Connecting a GCP account

Overview

To connect your GCP environment to DigiUsher, you create a service account. This account needs read-only access to your billing, resource, and metrics data. This page gives the permissions, the reason for each permission, and the credentials that you enter in DigiUsher.

Summary of Access Required

DigiUsher cannot create, change, or delete a GCP resource.

If the policies of your organization need a setup by hand, use the manual steps on this page.

Prerequisites

Information to Gather

Roles Required by the Person Performing Setup

Option A: Terraform (Recommended)

The DigiUsher Terraform configuration does the full setup in approximately 5 minutes.

git clone https://github.com/digiusher/digiusher-iac.git
cd digiusher-iac/gcp

cp terraform.tfvars.org-level.example terraform.tfvars
# Edit terraform.tfvars with your Organization ID, Billing Account ID, and Project ID

terraform init
terraform plan
terraform apply

Terraform Feature Flags

Every flag is true by default. To remove one kind of access, set its flag to false in terraform.tfvars.

After Terraform Apply

terraform output -raw service_account_key | base64 -d > digiusher-key.json

The digiusher-iac README is the full Terraform documentation. It gives the parameters, the feature flags, and the troubleshooting steps.

Option B: Manual Setup

Use these steps for a setup with the GCP Console or the gcloud CLI.

gcloud services enable \
  bigquery.googleapis.com \
  cloudbilling.googleapis.com \
  cloudresourcemanager.googleapis.com \
  iam.googleapis.com \
  cloudasset.googleapis.com \
  recommender.googleapis.com \
  compute.googleapis.com \
  sqladmin.googleapis.com \
  monitoring.googleapis.com \
  --project=<PROJECT_ID>

Connect in DigiUsher

After you complete Option A or Option B, go to Connectors > Add Source and select Google Cloud Platform. On the Configure step, enter the values in the table, then click Review. On the Connect step, click Connect source.

Setup Checklist

• APIs enabled in the hosting project
• Service account digiusher-finops created with JSON key
• BigQuery dataset created (or existing dataset identified)
• Billing Account Viewer role assigned on billing account
• Organization-level roles assigned (Browser, Tag Viewer, Cloud Asset Viewer, Recommender Viewer, Compute Viewer, Cloud SQL Viewer, BigQuery Resource Viewer, Monitoring Viewer)
• BigQuery Job User, BigQuery Read Session User, and Service Usage Consumer assigned on the hosting project
• BigQuery Data Viewer assigned on the billing export dataset
• Detailed usage cost billing export enabled (pointing to the dataset)
• Pricing billing export enabled (pointing to the same dataset)
• Credentials entered into the DigiUsher platform
• *.digiusher.com in the allowlist of the network and the firewall (if your organization restricts this)
• digiusher.com in the allowlist for incoming email (if your organization restricts this)

Security

What DigiUsher CAN Access (Read-Only)

• The billing data and the cost data in BigQuery
• The resource metadata, such as names, types, regions, labels, and tags
• The utilization metrics for CPU, memory, network, and disk, in Cloud Monitoring
• The optimization recommendations of the Recommender API of Google
• The information about the CUDs and the reservations
• The hierarchy of the organization, the folders, and the projects

What DigiUsher CANNOT Do

• Create, change, or delete a GCP resource
• Read application data, databases, or the content of your storage
• Change an IAM policy or a permission
• Read secrets, credentials, or encryption keys
• Read network traffic or the content of your logs
• Buy a product or change the billing configuration
• Read a BigQuery dataset that is not the billing export dataset

Scope Controls

• To limit the access to selected projects, and not to the whole organization, set target_project_ids in Terraform
• The BigQuery access always covers the billing export dataset only, also with access to the whole organization
• The Billing Viewer role covers one billing account only

Monitoring

To monitor the activity of the service account, open GCP Console > IAM & Admin > Audit Logs and filter by the principal digiusher-finops@<PROJECT_ID>.iam.gserviceaccount.com.

Credential Rotation

• With Terraform, run terraform apply -replace="google_service_account_key.digiusher".
• By hand, open the service account and click Keys > Add Key to create a new key. Then delete the old key, and enter the new key in the DigiUsher platform.

Revocation

• With Terraform, run terraform destroy. It removes the service account and all IAM bindings, and it invalidates the key.
• By hand, delete the service account digiusher-finops in IAM & Admin > Service Accounts. GCP then immediately invalidates the key and all its IAM bindings.
• The revocation does not disable the APIs. This prevents a fault in your other workloads.

Troubleshooting

Cannot find Organization ID

gcloud organizations list

If the result is empty, your GCP account has no organization. An organization needs Google Workspace or Cloud Identity. Write to your GCP administrator.

"Permission denied" when assigning roles

For the roles at the level of the organization you need Organization Administrator. For the billing roles you need Billing Account Administrator. This command gives your roles:

gcloud organizations get-iam-policy <ORG_ID> \
  --flatten="bindings[].members" \
  --filter="bindings.members:user:<YOUR_EMAIL>" \
  --format="table(bindings.role)"

BigQuery dataset already exists

Use the dataset that exists. Make sure that it is in a multi-region location, US or EU. Then give the role BigQuery Data Viewer to the service account on that dataset.

No billing data after 48 hours

1. Make sure that the billing export shows "Enabled" in Billing > Billing export.
2. Make sure that the dataset location is multi-region, US or EU.
3. Make sure that Detailed usage cost is enabled. The Standard export alone is not sufficient.
4. Make sure that you selected the correct billing account.

"API not enabled" errors

Make sure that all APIs from Step 1 are enabled. An API needs a few minutes to become active.

Need Help?

If this page does not answer your question, write to DigiUsher support at support@digiusher.com. The team will help you.