Question

Your finance team runs a nightly batch job on a Compute Engine VM that uses a dedicated service account to export billing data and read cost information via the Cloud Billing API. The job currently fails with permission errors when calling the billing API. Following the principle of least privilege, what should you do to allow the service account to view billing account information?

Accepted Answer

Grant the service account the Billing Account Viewer role (roles/billing.viewer) on the billing account.

Answer

Grant the service account the Project Owner role (roles/owner) on the project the VM runs in.

Answer

Grant the service account the Billing Account Administrator role (roles/billing.admin) on the billing account.

Answer

Grant the service account the Project Billing Manager role (roles/billing.projectManager) on the project.