Google Cloud permissions

CloudYali reads Google Cloud with a service account you create and whose JSON key you give it. The service account needs the roles below; CloudYali never asks for an owner, editor or admin role.

Required

Role	Grant it on	Enables	Checked when you connect
BigQuery Data Viewer (roles/bigquery.dataViewer)	The billing dataset, or its project	Reading the billing export and recommendations tables	Yes
BigQuery Job User (roles/bigquery.jobUser)	The project that holds the dataset	Running the daily queries on the billing export	No
Cloud Asset Viewer (roles/cloudasset.viewer)	The organization, or the project for This project only	Resource Inventory	Yes
Browser (roles/browser)	The organization	Finding the organization and its projects	No: without it, CloudYali connects the project alone

Turn on these APIs in the project you connect: BigQuery API, Cloud Asset API and Cloud Resource Manager API.

Optional

Role	Grant it on	Enables
Monitoring Viewer (roles/monitoring.viewer)	The organization or each project	CloudYali's own rightsizing rules, which read CPU and memory metrics. Without it, those rules are skipped

Example

To connect an organization with the service account cloudyali-reader@nw-billing.iam.gserviceaccount.com and the dataset billing_data in the project nw-billing, replace ORGANIZATION_ID with your organization's numeric ID, which gcloud organizations list shows:

SA=serviceAccount:cloudyali-reader@nw-billing.iam.gserviceaccount.com
gcloud projects add-iam-policy-binding nw-billing --member="$SA" --role=roles/bigquery.jobUser
gcloud projects add-iam-policy-binding nw-billing --member="$SA" --role=roles/bigquery.dataViewer
gcloud organizations add-iam-policy-binding ORGANIZATION_ID --member="$SA" --role=roles/cloudasset.viewer
gcloud organizations add-iam-policy-binding ORGANIZATION_ID --member="$SA" --role=roles/browser

Where you see it in CloudYali

The Connected tab of Integrations shows each project and its billing export table. To connect a project, see Connect Google Cloud.