GCP Billing Access and Administration Best Practice

When following our best practices article one of the steps that you eventually end up doing is setting up access to manage and view billing.  This article documents the steps necessary to do that and assumes a continuation of best practices when using GCP, specifically that Cloud Identity or G Suite has already been setup.

Objectives

1. Have the ability to modify the billing account used in a project.
2. Provide insight into the spend on each GCP SKU.
3. Enable Woolpert to provide the best support possible.
4. Do the above while following the best practices of least privilege.

Step 1: Create the Google Group

1. This section assumes you already have Cloud Identity (free) or G Suite.
2. Create a new group with the email address of google-billing@<your-domain.com>  using the official guide.
3. Add yourself, a backup and cloudsuccess@woolpert.com as members of the group.
4. Optionally, more granular billing groups and access can be setup to enable changing of the billing account in use on any given project (Billing Administration role) to be a separate group of users from those that can see the associated spend on each cloud SKU's (Billing Account Viewer role).  Create additional groups and membership as needed.

Step 2: Grant The Group Access

1. Identify and coordinate with whomever has GCP Project Owner access, they will need to perform the steps below for every project.
2. Browse to the projects IAM settings page.
3. Click "Add".
4. Enter the newly created group email address, it should look like google-billing@<your-domain.com> from the steps above.
5. Select the following roles Billing Administrator and Project Browser.  Project Browser is optional but it provides Woolpert and billing admins the ability to query/list all the project Id's without being explicitly granted any access to them.
6. Click Save