This document describes how to configure access permissions forCloud Billing accounts.

A Cloud Billing account is set up in Google Cloud and defines whopays for a given set of Google Cloud resources andGoogle Maps Platform APIs. A Cloud Billing account is connected to aGoogle payments profile. Access permissions for Cloud Billing andGoogle payments are configured in two different systems depending on what typeof access you want to provide.

If you need to configure access permissionsfor a Google payments profile, seeManage Google payments users, permissions, and notification settings.

Note: Changing access permissions for Cloud Billing accounts is considered a sensitive action; in some cases, you might need to reauthenticate before you can initiate the action. For more information, seeSensitive actions.

Cloud Billing account user permissions

Each Cloud Billing account needs at least oneBilling Account Administrator.By default, the person who creates the Cloud Billing account is aBilling Account Administrator for that billing account. For redundancy, werecommend that you configure more than one administrator on eachCloud Billing account.

You can grant different levels of access to billing accounts to your users,depending on what they need to do (for example, track spend, review costanomalies, manage budgets, optimize costs, or review and pay invoices).

You don't directly give users permissions; instead, you grant themroles,which have one or more permissions bundled within them. You can grant one ormore roles on the same resource.

If you have an organization associated with your Google Cloud account,you can grant or limit access to Cloud Billing by setting anIAM policy at the organization level. You can also setCloud Billing IAM policy on the Cloud Billingaccount level or limit billing access to a folder or project level.

Before you begin

Familiarize yourself with the roles and permissions available inCloud Billing.

• For information on predefined billing roles and their permissions, seeCloud Billing access control & permissions.
• If the permissions available in thepredefined roles don't fit your needs, create and use custom roles thatgrant more specific sets of permissions. For more information, seeCreate custom roles for billing.

Permissions required for this task

To manage user permissions on a Cloud Billing account, you need arole that includes the followingpermissions on your Cloud Billing account:

• billing.accounts.getIamPolicy -To view roles on account, including associated usernames.
• billing.accounts.setIamPolicy -To grant roles to principals on a Cloud Billing account.

To gain this permission using a predefined role, ask your administrator togrant you the following role on the Cloud Billing account:

• Billing Account Administrator

Update user permissions for a Cloud Billing account

To review, add, or remove Cloud Billing permissions:

1. Sign in to theManage billing accounts page in the Google Cloud console.

   Sign in to Manage billing accounts

2. Select the row of a Cloud Billing account to view the principalsand permissions for the billing account in the info panel. Ifthe panel isn't already visible, clickShow info panel to open it.

Alternatively, you can access a Cloud Billing account's permissionson itsAccount management page:

1. In the Google Cloud console, go to theAccount management page forthe Cloud Billing account.

   Go to Account management in Cloud Billing

2. At the prompt, choose the Cloud Billing account thatyou want to view.

3. In theInfo panel, review and edit thePrincipals andPermissions for the selected Cloud Billing account. Ifthe panel isn't already visible, clickShow info panel to open it.

ThePermissions panel is organized by role, along with the number ofprincipals that have each role. For example, in your permissions panel, youmight see

• Billing Account Administrator (2 principals)
• Billing Account User (6 principals)
• Billing Account Viewer (10 principals)

You can grant multiple roles to the same principal.

To view the list of principals assigned to a role, expand therolenode.

To find a specific principal and see which roles are granted to thatprincipal, use thefilter_listFilter and enter the email address of the principal.

To update Cloud Billing permissions, in thePermissions panel,do any of the following:

• To add new principals and assign permissions:

  1. ClickAdd principal.
  2. In theNew principals field, enter one or more email addresses for theprincipals you want to add. You can add individuals, service accounts, orGoogle Groups as principals.
  3. Select a permission for the principals fromSelect a role.
  4. If needed, you canAdd another role to grant additional permissionsto the principals.
  5. When done, clickSave.

• To edit a principal's billing permissions:

  1. Use thefilter_listFilter to locate a specific principal or role.
  2. In the list, locate the principal you want to edit.

  3. In the principal's row, clickEditedit.

     TheEdit permissions panel opens, specific to the selected principaland resource (Cloud Billing account) that you're viewing.

  4. In theEdit permissions panel, add, edit, and delete roles for theselected principal and resource.

  5. When done, clickSave.

• To revoke a role from a principal:

  1. Use thefilter_listFilter to locate a specific principal or role.
  2. In the list, locate the principal whose role you want to revoke.
  3. In the principal's row, clickDeletedelete.

  4. Confirm your action.

     Note: This action revokes only a single role. The principal retains theirother roles.

Google payments user permissions

Each Google payments account needs at least oneAdmin with all permissions,and onePrimary Contact (the person Google will contact with any payments-relatedalerts or questions). By default, the person who creates the Google paymentsaccount is both theAdmin with all permissions, and thePrimary Contact.For redundancy, we recommend that you set more than one Google paymentsadministrator.

You can add users to any Google paymentsbusiness profileyou manage, and grant different levels of access to your users depending onwhat they need to do (for example, manage payment methods orpayments profile details). You can also configure user emailpreferences for receiving billing and payments emails.

For more information, seeManage Google payments users, permissions, and notification settings.

Related topics

• Manage Google payments users, permissions, and notification settings
• Create custom roles for Cloud Billing
• Cloud Billing API access control
• Granting, changing, and revoking Access

Try it for yourself

If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

Get started for free