What Permissions Does the GCP Deployment Require?
Overview
Connecting your GCP environment to Archera provisions IAM permissions and supporting resources that allow Archera to access billing data, monitor commitments, and deliver optimization recommendations. When full procurement capabilities are enabled, Archera can also place and manage GCP Marketplace commitment orders on your behalf.
Archera supports two access modes:
Visibility Only
Read-only access for monitoring, analytics, and recommendations.
Full Access (default)
Read access plus the ability to place, modify, and cancel commitment purchases through the GCP Marketplace on your behalf.
All resources are provisioned via Terraform, either directly or through GCP Infrastructure Manager. The permissions are the same regardless of installation method.
Archera service account
Archera authenticates to your GCP environment using an Archera-managed service account:
application@archera.iam.gserviceaccount.comThis service account resides in Archera's GCP project, not yours. During onboarding, the Terraform configuration grants this service account a custom IAM role at the organization level, along with specific predefined roles at the billing account level. Archera does not create any service accounts inside your organization.
If your organization enforces iam.managed.allowedPolicyMembers or iam.allowedPolicyMemberDomains constraints, you may need to add Archera's service account or customer ID (C02c8qgso) to your allow list. See Organization policy constraints.
Temporary deployment service account
When installing via GCP Infrastructure Manager, a temporary service account is created in your project to execute the Terraform deployment. This account requires broad permissions, including Owner, Organization Administrator, and Billing Admin, so that it can create the resources and bindings required by the integration.
This temporary service account is not used by Archera for ongoing operations. The deployment script removes it after deployment completes; if you run the Terraform directly, delete the temporary account once deployment is complete.
API enablement
The following APIs are enabled in your billing project during onboarding:
bigquery.googleapis.com
Run queries against your billing, pricing, and CUD export datasets.
bigquerydatatransfer.googleapis.com
Support scheduled transfer and export of billing data.
billingbudgets.googleapis.com
Access billing budget metadata.
cloudbilling.googleapis.com
Access billing account information and metadata.
cloudcommerceconsumerprocurement.googleapis.com
View and manage GCP Marketplace procurement orders.
cloudresourcemanager.googleapis.com
Read organization, folder, and project hierarchy.
config.googleapis.com
Run the Terraform deployment via Infrastructure Manager.
iam.googleapis.com
Create the custom IAM role and apply role bindings.
recommender.googleapis.com
View and manage CUD recommendations.
storage.googleapis.com
Provision the billing-data staging bucket.
storagetransfer.googleapis.com
Copy billing, pricing, and CUD data for analysis.
The Infrastructure Manager Terraform directly enables the Cloud Billing, Consumer Procurement, and Recommender APIs. The onboarding script enables the remaining APIs required to provision and operate the integration, including Infrastructure Manager, IAM, Resource Manager, BigQuery, Cloud Storage, and Storage Transfer.
Custom IAM role
A custom organization-level IAM role named archera_application is created and bound to the Archera service account.
All permissions are scoped to the minimum required for Archera's functionality and are read-only unless explicitly noted. Write permissions are only included when Visibility Only mode is disabled.
BigQuery reservations and commitments
These permissions allow Archera to view BigQuery reservation and capacity commitment details for optimization recommendations.
Compute Engine commitments and reservations
These permissions allow Archera to monitor Compute Engine committed use discounts (CUDs) and VM reservations.
Consumer Procurement orders
These permissions allow Archera to view and, in Full Access mode, manage GCP Marketplace orders.
Read permissions are always granted:
Write permissions are granted only in Full Access mode:
consumerprocurement.orderAttributions.update
Update order attribution metadata.
consumerprocurement.orders.cancel
Cancel pending or active orders.
consumerprocurement.orders.modify
Modify existing order parameters.
consumerprocurement.orders.place
Place new procurement orders.
Additional procurement roles are applied at the billing account level. See Billing account IAM permissions.
Resource Manager
These permissions allow Archera to understand your GCP organization structure for cost and commitment attribution. They do not permit modifications to your organization, folders, or projects.
Spend-based CUD recommendations
Read permissions are always granted:
Write permissions are granted only in Full Access mode:
Resource-based CUD recommendations
Read permissions are always granted:
Write permissions are granted only in Full Access mode:
Monitoring and Service Usage
These permissions are required for CUD recommendation analysis.
Billing account IAM permissions
In addition to the custom organization-level role, Archera requires predefined roles at the billing account level. Billing account roles are required because billing accounts may exist outside the organization resource hierarchy, where organization-level custom roles cannot be applied.
Read roles are always granted:
roles/consumerprocurement.orderViewer
List and view procurement orders on the billing account.
roles/billing.viewer
View CUD recommendations scoped to the billing account.
Write roles are granted only in Full Access mode:
roles/consumerprocurement.orderAdmin
Place, modify, and cancel procurement orders.
roles/billing.admin
Manage CUD recommendations for the billing account.
roles/billing.admin is broader than ideal but is required because no narrower predefined role covers CUD recommendation writes at the billing account level. This role is only granted when Full Access mode is enabled.
Cloud Storage bucket
A GCS bucket is provisioned for temporary staging of billing and pricing data before transfer to Archera's infrastructure.
Bucket name
archerastorage_{billing_account_id}
Location
US
Storage class
STANDARD
Object lifecycle
Objects are automatically deleted after 7 days.
Access control
Uniform bucket-level access; public access prevented.
The following IAM bindings are scoped to this bucket only:
roles/storage.legacyBucketOwner
Granted to the Archera service account to manage the staging bucket lifecycle.
roles/storage.legacyBucketReader
Granted to the Storage Transfer Service for bucket metadata reads.
roles/storage.objectViewer
Granted to the Storage Transfer Service for object reads during data transfers.
BigQuery permissions
Archera requires read access to the BigQuery billing export datasets configured during onboarding, including detailed usage cost, pricing, and CUD exports, to analyze spending and generate recommendations.
Project-level
roles/bigquery.jobUser
Execute BigQuery queries against billing data in the billing project only.
Dataset-level
roles/bigquery.dataViewer
Read-only access to the billing export datasets configured during onboarding, such as billing_export and billing_export_cud.
Access is scoped to the specific datasets you configure. Archera has no access to any other datasets in your project.
Security summary
Archera's GCP integration follows the principle of least privilege:
A custom IAM role at the organization level ensures only the specific permissions listed above are granted.
BigQuery access is scoped to individual billing export datasets, not the entire project.
The Cloud Storage bucket is used solely for temporary staging, with a 7-day automatic deletion rule.
All write permissions are optional and only granted when Full Access mode is enabled.
The deployment service account is temporary and is removed after installation.
Archera's application service account is externally managed. No service accounts are created inside your organization.
Troubleshooting
Organization policy constraints
If your organization enforces IAM policy member restrictions, deployment may fail with:
One or more users named in the policy do not belong to a permitted customer.
To resolve:
If
iam.managed.allowedPolicyMembersis enforced, addserviceAccount:application@archera.iam.gserviceaccount.comto theallowedMemberSubjectslist.If
iam.allowedPolicyMemberDomainsis enforced, add Archera's customer IDC02c8qgsoto theallowedValueslist.
Refer to Google's Restricting identities by domain documentation for further guidance.
Related Resources
Support
For questions about permissions or assistance with deployment, contact your Archera representative or email support@archera.ai.
Last updated
Was this helpful?