如何在 GCP 中为项目添加权限？

Question

I'm trying to set up a GCP billing alert using Terraform. The docs say :

Your account must have the serviceusage.services.use permission on the billing_project you defined.

The Google docs also say to set this permission on the project but don't say how.

How can I add that permission to my project (either via the console or ideally Terraform) to allow myself to create billing alerts?

My provider currently looks like this:

provider "google-beta" {
  alias                 = "billing"
  billing_project       = "me-${var.env}"
  project               = "me-${var.env}"
  region                = "europe-west1"
  zone                  = "europe-west1-d"
  user_project_override = true
}

Answer 1

Cloud budgets can only be created and managed by users with a Billing Account Administrator role, or a custom role with appropriate budget management permissions. This means that project owners without the Billing Account Admin role cannot create budgets for their respective projects.

To create a budget for your Cloud Billing account, you need a role that includes the following permissions on the Cloud Billing account:

• billing.budgets.create to create a new budget.
• billing.budgets.get and billing.budgets.list to view all budgets for the Cloud Billing account.

To gain these permissions, ask your administrator to grant you one of the following Cloud Billing IAM roles on your Cloud Billing account:

• Billing Account Administrator
• Billing Account Costs Manager

Steps to add or remove Cloud Billing permissions:

1.Sign in to the Google Cloud Console.

• Open the Cloud Console Navigation menu and then select Billing .

• If you have more than one Cloud Billing account, do one of the following:

  • To manage Cloud Billing for the current project, select Go to linked billing account.
  • To locate a different Cloud Billing account, select Manage billing accounts and then choose the account that you want to manage.

2. In the Billing navigation menu, click Account management .

3. Use the Permissions panel to edit permissions for the selected Cloud Billing account. If the panel isn't already visible, click SHOW INFO PANEL to open it.

The Permissions panel is organized by role, along with the number of principals that have each role. For example, in your permissions panel, you might see - Billing Account Administrator (2 principals) - Billing Account User (6 principals) - Billing Account Viewer (10 principals)

You can grant multiple roles to the same principal.

To view the list of principals that have a role, click the role name to expand (or collapse) the list of principals.

Refer to the links to update Cloud Billing permissions and creating budget alerts.