create
cloudsupport.techCases.escalate
cloudsupport.techCases.get
cloudsupport.techCases.list
cloudsupport.techCases.update

commerceoffercatalog.*

commerceoffercatalog.agreements.get
commerceoffercatalog.agreements.list
commerceoffercatalog.documents.get
commerceoffercatalog.documents.list
commerceoffercatalog.offers.get

compute.commitments.*

compute.commitments.create
compute.commitments.get
compute.commitments.list
compute.commitments.update
compute.commitments.updateReservations

consumerprocurement.accounts.*

consumerprocurement.accounts.create
consumerprocurement.accounts.delete
consumerprocurement.accounts.get
consumerprocurement.accounts.list

consumerprocurement.consents.check

consumerprocurement.consents.grant

consumerprocurement.consents.list

consumerprocurement.consents.revoke

consumerprocurement.events.*

consumerprocurement.events.get
consumerprocurement.events.list

consumerprocurement.licensePools.*

consumerprocurement.licensePools.assign
consumerprocurement.licensePools.enumerateLicensedUsers
consumerprocurement.licensePools.get
consumerprocurement.licensePools.unassign
consumerprocurement.licensePools.update

consumerprocurement.orderAttributions.*

consumerprocurement.orderAttributions.get
consumerprocurement.orderAttributions.list
consumerprocurement.orderAttributions.update

consumerprocurement.orders.*

consumerprocurement.orders.cancel
consumerprocurement.orders.get
consumerprocurement.orders.list
consumerprocurement.orders.modify
consumerprocurement.orders.place

dataprocessing.datasources.get

dataprocessing.datasources.list

dataprocessing.groupcontrols.get

dataprocessing.groupcontrols.list

logging.logEntries.list

logging.logServiceIndexes.list

logging.logServices.list

logging.logs.list

logging.privateLogEntries.list

recommender.cloudsqlIdleInstanceRecommendations.get

recommender.cloudsqlIdleInstanceRecommendations.list

recommender.cloudsqlOverprovisionedInstanceRecommendations.get

recommender.cloudsqlOverprovisionedInstanceRecommendations.list

recommender.commitmentUtilizationInsights.*

recommender.commitmentUtilizationInsights.get
recommender.commitmentUtilizationInsights.list
recommender.commitmentUtilizationInsights.update

recommender.computeAddressIdleResourceRecommendations.get

recommender.computeAddressIdleResourceRecommendations.list

recommender.computeDiskIdleResourceRecommendations.get

recommender.computeDiskIdleResourceRecommendations.list

recommender.computeImageIdleResourceRecommendations.get

recommender.computeImageIdleResourceRecommendations.list

recommender.computeInstanceGroupManagerMachineTypeRecommendations.get

recommender.computeInstanceGroupManagerMachineTypeRecommendations.list

recommender.computeInstanceIdleResourceRecommendations.get

recommender.computeInstanceIdleResourceRecommendations.list

recommender.computeInstanceMachineTypeRecommendations.get

recommender.computeInstanceMachineTypeRecommendations.list

recommender.costInsights.*

recommender.costInsights.get
recommender.costInsights.list
recommender.costInsights.update

recommender.costRecommendations.*

recommender.costRecommendations.listAll
recommender.costRecommendations.summarizeAll

recommender.resourcemanagerProjectUtilizationRecommendations.get

recommender.resourcemanagerProjectUtilizationRecommendations.list

recommender.spendBasedCommitmentInsights.*

recommender.spendBasedCommitmentInsights.get
recommender.spendBasedCommitmentInsights.list
recommender.spendBasedCommitmentInsights.update

recommender.spendBasedCommitmentRecommendations.*

recommender.spendBasedCommitmentRecommendations.get
recommender.spendBasedCommitmentRecommendations.list
recommender.spendBasedCommitmentRecommendations.update

recommender.spendBasedCommitmentRecommenderConfig.*

recommender.spendBasedCommitmentRecommenderConfig.get
recommender.spendBasedCommitmentRecommenderConfig.update

recommender.usageCommitmentRecommendations.*

recommender.usageCommitmentRecommendations.get
recommender.usageCommitmentRecommendations.list
recommender.usageCommitmentRecommendations.update

resourcemanager.projects.createBillingAssignment

resourcemanager.projects.deleteBillingAssignment

resourcemanager.projects.get

resourcemanager.projects.list

Carbon Footprint Viewer

(roles/billing.carbonViewer)

billing.accounts.get

billing.accounts.getCarbonInformation

billing.accounts.list

Billing Account Costs Manager

(roles/billing.costsManager)

Manage budgets for a billing account, and view, analyze, and export cost information of a billing account.

Lowest-level resources where you can grant this role:

Billing Account

billing.accounts.get

billing.accounts.getIamPolicy

billing.accounts.getSpendingInformation

billing.accounts.getUsageExportSpec

billing.accounts.list

billing.accounts.updateUsageExportSpec

billing.anomalies.get

billing.anomalies.list

billing.anomaliesConfigs.*

billing.anomaliesConfigs.get
billing.anomaliesConfigs.update

billing.budgets.*

billing.budgets.create
billing.budgets.delete
billing.budgets.get
billing.budgets.list
billing.budgets.update

billing.resourceAssociations.list

recommender.costInsights.*

recommender.costInsights.get
recommender.costInsights.list
recommender.costInsights.update

Billing Account Creator

(roles/billing.creator)

Provides access to create billing accounts.

Lowest-level resources where you can grant this role:

Organization

billing.accounts.create

resourcemanager.organizations.get

Account Hierarchy Manager

(roles/billing.linkAdmin)

Authorized to manage billing account hierarchy

billing.accounts.create

billing.accounts.get

billing.accounts.getCarbonInformation

billing.accounts.getIamPolicy

billing.accounts.getPaymentInfo

billing.accounts.getPricing

billing.accounts.getSpendingInformation

billing.accounts.getUsageExportSpec

billing.accounts.list

billing.accounts.move

billing.accounts.removeFromOrganization

billing.anomalies.get

billing.anomalies.list

billing.anomaliesConfigs.get

billing.billingAccountPrice.get

billing.billingAccountPrices.list

billing.billingAccountServices.*

billing.billingAccountServices.get
billing.billingAccountServices.list

billing.billingAccountSkuGroupSkus.*

billing.billingAccountSkuGroupSkus.get
billing.billingAccountSkuGroupSkus.list

billing.billingAccountSkuGroups.*

billing.billingAccountSkuGroups.get
billing.billingAccountSkuGroups.list

billing.billingAccountSkus.*

billing.billingAccountSkus.get
billing.billingAccountSkus.list

billing.budgets.get

billing.budgets.list

billing.credits.list

billing.finOpsBenchmarkInformation.get

billing.finOpsHealthInformation.get

billing.resourceAssociations.list

billing.subscriptions.get

billing.subscriptions.list

commerceoffercatalog.*

commerceoffercatalog.agreements.get
commerceoffercatalog.agreements.list
commerceoffercatalog.documents.get
commerceoffercatalog.documents.list
commerceoffercatalog.offers.get

consumerprocurement.accounts.get

consumerprocurement.accounts.list

consumerprocurement.consents.check

consumerprocurement.consents.list

consumerprocurement.orderAttributions.get

consumerprocurement.orderAttributions.list

consumerprocurement.orders.get

consumerprocurement.orders.list

dataprocessing.datasources.get

dataprocessing.datasources.list

dataprocessing.groupcontrols.get

dataprocessing.groupcontrols.list

recommender.commitmentUtilizationInsights.get

recommender.commitmentUtilizationInsights.list

recommender.costInsights.get

recommender.costInsights.list

recommender.costRecommendations.*

recommender.costRecommendations.listAll
recommender.costRecommendations.summarizeAll

recommender.spendBasedCommitmentInsights.get

recommender.spendBasedCommitmentInsights.list

recommender.spendBasedCommitmentRecommendations.get

recommender.spendBasedCommitmentRecommendations.list

recommender.spendBasedCommitmentRecommenderConfig.get

recommender.usageCommitmentRecommendations.get

recommender.usageCommitmentRecommendations.list

Project Billing Costs Manager

(roles/billing.projectCostsManager)

When granted in conjunction with cost view permissions on projects, provides access to billing information scoped to the projects to which the user has cost access.

Lowest-level resources where you can grant this role:

Billing Account

billing.accounts.getIamPolicy

billing.accounts.getSpendingInformationScoped

billing.costRecommendations.listScoped

Project Billing Manager

(roles/billing.projectManager)

When granted in conjunction with the Billing Account User role, provides access to assign a project's billing account or disable its billing.

Lowest-level resources where you can grant this role:

Project

resourcemanager.projects.createBillingAssignment

resourcemanager.projects.deleteBillingAssignment

Billing Account User

(roles/billing.user)

When granted in conjunction with the Project Owner role or Project Billing Manager role, provides access to associate projects with billing accounts.

Lowest-level resources where you can grant this role:

Billing Account

billing.accounts.get

billing.accounts.getIamPolicy

billing.accounts.list

billing.accounts.redeemPromotion

billing.credits.list

billing.resourceAssociations.create

Billing Account Viewer

(roles/billing.viewer)

View billing account cost and pricing information, transactions, and billing and commitment recommendations.

Lowest-level resources where you can grant this role:

Billing Account

billing.accounts.get

billing.accounts.getCarbonInformation

billing.accounts.getIamPolicy

billing.accounts.getPaymentInfo

billing.accounts.getPricing

billing.accounts.getSpendingInformation

billing.accounts.getUsageExportSpec

billing.accounts.list

billing.anomalies.get

billing.anomalies.list

billing.anomaliesConfigs.get

billing.billingAccountPrice.get

billing.billingAccountPrices.list

billing.billingAccountServices.*

billing.billingAccountServices.get
billing.billingAccountServices.list

billing.billingAccountSkuGroupSkus.*

billing.billingAccountSkuGroupSkus.get
billing.billingAccountSkuGroupSkus.list

billing.billingAccountSkuGroups.*

billing.billingAccountSkuGroups.get
billing.billingAccountSkuGroups.list

billing.billingAccountSkus.*

billing.billingAccountSkus.get
billing.billingAccountSkus.list

billing.budgets.get

billing.budgets.list

billing.credits.list

billing.finOpsBenchmarkInformation.get

billing.finOpsHealthInformation.get

billing.resourceAssociations.list

billing.subscriptions.get

billing.subscriptions.list

commerceoffercatalog.*

commerceoffercatalog.agreements.get
commerceoffercatalog.agreements.list
commerceoffercatalog.documents.get
commerceoffercatalog.documents.list
commerceoffercatalog.offers.get

consumerprocurement.accounts.get

consumerprocurement.accounts.list

consumerprocurement.consents.check

consumerprocurement.consents.list

consumerprocurement.orderAttributions.get

consumerprocurement.orderAttributions.list

consumerprocurement.orders.get

consumerprocurement.orders.list

dataprocessing.datasources.get

dataprocessing.datasources.list

dataprocessing.groupcontrols.get

dataprocessing.groupcontrols.list

recommender.commitmentUtilizationInsights.get

recommender.commitmentUtilizationInsights.list

recommender.costInsights.get

recommender.costInsights.list

recommender.costRecommendations.*

recommender.costRecommendations.listAll
recommender.costRecommendations.summarizeAll

recommender.spendBasedCommitmentInsights.get

recommender.spendBasedCommitmentInsights.list

recommender.spendBasedCommitmentRecommendations.get

recommender.spendBasedCommitmentRecommendations.list

recommender.spendBasedCommitmentRecommenderConfig.get

recommender.usageCommitmentRecommendations.get

recommender.usageCommitmentRecommendations.list

Ten en cuenta que los roles roles/billing.admin, roles/billing.costsManager, roles/billing.viewer y roles/billing.projectManager incluyen permisos para otros servicios de Google Cloud .

Temas relacionados

Gestionar el acceso a proyectos, carpetas y organizaciones en la documentación de gestión de identidades y accesos
Gestionar el acceso a otros recursos en la documentación de gestión de identidades y accesos
Crear roles personalizados para la facturación de Cloud