Cloud Billing Budget API 的存取權控管

Google Cloud 提供身分與存取權管理 (IAM) 功能，可對特定 Google Cloud 資源授予更精細的存取權，避免未經授權者存取其他資源。IAM 採用最小權限原則，可確保您僅授予使用者必要的資源存取權限。

您可以設定 IAM 政策，控管「哪些使用者」具備「哪些資源」的「何種存取權 (角色)」。IAM 政策可將特定角色授予使用者，讓該使用者擁有特定權限。

本頁面說明 Cloud Billing API 適用的 Identity and Access Management 角色。舉例來說，您可以使用 IAM 授予 Cloud Billing 帳戶的管理員、使用者和專案經理等角色。如要進一步瞭解 IAM 及其功能，請參閱 Identity and Access Management 開發人員指南。特別是「授予、變更及撤銷存取權」一節。

權限與角色

使用者必須具備必要權限，才能在Google Cloud 控制台中查看 Cloud Billing 帳戶詳細資料，或透過 Cloud Billing API 方法傳回 Cloud Billing 帳戶資訊。下表列出使用 Cloud Billing Budget API 所需的 IAM 權限和角色。

Cloud Billing Budget API 的必要權限

下表列出呼叫各個 Cloud Billing Budget API 方法所需的權限。此外，也包含會自動授予這些權限的標準 IAM Billing 角色。

API 方法	所需權限	授予權限的 IAM 角色
GetBudget	如要取得預算詳細資料，呼叫端必須具備預算 Cloud Billing 帳戶的 billing.budgets.get 權限。 如果是單一專案預算，呼叫端可以具備下列專案權限，而非帳單帳戶權限：resourcemanager.projects.get和billing.resourcebudgets.read。	預算 Cloud Billing 帳戶的帳單帳戶管理員、帳單帳戶費用管理員或帳單帳戶檢視者。 如果是單一專案預算，則須具備專案的「專案擁有者」、「專案編輯者」或「專案檢視者」角色。
ListBudgets	如要傳回套用至 Cloud Billing 帳戶的預算清單，呼叫端必須具備 Cloud Billing 帳戶的 billing.budgets.list 權限。 如果是單一專案預算，呼叫端可以具備下列專案權限，而非帳單帳戶權限：resourcemanager.projects.get和billing.resourcebudgets.read。	預算 Cloud Billing 帳戶的帳單帳戶管理員、帳單帳戶費用管理員或帳單帳戶檢視者。 如果是單一專案預算，則須具備專案的「專案擁有者」、「專案編輯者」或「專案檢視者」角色。
CreateBudget	如要建立新的預算，呼叫端必須具備預算 Cloud Billing 帳戶的 billing.budgets.create 權限。 如果是單一專案預算，呼叫端可以具備下列專案權限，而非帳單帳戶權限：resourcemanager.projects.get、billing.resourcebudgets.read和billing.resourcebudgets.write。	預算 Cloud Billing 帳戶的帳單帳戶管理員或帳單帳戶費用管理員。 如果是單一專案預算，則須具備專案的「專案擁有者」或「專案編輯者」角色。
UpdateBudget	如要更新現有預算，呼叫端必須具備預算 Cloud Billing 帳戶的 billing.budgets.update 權限。 如果是單一專案預算，呼叫端可以具備下列專案權限，而非帳單帳戶權限：resourcemanager.projects.get、billing.resourcebudgets.read和billing.resourcebudgets.write。	預算 Cloud Billing 帳戶的帳單帳戶管理員或帳單帳戶費用管理員。 如果是單一專案預算，則須具備專案的「專案擁有者」或「專案編輯者」角色。
DeleteBudget	如要刪除現有預算，呼叫端必須具備預算 Cloud Billing 帳戶的 billing.budgets.delete 權限。 如果是單一專案預算，呼叫端可以具備下列專案權限，而非帳單帳戶權限：resourcemanager.projects.get、billing.resourcebudgets.read和billing.resourcebudgets.write。	預算 Cloud Billing 帳戶的帳單帳戶管理員或帳單帳戶費用管理員。 如果是單一專案預算，則須具備專案的「專案擁有者」或「專案編輯者」角色。

角色

您並非直接為使用者授予權限，而是指派「角色」給他們，每個角色可能具備一或多項權限。

針對同一項資源，您可以授予一或多個角色。

下表列出可授予 Cloud Billing API 存取權的標準 IAM Billing 角色、角色功能說明，以及該角色內含的權限。

如要授予 Cloud Billing API 權限，請為 API 設定服務帳戶，並為服務帳戶指派角色。

Role	Permissions
Billing Account Administrator (roles/billing.admin) Provides access to see and manage all aspects of billing accounts. Lowest-level resources where you can grant this role: Billing Account	billing.accounts.close billing.accounts.get billing.accounts.getCarbonInformation billing.accounts.getIamPolicy billing.accounts.getPaymentInfo billing.accounts.getPricing billing.accounts.getSpendingInformation billing.accounts.getUsageExportSpec billing.accounts.list billing.accounts.move billing.accounts.redeemPromotion billing.accounts.removeFromOrganization billing.accounts.reopen billing.accounts.setIamPolicy billing.accounts.update billing.accounts.updatePaymentInfo billing.accounts.updateUsageExportSpec billing.anomalies.* billing.anomalies.get billing.anomalies.list billing.anomalies.submitFeedback billing.anomaliesConfigs.* billing.anomaliesConfigs.get billing.anomaliesConfigs.update billing.billingAccountPrice.get billing.billingAccountPrices.list billing.billingAccountServices.* billing.billingAccountServices.get billing.billingAccountServices.list billing.billingAccountSkuGroupSkus.* billing.billingAccountSkuGroupSkus.get billing.billingAccountSkuGroupSkus.list billing.billingAccountSkuGroups.* billing.billingAccountSkuGroups.get billing.billingAccountSkuGroups.list billing.billingAccountSkus.* billing.billingAccountSkus.get billing.billingAccountSkus.list billing.budgets.* billing.budgets.configureSpendCap billing.budgets.create billing.budgets.delete billing.budgets.get billing.budgets.list billing.budgets.update billing.credits.list billing.finOpsBenchmarkInformation.get billing.finOpsHealthInformation.get billing.resourceAssociations.* billing.resourceAssociations.create billing.resourceAssociations.delete billing.resourceAssociations.list billing.subscriptions.* billing.subscriptions.create billing.subscriptions.get billing.subscriptions.list billing.subscriptions.update chroniclesm.contracts.* chroniclesm.contracts.get chroniclesm.contracts.update cloudasset.assets.searchAllResources cloudnotifications.activities.list cloudsupport.properties.get cloudsupport.techCases.* cloudsupport.techCases.create cloudsupport.techCases.escalate cloudsupport.techCases.get cloudsupport.techCases.list cloudsupport.techCases.update commerceoffercatalog.* commerceoffercatalog.agreements.get commerceoffercatalog.agreements.list commerceoffercatalog.documents.get commerceoffercatalog.documents.list commerceoffercatalog.offers.get compute.commitments.create compute.commitments.get compute.commitments.list compute.commitments.update compute.commitments.updateReservations consumerprocurement.accounts.* consumerprocurement.accounts.create consumerprocurement.accounts.delete consumerprocurement.accounts.get consumerprocurement.accounts.list consumerprocurement.consents.check consumerprocurement.consents.grant consumerprocurement.consents.list consumerprocurement.consents.revoke consumerprocurement.events.* consumerprocurement.events.get consumerprocurement.events.list consumerprocurement.licensePools.* consumerprocurement.licensePools.assign consumerprocurement.licensePools.enumerateLicensedUsers consumerprocurement.licensePools.get consumerprocurement.licensePools.unassign consumerprocurement.licensePools.update consumerprocurement.orderAttributions.* consumerprocurement.orderAttributions.get consumerprocurement.orderAttributions.list consumerprocurement.orderAttributions.update consumerprocurement.orders.* consumerprocurement.orders.cancel consumerprocurement.orders.get consumerprocurement.orders.list consumerprocurement.orders.modify consumerprocurement.orders.place dataprocessing.datasources.get dataprocessing.datasources.list dataprocessing.groupcontrols.get dataprocessing.groupcontrols.list discoveryengine.billingAccountLicenseConfigs.* discoveryengine.billingAccountLicenseConfigs.distribute discoveryengine.billingAccountLicenseConfigs.get discoveryengine.billingAccountLicenseConfigs.list discoveryengine.billingAccountLicenseConfigs.retract logging.logEntries.list logging.logServiceIndexes.list logging.logServices.list logging.logs.list logging.privateLogEntries.list recommender.cloudsqlIdleInstanceRecommendations.get recommender.cloudsqlIdleInstanceRecommendations.list recommender.cloudsqlOverprovisionedInstanceRecommendations.get recommender.cloudsqlOverprovisionedInstanceRecommendations.list recommender.commitmentUtilizationInsights.* recommender.commitmentUtilizationInsights.get recommender.commitmentUtilizationInsights.list recommender.commitmentUtilizationInsights.update recommender.computeAddressIdleResourceRecommendations.get recommender.computeAddressIdleResourceRecommendations.list recommender.computeDiskIdleResourceRecommendations.get recommender.computeDiskIdleResourceRecommendations.list recommender.computeImageIdleResourceRecommendations.get recommender.computeImageIdleResourceRecommendations.list recommender.computeInstanceGroupManagerMachineTypeRecommendations.get recommender.computeInstanceGroupManagerMachineTypeRecommendations.list recommender.computeInstanceIdleResourceRecommendations.get recommender.computeInstanceIdleResourceRecommendations.list recommender.computeInstanceMachineTypeRecommendations.get recommender.computeInstanceMachineTypeRecommendations.list recommender.costInsights.* recommender.costInsights.get recommender.costInsights.list recommender.costInsights.update recommender.costRecommendations.* recommender.costRecommendations.listAll recommender.costRecommendations.summarizeAll recommender.resourcemanagerProjectUtilizationRecommendations.get recommender.resourcemanagerProjectUtilizationRecommendations.list recommender.spendBasedCommitmentInsights.* recommender.spendBasedCommitmentInsights.get recommender.spendBasedCommitmentInsights.list recommender.spendBasedCommitmentInsights.update recommender.spendBasedCommitmentRecommendations.* recommender.spendBasedCommitmentRecommendations.get recommender.spendBasedCommitmentRecommendations.list recommender.spendBasedCommitmentRecommendations.update recommender.spendBasedCommitmentRecommenderConfig.* recommender.spendBasedCommitmentRecommenderConfig.get recommender.spendBasedCommitmentRecommenderConfig.update recommender.usageCommitmentRecommendations.* recommender.usageCommitmentRecommendations.get recommender.usageCommitmentRecommendations.list recommender.usageCommitmentRecommendations.update resourcemanager.projects.createBillingAssignment resourcemanager.projects.deleteBillingAssignment resourcemanager.projects.get resourcemanager.projects.list
Project Billing Manager (roles/billing.projectManager) When granted in conjunction with the Billing Account User role, provides access to assign a project's billing account or disable its billing. Lowest-level resources where you can grant this role: Project	resourcemanager.projects.createBillingAssignment resourcemanager.projects.deleteBillingAssignment
Billing Account Viewer (roles/billing.viewer) View billing account cost and pricing information, transactions, and billing and commitment recommendations. Lowest-level resources where you can grant this role: Billing Account	billing.accounts.get billing.accounts.getCarbonInformation billing.accounts.getIamPolicy billing.accounts.getPaymentInfo billing.accounts.getPricing billing.accounts.getSpendingInformation billing.accounts.getUsageExportSpec billing.accounts.list billing.anomalies.get billing.anomalies.list billing.anomaliesConfigs.get billing.billingAccountPrice.get billing.billingAccountPrices.list billing.billingAccountServices.* billing.billingAccountServices.get billing.billingAccountServices.list billing.billingAccountSkuGroupSkus.* billing.billingAccountSkuGroupSkus.get billing.billingAccountSkuGroupSkus.list billing.billingAccountSkuGroups.* billing.billingAccountSkuGroups.get billing.billingAccountSkuGroups.list billing.billingAccountSkus.* billing.billingAccountSkus.get billing.billingAccountSkus.list billing.budgets.get billing.budgets.list billing.credits.list billing.finOpsBenchmarkInformation.get billing.finOpsHealthInformation.get billing.resourceAssociations.list billing.subscriptions.get billing.subscriptions.list chroniclesm.contracts.get commerceoffercatalog.* commerceoffercatalog.agreements.get commerceoffercatalog.agreements.list commerceoffercatalog.documents.get commerceoffercatalog.documents.list commerceoffercatalog.offers.get consumerprocurement.accounts.get consumerprocurement.accounts.list consumerprocurement.consents.check consumerprocurement.consents.list consumerprocurement.orderAttributions.get consumerprocurement.orderAttributions.list consumerprocurement.orders.get consumerprocurement.orders.list dataprocessing.datasources.get dataprocessing.datasources.list dataprocessing.groupcontrols.get dataprocessing.groupcontrols.list discoveryengine.billingAccountLicenseConfigs.get discoveryengine.billingAccountLicenseConfigs.list recommender.commitmentUtilizationInsights.get recommender.commitmentUtilizationInsights.list recommender.costInsights.get recommender.costInsights.list recommender.costRecommendations.* recommender.costRecommendations.listAll recommender.costRecommendations.summarizeAll recommender.spendBasedCommitmentInsights.get recommender.spendBasedCommitmentInsights.list recommender.spendBasedCommitmentRecommendations.get recommender.spendBasedCommitmentRecommendations.list recommender.spendBasedCommitmentRecommenderConfig.get recommender.usageCommitmentRecommendations.get recommender.usageCommitmentRecommendations.list
Carbon Footprint Viewer (roles/billing.carbonViewer)	billing.accounts.get billing.accounts.getCarbonInformation billing.accounts.list
Billing Account Costs Manager (roles/billing.costsManager) Manage budgets for a billing account, and view, analyze, and export cost information of a billing account. Lowest-level resources where you can grant this role: Billing Account	billing.accounts.get billing.accounts.getIamPolicy billing.accounts.getSpendingInformation billing.accounts.getUsageExportSpec billing.accounts.list billing.accounts.updateUsageExportSpec billing.anomalies.get billing.anomalies.list billing.anomaliesConfigs.* billing.anomaliesConfigs.get billing.anomaliesConfigs.update billing.budgets.create billing.budgets.delete billing.budgets.get billing.budgets.list billing.budgets.update billing.resourceAssociations.list recommender.costInsights.* recommender.costInsights.get recommender.costInsights.list recommender.costInsights.update
Billing Account Creator (roles/billing.creator) Provides access to create billing accounts. Lowest-level resources where you can grant this role: Organization	billing.accounts.create resourcemanager.organizations.get
Account Hierarchy Manager (roles/billing.linkAdmin) Authorized to manage billing account hierarchy	billing.accounts.create billing.accounts.get billing.accounts.getCarbonInformation billing.accounts.getIamPolicy billing.accounts.getPaymentInfo billing.accounts.getPricing billing.accounts.getSpendingInformation billing.accounts.getUsageExportSpec billing.accounts.list billing.accounts.move billing.accounts.removeFromOrganization billing.anomalies.get billing.anomalies.list billing.anomaliesConfigs.get billing.billingAccountPrice.get billing.billingAccountPrices.list billing.billingAccountServices.* billing.billingAccountServices.get billing.billingAccountServices.list billing.billingAccountSkuGroupSkus.* billing.billingAccountSkuGroupSkus.get billing.billingAccountSkuGroupSkus.list billing.billingAccountSkuGroups.* billing.billingAccountSkuGroups.get billing.billingAccountSkuGroups.list billing.billingAccountSkus.* billing.billingAccountSkus.get billing.billingAccountSkus.list billing.budgets.get billing.budgets.list billing.credits.list billing.finOpsBenchmarkInformation.get billing.finOpsHealthInformation.get billing.resourceAssociations.list billing.subscriptions.get billing.subscriptions.list commerceoffercatalog.* commerceoffercatalog.agreements.get commerceoffercatalog.agreements.list commerceoffercatalog.documents.get commerceoffercatalog.documents.list commerceoffercatalog.offers.get consumerprocurement.accounts.get consumerprocurement.accounts.list consumerprocurement.consents.check consumerprocurement.consents.list consumerprocurement.orderAttributions.get consumerprocurement.orderAttributions.list consumerprocurement.orders.get consumerprocurement.orders.list dataprocessing.datasources.get dataprocessing.datasources.list dataprocessing.groupcontrols.get dataprocessing.groupcontrols.list recommender.commitmentUtilizationInsights.get recommender.commitmentUtilizationInsights.list recommender.costInsights.get recommender.costInsights.list recommender.costRecommendations.* recommender.costRecommendations.listAll recommender.costRecommendations.summarizeAll recommender.spendBasedCommitmentInsights.get recommender.spendBasedCommitmentInsights.list recommender.spendBasedCommitmentRecommendations.get recommender.spendBasedCommitmentRecommendations.list recommender.spendBasedCommitmentRecommenderConfig.get recommender.usageCommitmentRecommendations.get recommender.usageCommitmentRecommendations.list
Project Billing Costs Manager (roles/billing.projectCostsManager) When granted in conjunction with cost view permissions on projects, provides access to billing information scoped to the projects to which the user has cost access. Lowest-level resources where you can grant this role: Billing Account	billing.accounts.get billing.accounts.getIamPolicy billing.accounts.getSpendingInformationScoped billing.costRecommendations.listScoped
Billing Account User (roles/billing.user) When granted in conjunction with the Project Owner role or Project Billing Manager role, provides access to associate projects with billing accounts. Lowest-level resources where you can grant this role: Billing Account	billing.accounts.get billing.accounts.getIamPolicy billing.accounts.list billing.accounts.redeemPromotion billing.credits.list billing.resourceAssociations.create

請注意，roles/billing.admin、roles/billing.costsManager、roles/billing.viewer 和 roles/billing.projectManager 角色也包含其他 Google Cloud 服務的權限。

相關主題

• IAM 說明文件中的「管理專案、資料夾和組織的存取權」
• IAM 說明文件中的「管理其他資源的存取權」
• 建立 Cloud Billing 自訂角色