> ## Documentation Index
> Fetch the complete documentation index at: https://help.nops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Cloud Platform - Commitment Management Setup

> Configure nOps to manage GCP Committed Use Discounts (CUDs) on your behalf, including Resource-based and Spend-based commitments.

## FAQs

<AccordionGroup>
  <Accordion title="What is GCP Commitment Management?">
    GCP Commitment Management enables nOps to autonomously purchase, manage, and optimize Committed Use Discounts (CUDs) on your behalf. This includes both Resource-based CUDs (project-level) and Spend-based (Flex) CUDs (billing account-level).
  </Accordion>

  <Accordion title="What's the difference between Resource-based and Spend-based CUDs?">
    * **Resource-based CUDs**: Purchased at the project level for specific machine families. Requires CUD sharing to be enabled to apply discounts across projects.
    * **Spend-based (Flex) CUDs**: Purchased at the billing account level and automatically apply to all eligible usage across all projects.
  </Accordion>

  <Accordion title="Do I need to enable CUD sharing?">
    Yes, for Resource-based CUDs. CUD sharing is **disabled by default** in GCP and must be enabled before nOps can share purchased commitments across your projects.
  </Accordion>

  <Accordion title="Why are there two access paths (Automation Agent and nOps Support)?">
    * **Automation Agent**: A service account used by nOps for autonomous purchasing, quota management, and self-healing operations.
    * **nOps Support**: A group email provided by nOps for console access, manual overrides, dashboards, and verification.
  </Accordion>

  <Accordion title="Do I need Inform to view Commitment Inventory?">
    No. [Commitment Inventory](/optimize/commitment-inventory) is included on every nOps plan when your GCP integration is **active**. Inform is only required to **email** or **schedule** inventory reports. This CM setup is for purchasing and deeper CUD inventory reads—not for opening the Inventory page itself.
  </Accordion>
</AccordionGroup>

***

## Before You Start

**You will need these 2 values:**

| Value                      | Where to find it                                                              |
| -------------------------- | ----------------------------------------------------------------------------- |
| nOps Service Account email | [nOps Settings → Cloud Provider Integrations](https://clara.nops.io/settings) |
| nOps Support email         | nOps UI (format: `{your-client-id}-gcp-console@nops.io`)                      |

<Info>
  **Prerequisites** — Before configuring Commitment Management, ensure you have completed:

  * [GCP Integration Prerequisites](/gcp/prerequisites) — Billing export setup
  * [GCP Integration Setup](/gcp/integration-setup) — Link billing data to nOps, Domain Restricted Sharing when required, and service account permissions

  You will need the **nOps Service Account email** from your existing integration. You can find it in [nOps Settings → Cloud Provider Integrations](https://clara.nops.io/settings).
</Info>

<Tip>
  **Prefer infrastructure as code?** After completing [Step 1 (Enable CUD Sharing)](#step-1-enable-cud-sharing) and [Step 2 (Create a Dedicated CUD Project)](#step-2-create-a-dedicated-cud-project), you can use our open-source Terraform module instead of the console steps in Steps 3–7. See [Terraform setup](#terraform-setup-alternative-to-console).
</Tip>

***

## What You're Setting Up

nOps uses two identities to manage commitments on your behalf:

| Identity                               | What it does                                        |
| -------------------------------------- | --------------------------------------------------- |
| **Automation Agent** (Service Account) | Autonomous purchasing, quota fixing, self-healing   |
| **nOps Support** (nOps Email)          | Dashboard access, manual overrides, support tickets |

Both identities need roles at three scopes: Organization, Billing Account, and Project. This guide walks through each scope exactly once, granting roles for both identities at each step.

***

## Step 1: Enable CUD Sharing

CUD sharing is off by default. This must be enabled for resource-based CUD discounts to apply across projects in your billing account.

<Warning>
  **Cannot be undone from Console.** Once enabled, only Cloud Billing Support can revert it. The reverted setting takes effect at the start of the following month.
</Warning>

<Warning>
  **Spend-based CUDs** automatically apply across all projects without this step. This is only needed for resource-based CUDs.
</Warning>

<Info>
  **Required permission:** Billing Account Administrator (includes `billing.subscriptions.update`)
</Info>

<Steps>
  <Step title="Open CUD Analysis">
    Go to <strong>Billing</strong> in the GCP Console, select your billing account, and then choose <strong>CUD analysis</strong> on the left sidebar.
  </Step>

  <Step title="Open CUD Scope Settings">
    Click the 3 dots next to <strong>Purchase CUDS</strong> → <strong>CUD scope & settings</strong>.
  </Step>

  <Step title="Select CUD Scope and Settings">
    In "Resource-based CUD scope", ensure it says <strong>billing account</strong> and save.
  </Step>

  <Step title="Confirm and Enable">
    In the confirmation dialog, type <code>Enable</code> and click <strong>Enable billing account scope</strong>.
  </Step>
</Steps>

<Info>
  **Propagation:** Can take up to 24 hours. If unchanged after 24 hours, contact Cloud Billing Support.
</Info>

***

## Step 2: Create a Dedicated CUD Project

nOps purchases all resource-based commitments from a single dedicated project. With CUD sharing enabled (Step 1), discounts automatically apply across all projects in the billing account.

<Steps>
  <Step title="Create the Dedicated Project">
    Go to <strong>IAM & Admin at the org level</strong> → <strong>Go to "Manage Resources"</strong>
  </Step>

  <Step title="Enter Project Details">
    Enter the following details:

    <ul>
      <li><strong>Project name:</strong> <code>nops-cud-purchases</code> (or your preferred name)</li>
      <li><strong>Organization:</strong> Select your organization</li>
      <li><strong>Location:</strong> Select the appropriate folder or organization root</li>
    </ul>
  </Step>

  <Step title="Create the Project">
    Click <strong>Create</strong> to create the project.
  </Step>

  <Step title="Link Project to Billing Account">
    Ensure you pick your billing account you want cud purchases in. It should align with the billing account you selected for this integration.
  </Step>
</Steps>

<Info>
  **Save the Project ID** — you'll need it for Step 3 and Step 6.
</Info>

***

## Step 3: Enable Required APIs

<Steps>
  <Step title="Navigate to APIs & Services">
    Go to **APIs & Services** → **Library**
  </Step>

  <Step title="Select Project">
    Select the **`nops-cud-purchases`** project from the top dropdown
  </Step>

  <Step title="Enable Required APIs">
    Click **Enable** for each of the following APIs:
  </Step>
</Steps>

| API                                     | Service ID                                        | Purpose                                  |
| --------------------------------------- | ------------------------------------------------- | ---------------------------------------- |
| Compute Engine API                      | `compute.googleapis.com`                          | Purchase resource-based CUDs             |
| Cloud Commerce Consumer Procurement API | `cloudcommerceconsumerprocurement.googleapis.com` | Purchase spend-based (Flex) CUDs         |
| Cloud Asset API                         | `cloudasset.googleapis.com`                       | Asset inventory and export               |
| Cloud Quotas API                        | `cloudquotas.googleapis.com`                      | Auto-fix quotas before purchasing        |
| Service Usage API                       | `serviceusage.googleapis.com`                     | Service quota management                 |
| Recommender API                         | `recommender.googleapis.com`                      | CUD recommendations and savings analysis |

## Step 4: Create the Custom Role (Organization Level)

Below are the permissions you will grant to the nOps Custom Role

| Permission                             | Description                                                     |
| -------------------------------------- | --------------------------------------------------------------- |
| compute.commitments.create             | Create compute commitments                                      |
| compute.commitments.get                | Get compute commitments                                         |
| compute.commitments.list               | List compute commitments                                        |
| compute.commitments.update             | Update compute commitments                                      |
| compute.commitments.updateReservations | Update compute reservations                                     |
| compute.regionOperations.get           | Get compute region operations                                   |
| compute.reservations.list              | List reservations (attach to Local SSD / GPU commitments)       |
| compute.reservations.get               | Get a reservation (attach to Local SSD / GPU commitments)       |
| compute.reservations.create            | Attach existing reservations at commitment creation             |
| serviceusage.quotas.get                | Get service usage quotas                                        |
| serviceusage.quotas.update             | Update service usage quotas                                     |
| serviceusage.services.get              | Get service usage services                                      |
| serviceusage.services.list             | List service usage services                                     |
| serviceusage.services.use              | Use services (required for Procurement API billing attribution) |
| cloudquotas.quotas.get                 | Get cloud quotas                                                |
| cloudquotas.quotas.update              | Update cloud quotas                                             |
| cloudasset.assets.exportResource       | Export cloud asset resources                                    |
| monitoring.timeSeries.list             | List monitoring time series                                     |

<Steps>
  <Step title="Navigate to Roles">
    Go to <strong>IAM & Admin</strong> → <strong>Roles</strong>
  </Step>

  <Step title="Select Organization">
    Select your <strong>Organization</strong> from the top dropdown
  </Step>

  <Step title="Create Role">
    Click <strong>+ Create Role</strong> on the top menu bar
  </Step>

  <Step title="Set Role Details">
    Set:

    <ul>
      <li><strong>Title:</strong> <code>nOps Resource Manager</code></li>
      <li><strong>Description:</strong> <code>Least-privilege role for nOps to manage Compute Commitments, Quotas, and Service Usage</code></li>
      <li><strong>ID:</strong> <code>nOpsResourceManager</code></li>
      <li><strong>Role launch stage:</strong> General Availability</li>
    </ul>
  </Step>

  <Step title="Add Permissions">
    Click <strong>Add Permissions</strong> → <strong>Import</strong>

    Click the <strong>Enter property name or value</strong> text box and paste in the first permission in the list above

    Select the <strong>Checkbox</strong> next to the permission and click <strong>Add</strong>

    Click the <strong>blue X</strong> next to the permission name you pasted in the <strong>Enter property name or value</strong> text box to remove the filter

    Repeat for each of the permissions in the list above
  </Step>

  <Step title="Create the Role">
    When you have finished adding all permissions, click <strong>Create</strong> to create the role.
  </Step>
</Steps>

***

## Step 5: Organization IAM (Grant Roles to Both Identities)

While you're still at the Organization level in IAM:

<Steps>
  <Step title="Navigate to IAM">
    Go to <strong>IAM & Admin</strong> → <strong>IAM</strong>
  </Step>

  <Step title="Confirm Organization">
    Confirm your <strong>Organization</strong> is selected in the top dropdown
  </Step>
</Steps>

### Grant access to the Automation Agent (Service Account)

<Steps>
  <Step title="Grant access to the Automation Agent (Service Account)">
    Click **+ Grant Access**
  </Step>

  <Step title="Enter nOps Service Account email">
    Enter the nOps Service Account email in **New principals**
  </Step>

  <Step title="Add roles">
    Add roles:

    <ul>
      <li>**Cloud Asset Viewer** (`roles/cloudasset.viewer`)</li>
      <li>**Browser** (`roles/browser`)</li>
      <li>**Recommender Viewer** (`roles/recommender.viewer`)</li>
      <li>**Cloud SQL Viewer** (`roles/cloudsql.viewer`)</li>
      <li>**Cloud Run Viewer** (`roles/run.viewer`)</li>
      <li>**Compute Recommender Viewer** (`roles/recommender.computeViewer`)</li>
      <li>*(Paid support plan only)* **Cloud Support Tech Support Editor** (`roles/cloudsupport.techSupportEditor`)</li>
    </ul>
  </Step>

  <Step title="Save">
    Click **Save**
  </Step>
</Steps>

### Grant access to nOps Support

<Steps>
  <Step title="Grant access to nOps Support">
    Click **+ Grant Access**
  </Step>

  <Step title="Enter nOps Support email">
    Enter the nOps Support email in **New principals**
  </Step>

  <Step title="Add roles">
    Add roles:

    <ul>
      <li>**Browser** (`roles/browser`)</li>
      <li>**Compute Viewer** (`roles/compute.viewer`)</li>
      <li>*(Paid support plan only)* **Cloud Support Tech Support Editor** (`roles/cloudsupport.techSupportEditor`)</li>
    </ul>
  </Step>

  <Step title="Save">
    Click **Save**
  </Step>
</Steps>

<Warning>
  **No paid support plan?** Skip the `techSupportEditor` role for both identities. You can still contact Cloud Billing Support for CUD-related issues at no cost.

  To check your plan: **Support** → **Overview** → look for "Your current Customer Care service."
</Warning>

***

## Step 6: Project IAM (Grant Roles to Both Identities)

<Steps>
  <Step title="Navigate to IAM">
    Go to **IAM & Admin** → **IAM**
  </Step>

  <Step title="Select Project">
    Select the **`nops-cud-purchases`** project from the top dropdown
  </Step>
</Steps>

### Grant access to the Automation Agent (Service Account)

<Steps>
  <Step title="Grant access to the Automation Agent (Service Account)">
    Click **+ Grant Access**
  </Step>

  <Step title="Enter nOps Service Account email">
    Enter the nOps Service Account email in **New principals**
  </Step>

  <Step title="Add roles">
    Add roles:

    <ul>
      <li>**Compute Viewer** (`roles/compute.viewer`)</li>
      <li>**nOps Resource Manager** (the custom role from Step 3)</li>
    </ul>
  </Step>

  <Step title="Save">
    Click **Save**
  </Step>
</Steps>

### Grant access to nOps Support

<Steps>
  <Step title="Grant access to nOps Support">
    Click **+ Grant Access**
  </Step>

  <Step title="Enter nOps Support email">
    Enter the nOps Support email in **New principals**
  </Step>

  <Step title="Add roles">
    Add roles:

    <ul>
      <li>**Compute Viewer** (`roles/compute.viewer`)</li>
    </ul>
  </Step>

  <Step title="Save">
    Click **Save**
  </Step>
</Steps>

***

## Step 7: Billing Account IAM (Grant Roles to Both Identities)

<Steps>
  <Step title="Navigate to Billing Account Management">
    Go to **Billing** → select your billing account → **Account Management**
  </Step>

  <Step title="Show info panel">
    Click **Show info panel** in the top-right corner
  </Step>
</Steps>

### Grant access to the Automation Agent (Service Account)

<Steps>
  <Step title="Grant access to the Automation Agent (Service Account)">
    Click **+ Add Principal**
  </Step>

  <Step title="Enter nOps Service Account email">
    Enter the nOps Service Account email in **New principals**
  </Step>

  <Step title="Add roles">
    Add roles:

    <ul>
      <li>**Billing Account Viewer** (`roles/billing.viewer`)</li>
      <li>**Consumer Procurement Order Admin** (`roles/consumerprocurement.orderAdmin`)</li>
      <li>**Recommender Billing Account CUD Admin** (`roles/recommender.billingAccountCudAdmin`)</li>
    </ul>
  </Step>

  <Step title="Save">
    Click **Save**
  </Step>
</Steps>

### Grant access to nOps Support

<Steps>
  <Step title="Grant access to nOps Support">
    Click **+ Add Principal**
  </Step>

  <Step title="Enter nOps Support email">
    Enter the nOps Support email in **New principals**
  </Step>

  <Step title="Add roles">
    Add roles:

    <ul>
      <li>**Billing Account Viewer** (`roles/billing.viewer`)</li>
      <li>**Recommender Billing Account CUD Viewer** (`roles/recommender.billingAccountCudViewer`)</li>
    </ul>
  </Step>

  <Step title="Save">
    Click **Save**
  </Step>
</Steps>

***

## Terraform Setup (Alternative to Console)

If you manage GCP with **Terraform** or **OpenTofu**, you can provision everything in Steps 3–7—the required APIs, the nOps Resource Manager custom role, and the organization-, project-, and billing account-level IAM bindings for both identities—using the official nOps module. Use this path **instead of** the manual console instructions in [Step 3](#step-3-enable-required-apis) through [Step 7](#step-7-billing-account-iam-grant-roles-to-both-identities).

**Repository:** [nops-io/terraform-gcp-nops-commitment-management](https://github.com/nops-io/terraform-gcp-nops-commitment-management)

Complete these steps first — they cannot be done with the module:

1. [Step 1: Enable CUD Sharing](#step-1-enable-cud-sharing) — a billing account setting that must be changed in the Console
2. [Step 2: Create a Dedicated CUD Project](#step-2-create-a-dedicated-cud-project) — the module configures an **existing** CUD purchase project; note the Project ID for the module input

Then configure the module inputs with your organization ID, billing account ID, CUD purchase project ID, and the **nOps Service Account email** and **nOps Support email** from nOps. Follow the README in the repository for the full list of variables, the `examples/basic` layout, and how to run `terraform apply` or `tofu apply`.

<Info>
  The repository README is the source of truth for Terraform inputs and optional settings (such as the Cloud Support Tech Support Editor role for paid support plans). If anything conflicts with this guide, follow the module documentation for Terraform-specific behavior.
</Info>

***

## Related Guides

<CardGroup cols={2}>
  <Card title="Prerequisites" icon="list-check" href="/gcp/prerequisites">
    Configure billing exports and prepare your GCP environment.
  </Card>

  <Card title="Integration Setup" icon="plug" href="/gcp/integration-setup">
    Link GCP billing data and grant service account permissions.
  </Card>

  <Card title="Permissions and Resources - Savings Analysis" icon="shield-check" href="/gcp/permissions-and-resources-sa">
    Overview of all permissions and resources needed for Savings Analysis.
  </Card>

  <Card title="Permissions and Resources - Commitment Management" icon="shield-check" href="/gcp/permissions-and-resources-cm">
    Overview of all permissions and resources needed for Commitment Management.
  </Card>
</CardGroup>