Getting Started with Google Cloud Platform: A Beginner’s Guide to Cloud Excellence

📘 Chapter 4: Managing Access, IAM, and Billing in GCP

🔍 Overview

Effective access control and billing management are essential components of working with Google Cloud Platform (GCP). Without proper IAM configuration, your resources are vulnerable to misuse or compromise. Similarly, poor billing practices can lead to unexpected costs.

This chapter covers:

• The fundamentals of Identity and Access Management (IAM)
• Setting up users, roles, and permissions
• Creating service accounts for automation
• Configuring budgets, billing accounts, and alerts
• Best practices to ensure security and cost-efficiency

🧠 1. Understanding IAM in GCP

IAM lets you define who (identity) has what access (roles) to which resources.

🔹 Key Terms

🔑 Types of Principals

• Google account (user:someone@gmail.com)
• Service accounts (serviceAccount:my-sa@project.iam.gserviceaccount.com)
• Google Groups (group:devs@company.com)
• G Suite domains
• All users (allUsers) or all authenticated users (allAuthenticatedUsers)

📘 Common Roles in GCP

🛠️ 2. Assigning IAM Roles

✅ Console Steps:

1. Go to IAM & Admin → IAM
2. Click "Add"
3. Enter email and select role(s)
4. Click "Save"

✅ CLI Command:

bash

gcloud projects add-iam-policy-binding my-project-id \

  --member="user:john@example.com" \

  --role="roles/editor"

🤖 3. Service Accounts

Service accounts are non-human accounts used by apps, VMs, or APIs to access GCP resources securely.

🔹 When to Use

• VM instances needing storage access
• CI/CD pipelines deploying resources
• Cloud Functions accessing APIs

✅ Create a Service Account:

bash

gcloud iam service-accounts create my-app \

  --description="App-level service account" \

  --display-name="My App"

✅ Assign Roles:

bash

gcloud projects add-iam-policy-binding my-project-id \

  --member="serviceAccount:my-app@my-project.iam.gserviceaccount.com" \

  --role="roles/storage.objectViewer"

✅ Generate Key for External Use:

bash

gcloud iam service-accounts keys create key.json \

  --iam-account=my-app@my-project.iam.gserviceaccount.com

⚠️ Tip: Never hardcode keys into public repositories.

🔐 4. IAM Best Practices

• Follow Principle of Least Privilege: Grant only the minimum required access
• Use Predefined Roles Over Owner: Avoid using overly broad roles
• Enable MFA for Admins
• Use Custom Roles for specific access needs
• Audit IAM Changes using Cloud Audit Logs

💳 5. Understanding GCP Billing Structure

GCP uses a centralized billing model tied to your Google account.

🔹 Billing Hierarchy

🔹 Account Types

📈 6. Creating Budgets and Alerts

Stay within budget using Budgets & Alerts.

✅ Console Steps:

1. Go to Billing → Budgets & alerts
2. Click "Create Budget"
3. Set monthly limit (e.g., $20)
4. Set alert thresholds (50%, 90%, 100%)
5. Add email recipients

✅ Use CLI:

bash

gcloud billing budgets create --billing-account=XXXX \

  --display-name="Budget Alert" \

  --budget-amount=20USD \

  --threshold-rules="percent=0.5,percent=0.9,percent=1"

📄 7. Viewing Billing Reports

GCP provides detailed usage and cost reports.

🧪 8. Export Billing Data to BigQuery

Step 1: Go to Billing → Settings → Export
Step 2: Choose BigQuery Dataset
Step 3: Query data like:

sql

SELECT

  service.description,

  SUM(cost) as total_cost

FROM

  `billing_dataset.gcp_billing_export`

GROUP BY

  service.description

ORDER BY

  total_cost DESC

🧩 Summary Table – IAM and Billing Essentials