Create Custom Roles

In order to grant the appropriate permissions to the service account, you need to create 2 custom roles:

• TopogyBigQueryJobsRole
• TopogyReadOnlyRole

The TopogyReadOnlyRole should be created at the organization level while the TopogyBigQueryJobsRole should be created in the project you created for your BigQuery dataset.

TopogyBigQueryJobsRole

Creating the TopogyBigQueryJobsRole is a similar process to creating the TopogyReadOnlyRole, however, this role needs to be created in the Project where your BigQuery billing dataset resides. Given this role encompasses the entire project, we recommend having a dedicated project that only houses your BigQuery billing dataset (there is no way to assign the permissions we need at the dataset level).

Navigate to IAM

1. Navigate to IAM & Admin in the GCP console
2. Ensure that the project you created (likely "Billing BigQuery" if you followed our directions) for your BigQuery billing dataset is selected in the org/project selector at the top
3. Click on the "Roles" item in the left navigation
4. Click the "+ Create role" button along the top

Configure the role

5. Enter a Title: TopogyBigQueryJobsRole
6. Enter an ID: TopogyBigQueryJobsRole
7. Select "General Availability" from the dropdown for Role launch stage
8. Click the "+ Add permissions" button
9. Enter "bigquery.jobs." in the filter box
10. Select the following permissions:

bigquery.jobs.create
bigquery.jobs.get
bigquery.jobs.list

11. Click the "Add" button

12. Click the "Create" button to create the role

TopogyReadOnlyRole

The TopogyReadOnlyRole needs to be created at the Organization level. We provide 2 methods for creating the TopogyReadOnlyRole:

• CLI Script
• Manual Instructions

CLI Script

If you would like to bypass the tedium of assigning permissions to a custom role, you can use the create_topogy_readonly_role.sh bash script which leverages the Google Cloud SDK. The README provides instructions on how to use the simple bash script.

Manual Instructions

The following steps show how to create the role and assign the appropriate permissions. Adding permissions manually is a bit tedious - we recommend using the filters defined in the Filter Table to narrow the list so you can easily find the permissions you need to include in the TopogyReadOnlyRole. The basic process is as follows:

Navigate to IAM

1. Navigate to IAM & Admin in the GCP console
2. Ensure that your organization is selected in the org/project selector at the top
3. Click on the "Roles" item in the left navigation
4. Click the "+ Create role" button along the top

Configure role settings

5. Enter a Title: TopogyReadOnlyRole
6. Enter an ID: TopogyReadOnlyRole
7. Select "General Availability" from the dropdown for Role launch stage

Add permissions

8. Click the "+ Add permissions" button
9. Enter filter, such as "cloudasset.assets.exportCloudresourcemanager" in the filter box and then hit the enter button. If you do not hit the enter button, you may not see all the permissions available under the permission path. See Filter Table for list of filters and associated permissions.
10. Select the corresponding permissions
11. Click the "Add" button

12. Click the "+ Add permissions" button again
13. Enter a different filter, such as "cloudasset.assets.exportResource" and then hit the enter button (hitting enter ensures that all the permissions show up)
14. Select the appropriate permissions
15. Rinse and repeat until all permissions have been added to the TopogyReadOnlyRole (should be 20 total)
16. Once all the permissions have been added, click the "Create" button to create the role

Filter Table

Permissions

Below is the list of permissions that the TopogyReadOnlyRole needs assigned

cloudasset.assets.exportCloudresourcemanagerFolders
cloudasset.assets.exportCloudresourcemanagerOrganizations
cloudasset.assets.exportCloudresourcemanagerProjects
cloudasset.assets.exportResource
cloudasset.assets.listCloudresourcemanagerFolders
cloudasset.assets.listCloudresourcemanagerOrganizations
cloudasset.assets.listCloudresourcemanagerProjects
cloudasset.assets.listResource
cloudasset.assets.searchAllResources
compute.commitments.get
compute.commitments.list
compute.regions.list
monitoring.metricDescriptors.list
monitoring.timeSeries.list
resourcemanager.folders.get
resourcemanager.folders.list
resourcemanager.organizations.get
resourcemanager.projects.get
resourcemanager.projects.getIamPolicy
resourcemanager.projects.list

Next step: Assign roles to service account