[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[[["\u003cp\u003eIdentity and Access Management (IAM) allows for fine-grained permissions, which can be grouped into roles for simplified user access management, including the use of predefined or custom roles.\u003c/p\u003e\n"],["\u003cp\u003eCustom roles, created at the organization level, enable tailored permission sets for billing accounts, providing flexibility beyond predefined roles, and ensuring that users only receive necessary permissions.\u003c/p\u003e\n"],["\u003cp\u003eBilling permissions can be granted at both billing account and project levels, with most permissions residing at the billing account level, but some actions, such as project association, require permissions at both levels.\u003c/p\u003e\n"],["\u003cp\u003eUsers can manage budgets for an entire billing account or specific projects, depending on the assigned permissions, which can be set at either the billing account level or the project level to limit access as needed.\u003c/p\u003e\n"],["\u003cp\u003eBilling permissions follow a hierarchical inheritance model, meaning permissions at higher levels (like the organization) apply to lower levels (like individual billing accounts), and some permissions are exclusive to these higher levels.\u003c/p\u003e\n"]]],[],null,["# Create custom roles for Cloud Billing accounts\n\n\u003cbr /\u003e\n\n[Identity and Access Management (IAM)](/iam/docs/overview)\nincludes fine-grained permissions, which lets you grant or revoke access to\nspecific actions for individual users. To simplify the process of assigning\npermissions to users, IAM roles combine these fine-grained\npermissions into related groups. Billing has\n[predefined roles](/billing/docs/how-to/billing-access),\nsuch as Billing Account Administrator or Billing Account Viewer, which\nwork for most users. But, if they don't fit your needs, custom roles\nlet you to grant more specific sets of permissions.\n\nCreate a custom role\n--------------------\n\nCustom roles are created on the organization, and then are applied to any\nbilling account in the organization.\n[Creating and Managing Custom Roles](/iam/docs/creating-custom-roles)\nin the IAM documentation describes how to configure\na custom role, including which permissions are necessary.\n| **Caution:** When you create a custom role, you're prompted to specify *Project* or *Organization* . You must select *Organization*. Project roles can't be applied to billing accounts.\n\nAfter custom roles are created, you can grant custom roles to users just like\nstandard, predefined roles.\n[Learn how to update billing permissions](/billing/docs/how-to/billing-access#update_billing_permissions).\n\nExample custom role\n-------------------\n\nImagine you want to give someone the ability to edit cost management features,\nsuch as budget alerts and billing export. The relevant permissions are:\n\n- `billing.budgets.create`\n- `billing.budgets.update`\n- `billing.accounts.updateUsageExportSpec`\n\nWith the predefined roles, to apply these permissions you need to grant\nthe Billing Account Administrator role. But that role also includes\npermission to delete resource associations, cancel subscriptions, and close the\nbilling account. If you didn't want your users to have those capabilities, you\ncould instead [create a custom role](/iam/docs/creating-custom-roles)\nwith only the three necessary permissions and name it *Cost Management\nAdministrator*. Then, you could apply that custom role in combination with the\nBilling Account Viewer role to any users that should have broad cost\nmanagement permissions but no ability to edit other account properties.\n\nPermission association and inheritance\n--------------------------------------\n\nYou can grant billing permissions at the billing\naccount level or at the project level. Most billing permissions belong on the\nbilling account, so roles containing those permissions should be associated with\nthe billing account. Other billing permissions instead belong on a project and\nneed to be associated with the project instead of the billing account.\n\nFor example, associating a\nproject with a billing account requires the\n`billing.resourceAssociations.create` permission on the billing account and\nalso the `resourcemanager.projects.createBillingAssignment` permission on the\nproject. This is because project permissions are required for actions where\nproject owners control access, while billing account permissions are required\nfor actions where billing account administrators control access. When both\nare involved, both permissions are necessary.\n\nJust like other IAM permissions, all billing permissions\ninherit from higher levels of the billing hierarchy. For example, a user with\na role containing `billing.accounts.close` on an organization can close any\nbilling account within that organization. However, some permissions only apply\nat higher levels. For example, the `billing.accounts.list` permission doesn't\ndo anything when applied to an individual billing account, but a user with a\nrole containing `billing.accounts.list` on an organization can list all billing\naccounts within that organization.\n\nBilling activities\n------------------\n\nThe following tables describe common billing activities, the permissions\nrequired to perform those activities, and the resource that those permissions\napply to.\n\n### Account management\n\n| **Key Point:** Most billing actions require `billing.accounts.get`. You might consider giving a role with this permission to all users who need billing account access.\n\n### Billing account hierarchy\n\n### Cost information\n\nCost view permissions can be limited to specific projects, or granted on a\nbilling account to view all costs for a billing account.\n\n| **\\* Note:** A user with `billing.accounts.getSpendingInformation` permission on the billing account can view costs for the entire billing account including *all* of its projects. If you want to limit a user to viewing the costs only for specific projects, give the user the `billing.resourceCosts.get` and `resourcemanager.projects.get` permissions on each project instead of setting the billing account level permission.\n\n### Payment information\n\nThe payment profile includes customer name, address, and payment method.\n\n### Resource associations\n\nMoving a project between billing accounts requires the same permissions as\nremoving it from the original billing account and associating it with the new\none.\n\n### Budgets and spending alerts\n\n| **Key Point:** A user with billing-account-level permissions on the billing account can manage budgets for the entire billing account, including *any* of its projects. If you want to limit a user to managing budgets that are scoped only to a single project, give the user project-level permissions on the project instead of setting billing-account-level permissions. For more information, see [Create, edit, or delete budgets and budget alerts](/billing/docs/how-to/budgets)\n\n### Credits and promotions\n\n### Policy\n\nThe policy defines which users have access to which resources on a billing\naccount. For information on creating or modifying custom roles, see the\n[Create a Custom Role](#create_a_custom_role) section, above.\n\n### Export specifications\n\nThe export specification defines where to send a copy of all usage-related data,\nand can contain the name of a\n[BigQuery dataset](/billing/docs/how-to/export-data-bigquery).\n\nRelated topics\n--------------\n\n- [Overview of Cloud Billing access control](/billing/docs/how-to/billing-access)\n- [Cloud Billing API access control](/billing/v1/how-tos/access-control)\n- [Granting, changing, and revoking Access](/iam/docs/granting-changing-revoking-access)"]]
