Set up Gemini Cloud Assist in Cloud Billing

Preview

This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

To set up Gemini Cloud Assist in Cloud Billing, perform the following steps:

1. Enable the Gemini for Google Cloud API in a Google Cloud project. An administrator typically performs this step.

2. In the Google Cloud project, grant Identity and Access Management (IAM) roles to the same users who access Cloud Billing reports. An administrator typically performs this step.

3. For users who need access to Cloud Billing reports and Gemini Cloud Assist in Cloud Billing, grant IAM roles in the Cloud Billing account that's linked to the project where the Gemini for Google Cloud API is enabled. An administrator typically performs this step.

Enable the Gemini for Google Cloud API in a Google Cloud project

This section describes the steps required to enable the Gemini for Google Cloud API in a Google Cloud project.

Console

1. To enable the Gemini for Google Cloud API, go to the Gemini for Google Cloud page.

   Go to Gemini for Google Cloud

2. In the project selector, select a project.

   For Cloud Billing users who have billing-account-level permissions on the Cloud Billing account, we recommend that you use a FinOps administration project to contain the API.

3. Click Enable.

   The page updates and shows a status of API Enabled.

gcloud

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

2. In the project selector menu, select a project.

   For Cloud Billing users who have billing-account-level permissions on the Cloud Billing account, we recommend that you use a FinOps administration project to contain the API.

3. Enable the Gemini for Google Cloud API for Gemini using the gcloud services enable command:

   gcloud services enable cloudaicompanion.googleapis.com
   

   If you want to enable the Gemini for Google Cloud API in a different Google Cloud project, add the --project parameter:

   gcloud services enable cloudaicompanion.googleapis.com --project PROJECT_ID
   

   Replace PROJECT_ID with your Google Cloud project ID.

   The output is similar to the following:

   Waiting for async operation operations/acf.2e2fcfce-8327-4984-9040-a67777082687 to complete...
   Operation finished successfully.
   

After you enable the Gemini for Google Cloud API in the specified Google Cloud project, Gemini Cloud Assist is now available to all users who have the required IAM roles on the specified project.

Grant IAM roles in a Google Cloud project

This section describes the steps to grant the required project permissions to use Gemini Cloud Assist. In the Google Cloud project where you enabled the Gemini for Google Cloud API, grant the following IAM roles to users (principals) on the project:

• Gemini for Google Cloud User
• Service Usage Consumer

Console

1. To grant the IAM roles that are required to use Gemini for Google Cloud, go to the IAM & Admin page.

   Go to IAM & Admin

2. In the Principal column, find a principal for which you want to enable access to Gemini, and then click Edit principal in that row.

3. In the Edit access pane, click Add another role.

4. In Select a role, select Gemini for Google Cloud User.

5. Click Add another role and select Service Usage Consumer.

6. Click Save.

gcloud

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

2. In the project selector menu, select a project.

3. Grant the Gemini for Google Cloud User role:

   gcloud projects add-iam-policy-binding  PROJECT_ID \
       --member=PRINCIPAL --role=roles/cloudaicompanion.user
   

   Replace PRINCIPAL with the identifier for the principal. The identifier takes the form user|group|serviceAccount:email or domain:domain—for example, user:[e-mail], group:[e-mail], serviceAccount:[e-mail], or domain:example.domain.com.

   The output is a list of policy bindings that includes the following:

   - members:
     - user:PRINCIPAL
     role: roles/cloudaicompanion.user
   

4. Grant the Service Usage Consumer role:

   gcloud projects add-iam-policy-binding  PROJECT_ID \
       --member=PRINCIPAL --role=roles/serviceusage.serviceUsageConsumer
   

   The output is a list of policy bindings that includes the following:

   - members:
     - user:PRINCIPAL
     role: roles/serviceusage.serviceUsageConsumer
   

For more information, see Grant a single role and gcloud projects add-iam-policy-binding.

All of the users (principals) who are granted these roles can access Gemini for Google Cloud features in the Google Cloud console within the specified project. If the project users also have access to view Cloud Billing Reports, they can use Gemini Cloud Assist in Cloud Billing Reports to get AI assistance to create cost reports and to summarize key insights from the cost reports. For more information, see Gemini Cloud Assist in Cloud Billing overview.

Advanced IAM setup tasks for projects

Instead of using the Google Cloud console or the gcloud CLI to grant predefined IAM roles on a project, you can do any of the following:

• Use IAM REST APIs or IAM client libraries to grant roles.

  If you use these interfaces, use the fully qualified role names:

  • roles/cloudaicompanion.user
  • roles/serviceusage.serviceUsageConsumer

  For more information about granting roles, see Manage access to projects, folders, and organizations.

• Create and grant custom roles.

  Any custom roles for project permissions that you create need the following permissions to access Gemini for Google Cloud:

  • cloudaicompanion.companions.generateChat
  • cloudaicompanion.companions.generateCode
  • serviceusage.services.use

Grant IAM roles in a Cloud Billing account

For users who need access to Cloud Billing reports, you need to grant permissions on the Cloud Billing account that are adequate to access the Reports page. To use Gemini Cloud Assist in the billing report, grant access to the Cloud Billing account that is linked to the project where the Gemini for Google Cloud API is enabled.

• Required permissions: for detailed guidance about the permissions required to access billing reports, see the Permissions required to access reports section available in the "Analyze billing data and cost trends with Reports" article.

• Grant access: for guidance on how to grant access to a Cloud Billing account, see the Update user permissions for a Cloud Billing account section available in the "Manage access to Cloud Billing accounts" article.

What's next

• Learn more about AI assistance that's available in Gemini Cloud Assist in Cloud Billing.
• Learn more about the different types of generative AI assistance available in Gemini for Google Cloud.
• Learn how Gemini for Google Cloud uses your data.
• Learn more about Google Cloud compliance.