Cloud Billing Budget API 的访问权限控制

Google Cloud 提供 Identity and Access Management (IAM)，可让您授予对特定 Google Cloud 资源的更细化访问权限，并防止对其他资源进行不必要的访问。IAM 允许您采用最小权限安全原则，因此您只需授予对您的资源的必要访问权限即可。

IAM 允许您通过设置 IAM 政策来控制谁（用户）对哪些资源具有什么访问权限（角色）。 您可以使用 IAM 政策向用户授予特定角色，从而给予用户特定权限。

本页面介绍适用于 Cloud Billing API 的 Identity and Access Management 角色。例如，您可以使用 IAM 为 Cloud Billing 账号授予 Admin、User 和 Project Manager 等角色。如需详细了解 IAM 及其功能，请参阅 Identity and Access Management 开发者指南，请特别留意授予、更改和撤消访问权限部分。

权限和角色

要让用户在 Google Cloud 控制台中查看 Cloud Billing 账号详细信息，或者使 Cloud Billing API 方法返回 Cloud Billing 账号信息，用户或调用方必须拥有必要的权限。下表列出了使用 Cloud Billing Budget API 所需的 IAM 权限和角色。

Cloud Billing Budget API 所需的权限

下表概括了调用每个 Cloud Billing Budget API 方法所需的权限，还包括可自动授予这些权限的标准 IAM Billing 角色。

API 方法	所需权限	可授予权限的 IAM 角色
GetBudget	如需获取预算的详细信息，调用方必须对预算的 Cloud Billing 账号拥有 billing.budgets.get 权限。 对于单项目预算，调用者可以对项目具有以下权限（而不是结算账号权限）：resourcemanager.projects.get 和 billing.resourcebudgets.read。	预算的 Cloud Billing 账号的 Billing Account Administrator、Billing Account Costs Manager 或 Billing Account Viewer。 对于单个项目的预算：项目的 Project Owner、Project Editor 或 Project Viewer。
ListBudgets	如需返回应用到 Cloud Billing 账号的预算列表，调用者必须对 Cloud Billing 账号拥有 billing.budgets.list 权限。 对于单项目预算，调用者可以对项目具有以下权限（而不是结算账号权限）：resourcemanager.projects.get 和 billing.resourcebudgets.read。	预算的 Cloud Billing 账号的 Billing Account Administrator、Billing Account Costs Manager 或 Billing Account Viewer。 对于单个项目的预算：项目的 Project Owner、Project Editor 或 Project Viewer。
CreateBudget	如需创建新预算，调用方必须对预算的 Cloud Billing 账号拥有 billing.budgets.create 权限。 对于单项目预算，调用者可以对项目具有以下权限（而不是结算账号权限）：resourcemanager.projects.get、billing.resourcebudgets.read 和 billing.resourcebudgets.write。	预算的 Cloud Billing 账号的 Billing Account Administrator 或 Billing Account Costs Manager。 对于单个项目的预算：项目的 Project Owner 或 Project Editor。
UpdateBudget	如需更新现有预算，调用方必须对预算的 Cloud Billing 账号拥有 billing.budgets.update 权限。 对于单项目预算，调用者可以对项目具有以下权限（而不是结算账号权限）：resourcemanager.projects.get、billing.resourcebudgets.read 和 billing.resourcebudgets.write。	预算的 Cloud Billing 账号的 Billing Account Administrator 或 Billing Account Costs Manager。 对于单个项目的预算：项目的 Project Owner 或 Project Editor。
DeleteBudget	如需删除现有预算，调用方必须对预算的 Cloud Billing 账号拥有 billing.budgets.delete 权限。 对于单项目预算，调用者可以对项目具有以下权限（而不是结算账号权限）：resourcemanager.projects.get、billing.resourcebudgets.read 和 billing.resourcebudgets.write。	预算的 Cloud Billing 账号的 Billing Account Administrator 或 Billing Account Costs Manager。 对于单个项目的预算：项目的 Project Owner 或 Project Editor。

角色

您不直接授予用户权限，而是向其授予角色（角色自带一个或多个权限）。

您可以针对同一项资源授予一个或多个角色。

下表列出了您可以为访问 Cloud Billing API 而授予的标准 IAM Billing 角色、角色的作用说明以及该角色提供的权限。

如需向 Cloud Billing API 授予权限，请为 API 设置服务账号，并将角色分配给服务账号。

Role	Permissions
Billing Account Administrator (roles/billing.admin) Provides access to see and manage all aspects of billing accounts. Lowest-level resources where you can grant this role: Billing Account	billing.accounts.close billing.accounts.get billing.accounts.getCarbonInformation billing.accounts.getIamPolicy billing.accounts.getPaymentInfo billing.accounts.getPricing billing.accounts.getSpendingInformation billing.accounts.getUsageExportSpec billing.accounts.list billing.accounts.move billing.accounts.redeemPromotion billing.accounts.removeFromOrganization billing.accounts.reopen billing.accounts.setIamPolicy billing.accounts.update billing.accounts.updatePaymentInfo billing.accounts.updateUsageExportSpec billing.billingAccountPrice.get billing.billingAccountPrices.list billing.billingAccountServices.* billing.billingAccountServices.get billing.billingAccountServices.list billing.billingAccountSkuGroupSkus.* billing.billingAccountSkuGroupSkus.get billing.billingAccountSkuGroupSkus.list billing.billingAccountSkuGroups.* billing.billingAccountSkuGroups.get billing.billingAccountSkuGroups.list billing.billingAccountSkus.* billing.billingAccountSkus.get billing.billingAccountSkus.list billing.budgets.* billing.budgets.create billing.budgets.delete billing.budgets.get billing.budgets.list billing.budgets.update billing.credits.list billing.finOpsBenchmarkInformation.get billing.finOpsHealthInformation.get billing.resourceAssociations.* billing.resourceAssociations.create billing.resourceAssociations.delete billing.resourceAssociations.list billing.subscriptions.* billing.subscriptions.create billing.subscriptions.get billing.subscriptions.list billing.subscriptions.update cloudasset.assets.searchAllResources cloudnotifications.activities.list cloudsupport.properties.get cloudsupport.techCases.* cloudsupport.techCases.create cloudsupport.techCases.escalate cloudsupport.techCases.get cloudsupport.techCases.list cloudsupport.techCases.update commerceoffercatalog.* commerceoffercatalog.agreements.get commerceoffercatalog.agreements.list commerceoffercatalog.documents.get commerceoffercatalog.documents.list commerceoffercatalog.offers.get compute.commitments.* compute.commitments.create compute.commitments.get compute.commitments.list compute.commitments.update compute.commitments.updateReservations consumerprocurement.accounts.* consumerprocurement.accounts.create consumerprocurement.accounts.delete consumerprocurement.accounts.get consumerprocurement.accounts.list consumerprocurement.consents.check consumerprocurement.consents.grant consumerprocurement.consents.list consumerprocurement.consents.revoke consumerprocurement.events.* consumerprocurement.events.get consumerprocurement.events.list consumerprocurement.licensePools.* consumerprocurement.licensePools.assign consumerprocurement.licensePools.enumerateLicensedUsers consumerprocurement.licensePools.get consumerprocurement.licensePools.unassign consumerprocurement.licensePools.update consumerprocurement.orderAttributions.* consumerprocurement.orderAttributions.get consumerprocurement.orderAttributions.list consumerprocurement.orderAttributions.update consumerprocurement.orders.* consumerprocurement.orders.cancel consumerprocurement.orders.get consumerprocurement.orders.list consumerprocurement.orders.modify consumerprocurement.orders.place dataprocessing.datasources.get dataprocessing.datasources.list dataprocessing.groupcontrols.get dataprocessing.groupcontrols.list logging.logEntries.list logging.logServiceIndexes.list logging.logServices.list logging.logs.list logging.privateLogEntries.list recommender.cloudsqlIdleInstanceRecommendations.get recommender.cloudsqlIdleInstanceRecommendations.list recommender.cloudsqlOverprovisionedInstanceRecommendations.get recommender.cloudsqlOverprovisionedInstanceRecommendations.list recommender.commitmentUtilizationInsights.* recommender.commitmentUtilizationInsights.get recommender.commitmentUtilizationInsights.list recommender.commitmentUtilizationInsights.update recommender.computeAddressIdleResourceRecommendations.get recommender.computeAddressIdleResourceRecommendations.list recommender.computeDiskIdleResourceRecommendations.get recommender.computeDiskIdleResourceRecommendations.list recommender.computeImageIdleResourceRecommendations.get recommender.computeImageIdleResourceRecommendations.list recommender.computeInstanceGroupManagerMachineTypeRecommendations.get recommender.computeInstanceGroupManagerMachineTypeRecommendations.list recommender.computeInstanceIdleResourceRecommendations.get recommender.computeInstanceIdleResourceRecommendations.list recommender.computeInstanceMachineTypeRecommendations.get recommender.computeInstanceMachineTypeRecommendations.list recommender.costInsights.* recommender.costInsights.get recommender.costInsights.list recommender.costInsights.update recommender.costRecommendations.* recommender.costRecommendations.listAll recommender.costRecommendations.summarizeAll recommender.resourcemanagerProjectUtilizationRecommendations.get recommender.resourcemanagerProjectUtilizationRecommendations.list recommender.spendBasedCommitmentInsights.* recommender.spendBasedCommitmentInsights.get recommender.spendBasedCommitmentInsights.list recommender.spendBasedCommitmentInsights.update recommender.spendBasedCommitmentRecommendations.* recommender.spendBasedCommitmentRecommendations.get recommender.spendBasedCommitmentRecommendations.list recommender.spendBasedCommitmentRecommendations.update recommender.spendBasedCommitmentRecommenderConfig.* recommender.spendBasedCommitmentRecommenderConfig.get recommender.spendBasedCommitmentRecommenderConfig.update recommender.usageCommitmentRecommendations.* recommender.usageCommitmentRecommendations.get recommender.usageCommitmentRecommendations.list recommender.usageCommitmentRecommendations.update resourcemanager.projects.createBillingAssignment resourcemanager.projects.deleteBillingAssignment resourcemanager.projects.get resourcemanager.projects.list
Billing Account Costs Manager (roles/billing.costsManager) Manage budgets for a billing account, and view, analyze, and export cost information of a billing account. Lowest-level resources where you can grant this role: Billing Account	billing.accounts.get billing.accounts.getIamPolicy billing.accounts.getSpendingInformation billing.accounts.getUsageExportSpec billing.accounts.list billing.accounts.updateUsageExportSpec billing.budgets.* billing.budgets.create billing.budgets.delete billing.budgets.get billing.budgets.list billing.budgets.update billing.resourceAssociations.list recommender.costInsights.* recommender.costInsights.get recommender.costInsights.list recommender.costInsights.update
Billing Account Creator (roles/billing.creator) Provides access to create billing accounts. Lowest-level resources where you can grant this role: Organization	billing.accounts.create resourcemanager.organizations.get
Project Billing Manager (roles/billing.projectManager) When granted in conjunction with the Billing Account User role, provides access to assign a project's billing account or disable its billing. Lowest-level resources where you can grant this role: Project	resourcemanager.projects.createBillingAssignment resourcemanager.projects.deleteBillingAssignment
Billing Account User (roles/billing.user) When granted in conjunction with the Project Owner role or Project Billing Manager role, provides access to associate projects with billing accounts. Lowest-level resources where you can grant this role: Billing Account	billing.accounts.get billing.accounts.getIamPolicy billing.accounts.list billing.accounts.redeemPromotion billing.credits.list billing.resourceAssociations.create
Billing Account Viewer (roles/billing.viewer) View billing account cost and pricing information, transactions, and billing and commitment recommendations. Lowest-level resources where you can grant this role: Billing Account	billing.accounts.get billing.accounts.getCarbonInformation billing.accounts.getIamPolicy billing.accounts.getPaymentInfo billing.accounts.getPricing billing.accounts.getSpendingInformation billing.accounts.getUsageExportSpec billing.accounts.list billing.billingAccountPrice.get billing.billingAccountPrices.list billing.billingAccountServices.* billing.billingAccountServices.get billing.billingAccountServices.list billing.billingAccountSkuGroupSkus.* billing.billingAccountSkuGroupSkus.get billing.billingAccountSkuGroupSkus.list billing.billingAccountSkuGroups.* billing.billingAccountSkuGroups.get billing.billingAccountSkuGroups.list billing.billingAccountSkus.* billing.billingAccountSkus.get billing.billingAccountSkus.list billing.budgets.get billing.budgets.list billing.credits.list billing.finOpsBenchmarkInformation.get billing.finOpsHealthInformation.get billing.resourceAssociations.list billing.subscriptions.get billing.subscriptions.list commerceoffercatalog.* commerceoffercatalog.agreements.get commerceoffercatalog.agreements.list commerceoffercatalog.documents.get commerceoffercatalog.documents.list commerceoffercatalog.offers.get consumerprocurement.accounts.get consumerprocurement.accounts.list consumerprocurement.consents.check consumerprocurement.consents.list consumerprocurement.orderAttributions.get consumerprocurement.orderAttributions.list consumerprocurement.orders.get consumerprocurement.orders.list dataprocessing.datasources.get dataprocessing.datasources.list dataprocessing.groupcontrols.get dataprocessing.groupcontrols.list recommender.commitmentUtilizationInsights.get recommender.commitmentUtilizationInsights.list recommender.costInsights.get recommender.costInsights.list recommender.costRecommendations.* recommender.costRecommendations.listAll recommender.costRecommendations.summarizeAll recommender.spendBasedCommitmentInsights.get recommender.spendBasedCommitmentInsights.list recommender.spendBasedCommitmentRecommendations.get recommender.spendBasedCommitmentRecommendations.list recommender.spendBasedCommitmentRecommenderConfig.get recommender.usageCommitmentRecommendations.get recommender.usageCommitmentRecommendations.list

请注意，roles/billing.admin、roles/billing.costsManager、roles/billing.viewer 和 roles/billing.projectManager 角色还包括对其他 Google Cloud 服务的权限。

相关主题

• IAM 文档中的管理对项目、文件夹和组织的访问权限
• IAM 文档中的管理对其他资源的访问权限
• 为 Cloud Billing 创建自定义角色