[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[[["\u003cp\u003eThis guide demonstrates how to configure Identity and Access Management (IAM) permissions for various billing scenarios, specifically aimed at billing administrators and employees managing billing tasks.\u003c/p\u003e\n"],["\u003cp\u003eThe document outlines which IAM roles to assign to different roles within an organization, such as CEOs, office managers, finance teams, IT departments, and developers, to manage billing accounts, budgets, and project costs.\u003c/p\u003e\n"],["\u003cp\u003eBest practices are emphasized, like using groups to manage principals, exporting billing data to BigQuery, and using labels and projects to track costs by team, department, service, or project.\u003c/p\u003e\n"],["\u003cp\u003eThe guide presents multiple scenarios, including small companies, finance teams managing budgets, customer self-service portals, and developers creating billed projects, each with specific role assignments and access considerations.\u003c/p\u003e\n"],["\u003cp\u003eBilling Account Administrator, Billing Account User, and Billing Account Viewer are some of the key roles discussed, highlighting their varying levels of permissions, from managing payments to simply viewing expenses.\u003c/p\u003e\n"]]],[],null,["# IAM roles for billing-related job functions\n\nThis topic shows you how to configure Identity and Access Management (IAM) permissions for\na set of sample billing scenarios. It provides guidance on which\nIAM roles to grant to the billing-related functional roles in\nyour company for the scenarios. These examples are mainly targeted at billing\nadministrators and employees who manage billing tasks for an organization.\n\nThis document does not explain in detail the billing roles and permissions. For\na detailed description of roles and permissions for Billing API, read the\n[Access Control for Billing](https://cloud.google.com/billing/v1/how-tos/access-control) page.\n\nSmall company configuring billing permissions\n---------------------------------------------\n\nIn this scenario a small company is trying to configure and use\nGoogle Cloud billing accounts. They have a handful of engineers who\ndevelop and maintain their applications, but none of them manage their billing.\nThey have an office manager, who is responsible for matching payments to\ninvoices, but for compliance reasons the office manager is not permitted to have\naccess to Google Cloud resources in the projects. The CEO also holds and manages\nthe credit card details.\n\nThe table below explains the billing IAM roles that the\nOrganization Administrator (which is the CEO in this scenario) can grant to the\nother personas in the company, and the resource level at which she grants the\nroles.\n\nThe allow policy attached to the organization resource for this scenario will\nlook similar to the following:\n**Note:** The JSON for all allow policy snippets is shown for each scenario. These bindings can also be set via the Google Cloud console. \n\n {\n \"bindings\": [\n {\n \"role\": \"roles/resourcemanager.organizationAdmin\",\n \"members\": [\n \"user:ceo@example.com\"\n ]\n },\n {\n \"role\": \"roles/billing.admin\",\n \"members\": [\n \"group:finance-admins-group@example.com\"\n ]\n }\n ]\n }\n\nThe best practice is to use groups to manage principals. In the example\nabove, for the second binding, you would add the CEO and office manager to\n`finance-admins-group`. When you need to modify who is able to carry out the\nfunction, you simply need to adjust the group membership, negating the need to\nupdate the allow policy. So the two individual user accounts do not appear in\nthe role bindings.\n\nFinance teams managing budgets\n------------------------------\n\nIn this scenario, a large organization wants the finance team in each division\nto be able to set budgets and view team spending in the division, but not have\naccess to the Google Cloud resources. They don't mind if the developers\nsee the spend for their own projects, but a broad view of expenses should not be\nallowed to the developers.\n\nGrant the roles in table below to the finance manager of each division and the\ndevelopers:\n\nFor this scenario, use the billing console to grant the Billing Account\nAdministrator role to the finance managers on the billing account. In addition,\ngrant the Billing Account Viewer role to the developers on the billing account.\n\nWhen you are done, the allow policy for the billing account looks similar to the\nfollowing: \n\n {\n \"bindings\": [\n {\n \"role\": \"roles/billing.admin\",\n \"members\": [\n \"group:finance-admins-group@example.com\"\n ]\n },\n {\n \"role\": \"roles/billing.viewer\",\n \"members\": [\n \"group:developers@example.com\"\n ]\n }\n ],\n \"etag\": \"BwUjMhCsNvY=\",\n \"version\": 1\n }\n\nCustomer self-service portal, Developers cannot adjust billing\n--------------------------------------------------------------\n\nIn this scenario, a customer's central IT team provides Google Cloud\nresources to their developers as part of their self service portal. Developers\nrequest access to Google Cloud projects and other approved cloud services\nvia the portal. The cost center of the developer pays the central IT team for\nthe cloud resources consumed.\n\nThe central IT team must be able to:\n\n- Associate projects with billing accounts.\n- Turn off billing for projects.\n- View the credit card information.\n\nThey must not have permissions to view the project contents.\n\nDevelopers should be able to view the actual costs of the Google Cloud\nresources being consumed, but shouldn't be able to turn billing off, associate\nbilling with projects, and view the credit card information.\n\nFor this scenario you will need two separate operations to assign the\nappropriate allow policies as they are attached at different levels of the\nhierarchy.\n\nUse the billing console to grant the Billing Account Administrator role to the\nIT department on the billing account. In addition, grant the Billing Account\nViewer role to the developers on the billing account.\n\nYou then need to attach an allow policy at the organization level. This allow\npolicy grants the Billing Account User role to the service account. It is\nsimilar to the following: \n\n {\n \"bindings\": [\n {\n \"role\": \"roles/billing.user\",\n \"members\": [\n \"serviceAccount:my-project-creator@shared-resources-proj.iam.gserviceaccount.com\"\n ]\n }\n ],\n \"etag\": \"BwWKmjvelug=\",\n \"version\": 1\n }\n\nDevelopers creating billed projects\n-----------------------------------\n\nA large digital native wants to allow all their developers to create billed\nprojects on their organization's invoiced account without giving them Billing\nAccount Administrator rights.\n\nA project needs to have billing enabled to ensure that APIs beyond the default\ncan be enabled. Thus if a developer creates a project, they need to associate it\nwith a billing account to enable the APIs.\n\nThe allow policy for this scenario needs to be attached at the organization\nlevel, and it will look similar to the following: \n\n {\n \"bindings\": [\n {\n \"role\": \"roles/billing.user\",\n \"members\": [\n \"group:developers@example.com\"\n ]\n }\n ],\n \"etag\": \"BwUjMhCsNvY=\",\n \"version\": 1\n }\n\nCost aggregation\n----------------\n\nIn this scenario, a company wants to calculate and keep track of how much each\nteam, department, service, or project is costing them. For example, keep track\nof how much does a test deployment cost them each month.\n\nThis can be tracked by using the following practices:\n\n- Use projects to organize resources. Cost is shown per project and project IDs are included in billing export.\n- Annotate projects with labels that represent additional grouping information. For example, `environment=test`. Labels are included in billing export to allow you to slice and dice further. However, labels on a project are permissioned the same way as the rest of the project's metadata which means a project owner can change labels. You can educate your employees about what not to change and then monitor (through audit logs), or grant them only granular permissions so they can't change project metadata.\n\nYou can export to JSON and CSV, but exporting directly to BigQuery is the\nsolution we recommend. This is easily configurable from the billing export\nsection of the billing console.\n\nIf each cost center must pay a separate invoice or pay in a separate\ncurrency for some workloads, then a separate billing account for each cost\ncenter is required. However this approach would require an affiliate agreement\nsigned for each billing account."]]
