Skip to main content

​
FAQs

  • Ensure that Billing Export is enabled for the correct project.
  • Check if the dataset and table names match what was configured in nOps.
  • Wait up to 48 hours for the first full dataset to appear.
No, Google Cloud only supports Google-managed encryption for billing data exports.
Billing data is refreshed daily, but there might be a 48-hour delay for full updates.
The tables under the Detailed Usage Cost and Pricing exports may take up to 48 hours to be created.
Yes. The Detailed Usage Cost and Pricing exports must be configured to use the same location (US or EU) and preferably the same project. Using different locations will cause integration issues with nOps.
Each level provides different types of access:
  • Organization-level role (Compute Viewer) allows nOps to list resource-based commitment objects across your organization.
  • Billing Account-level role is required to access billing metadata, currency information, and CUD recommendations at billing scope. This cannot be granted at the project level.
  • Project-level roles provide access to the BigQuery dataset containing your cost export data.
Granting roles only at one level will result in incomplete data or integration failures.Note: Additional organization-level roles for full resource analysis (Cloud Asset Viewer, Cloud SQL Viewer, Cloud Run Viewer, Compute Recommender Viewer) are configured during the Commitment Management setup, keeping the initial onboarding minimal.

​
Overview

Before proceeding, ensure you have completed the GCP Integration Prerequisites including:
  • Checking if billing exports are already enabled
  • Configuring GCP billing exports (if not already enabled)
If your organization uses Domain Restricted Sharing, review Domain Restricted Sharing below before granting IAM roles to the nOps service account.
Prefer infrastructure as code? After you create the GCP integration in nOps and copy the nOps service account email, you can use our open-source Terraform module instead of the console steps under Finding Your BigQuery Dataset IDs, Section 3, and Section 4. See Terraform setup.

​
1. Domain Restricted Sharing

The nOps GCP integration wizard includes a Domain Restricted Sharing step that you must review before proceeding. If your organization has DRS enabled, you need to add the nOps Customer ID to your allowed domains before granting any IAM roles. If DRS is not enabled, you can confirm and continue without any changes.
If your GCP organization has Domain Restricted Sharing enabled (via the iam.allowedPolicyMemberDomains constraint), you will encounter an error when trying to grant IAM roles to the nOps service account:
This security policy restricts which external identities can be granted IAM roles in your organization. To allow the nOps service account, you need to add the nOps Google Workspace Customer ID to your organization’s allowed domains list.
To modify organization policies, you need the Organization Policy Administrator (roles/orgpolicy.policyAdmin) IAM role on the organization. Contact your GCP administrator if you don’t have this role.

​
Checking and Configuring Domain Restricted Sharing

During GCP onboarding, the integration wizard shows the Domain Restricted Sharing section in Step 1 so you can confirm whether DRS applies and act on it before granting permissions. To check whether DRS is enabled in your organization:
1

Open the GCP Integration Wizard

Go to nOps Settings → Cloud Provider Integrations and click the Google Cloud Platform card.
2

Review the Domain Restricted Sharing section

In Step 1 of the wizard, the Domain Restricted Sharing section displays the nOps Customer ID with a copy button. Check whether your GCP organization has the iam.allowedPolicyMemberDomains policy enabled before proceeding.
If DRS is enabled, add the nOps Customer ID to your allowed domains:
1

Go to Organization Policies

Navigate to IAM & Admin → Organization Policies in the Google Cloud Console.
2

Select Organization

Select your Organization from the project/organization selector at the top.
3

Find the Domain Restricted Sharing Policy

Search for and select the policy Domain restricted sharing (iam.allowedPolicyMemberDomains).
4

Manage Policy

Click Manage Policy.
5

Add Value

Under Policy values, click Add value.
6

Enter nOps Customer ID

Enter the nOps Customer ID (copy it from the GCP integration wizard in nOps).
7

Save

Click Save.
If DRS is not enabled, no changes are needed. Continue with the next section to link your billing data to nOps.
Once billing exports are configured in GCP, connect them to nOps using the integration wizard.
1

Open Cloud Provider Integrations

Log in to nOps and go to Settings → Cloud Provider Integrations. Scroll down to the Add a provider section and click the Google Cloud Platform card.
2

Step 1: Configure Billing Exports and Name Your Integration

The Connect Google Cloud Platform dialog opens at Step 1 of 2. This step includes two required sections to review before continuing: The wizard displays the nOps Customer ID here. If your GCP organization has the iam.allowedPolicyMemberDomains policy enabled, add this Customer ID to your allowed domains now (see Domain Restricted Sharing). If DRS is not enabled in your organization, no action is needed. Detailed Usage Cost, Pricing, and Committed Use Discounts must all be enabled. See Prerequisites if you have not configured them yet.Enter an Integration Name (e.g., “My Organization GCP Integration 1”) and click Next.
3

Step 2: Enter Billing Account ID and Dataset IDs

On Step 2 of 2, enter the following: Format: XXXXXX-XXXXXX-XXXXXX (e.g., 0115B9-C18400-A979DC) Format: project.dataset.table or project.dataset Format: project.dataset.table or project.dataset Format: project.dataset.table or project.dataset Format: project.dataset.table or project.dataset. Leave this blank if you have not enabled the FOCUS billing export.Use the How to find links next to each field for guidance on locating these values.
4

Create the Integration

Click Create Integration. nOps will provision a service account for your GCP integration. Copy the service account email. You will need it in the next sections to grant permissions.
If the Detailed Usage Cost and Pricing exports share the same BigQuery dataset, you can use the same Dataset ID for both fields.
FOCUS is an open standard that presents your cost and usage data in a common format across cloud providers. It is optional in nOps. Unlike the other exports, Google creates and names the FOCUS dataset for you: it is called gcp_billing_immutable_<BILLING_ACCOUNT_ID>_<LOCATION> (with dashes in your billing account ID replaced by underscores) and lives in the project you chose when you turned the export on. You can add it later from Settings → Cloud Provider Integrations if you enable the export after connecting.

​
Finding Your Billing Account IDs

1

Navigate to Billing

Go to Billing in the GCP Console. From the billing accounts list, click on the billing account name.
2

Copy Billing Account ID

Copy the Billing Account ID from the URL. The format is XXXXXX-XXXXXX-XXXXXX (e.g., 0115B9-C18400-A979DC).

​
Finding Your BigQuery Dataset IDs

1

Navigate to Billing Export

Go to Billing in the GCP Console. From the billing accounts list, click on the billing account name. Select Billing Export from the left-hand menu.Each enabled export lists its dataset here. If you turned on the FOCUS export, its dataset is the Google-managed gcp_billing_immutable_<BILLING_ACCOUNT_ID>_<LOCATION>.
2

Open Dataset in BigQuery

Click on the Dataset name link for the first export (e.g., Detailed Usage Cost). This will open BigQuery with that dataset selected.
3

Manage Permissions

In BigQuery, click on the three vertical dots next to the dataset name in the left panel. Hover over Share and select Manage permissions.
4

Grant BigQuery Data Viewer Role

  1. In the permissions panel, click Add Principal.
  2. In the New principals field, enter the nOps service account email.
  3. In the Select a role dropdown, choose BigQuery Data Viewer (roles/bigquery.dataViewer).
  4. Click Save.
  5. Repeat for each distinct export dataset, including the FOCUS dataset (gcp_billing_immutable_<BILLING_ACCOUNT_ID>_<LOCATION>) if you enabled that export.

​
3. Grant Service Account Permissions in GCP

Once the nOps service account email is generated, grant it the required permissions in the Google Cloud Console, unless you are using Terraform setup. Permissions must be granted at three different levels: Organization, Billing Account, and Project.
The nOps service account requires permissions at multiple levels. Granting roles only at the project level will not provide sufficient access for full cost visibility and recommendations.
If your GCP organization has Domain Restricted Sharing enabled, you must add the nOps Customer ID to your allowed domains before granting any of the permissions below, or the role assignments will fail. The nOps Customer ID is shown in Step 1 of the integration wizard. See Domain Restricted Sharing above for detailed instructions.

​
A. Organization-Level Roles (Savings Analysis)

For the initial savings analysis setup, three organization-level roles are required. Additional roles for full resource analysis are configured later during Commitment Management setup. Required Roles:
1

Navigate to Organization IAM

Go to IAM & Admin → IAM in the Google Cloud Console.
2

Switch to Organization

At the top of the page, use the project/organization selector to switch to your Organization (not a specific project).
3

Grant Access to nOps Service Account

Click + Grant Access. In the New principals field, enter the nOps service account email (obtained from the integration setup). Add the following roles:
  • Compute Viewer (roles/compute.viewer)
  • Recommender Viewer (roles/recommender.viewer)
  • Browser (roles/browser) Click Save.

​
B. Billing Account-Level Role

This role is required for currency and billing metadata validation. It must be granted directly on the Billing Account. Required Role: Billing Account Viewer (roles/billing.viewer)
Permissions granted in the standard Project IAM page do not propagate to the Billing Account. You must grant this role via the Billing console or gcloud CLI.
1

Navigate to Billing Account Management

Go to Billing in the Google Cloud Console. From the billing accounts list, click on the billing account name that you configured the exports for. Click Account Management in the left-hand menu.
2

Open the Info Panel

On the Account Management page, click Show info panel in the top-right corner (if the panel is not already visible). This will open a side panel titled with your billing account name.
3

Grant Billing Account Viewer Role

In the info panel on the right, click + Add Principal. In the New principals field, enter the nOps service account email. Select the role: Billing Account Viewer (roles/billing.viewer). Click Save.

​
C. Dataset-Level Roles (Cost Export Datasets)

These roles are required for reading BigQuery billing data and must be granted on each dataset that contains your cost export data:
  • Detailed Usage Cost dataset
  • Pricing dataset
  • Committed Use Discounts dataset
  • FOCUS dataset: only if you entered a FOCUS Dataset ID
Required Role: BigQuery Data Viewer (roles/bigquery.dataViewer)
If you configured all exports to use the same dataset, you only need to grant the permissions once on that shared dataset.
1

Navigate to Billing Export

Go to Billing in the GCP Console. From the billing accounts list, click on the billing account name. Select Billing Export from the left-hand menu.
2

Open Dataset in BigQuery

Click on the Dataset name link for the first export (e.g., Detailed Usage Cost). This will open BigQuery with that dataset selected.
3

Manage Permissions

In BigQuery, click on the three vertical dots next to the dataset name in the left panel. Hover over Share and select Manage permissions.
4

Grant BigQuery Data Viewer Role

  1. In the permissions panel, click Add Principal.
  2. In the New principals field, enter the nOps service account email.
  3. In the Select a role dropdown, choose BigQuery Data Viewer (roles/bigquery.dataViewer).
  4. Click Save.
5

Repeat for Other Datasets (if different)

If your Pricing, Committed Use Discounts, or FOCUS exports use different datasets, go back to the Billing Export page and repeat Steps 2-4 for each additional export dataset. The FOCUS dataset is always separate, because Google creates it for you.

​
D. Project-Level Service Usage Role

The Service Usage Consumer role must be granted on the project that hosts your billing exports. Required Role: Service Usage Consumer (roles/serviceusage.serviceUsageConsumer)
1

Navigate to IAM

Go to IAM & Admin → IAM in the Google Cloud Console.
2

Select Project

Select the project that hosts your billing exports (where your BigQuery billing export dataset is located).
3

Grant Service Usage Consumer Role

Click + Grant Access. In the New principals field, enter the nOps service account email. Select the role: Service Usage Consumer (roles/serviceusage.serviceUsageConsumer). Click Save.

​
E. Project-Level BigQuery Resource Viewer Role (Optional)

This role is only required if your organization uses flat-rate or reservation-based BigQuery pricing. Most customers use on-demand pricing and can skip this section.How to check: Go to BigQuery → Administration → Reservations in the GCP Console. If you see reservations or capacity commitments configured, you need this role.
The BigQuery Resource Viewer role allows nOps to read BigQuery reservation and slot information for capacity planning and cost optimization of flat-rate BigQuery workloads. Role: BigQuery Resource Viewer (roles/bigquery.resourceViewer)
1

Navigate to IAM

Go to IAM & Admin → IAM in the Google Cloud Console.
2

Select Project

Select the project that contains your BigQuery billing export dataset.
3

Grant BigQuery Resource Viewer Role

Click + Grant Access. In the New principals field, enter the nOps service account email. Select the role: BigQuery Resource Viewer (roles/bigquery.resourceViewer). Click Save.

​
4. Enable Required APIs

Enable the following APIs in the Google Cloud Console to allow nOps to collect cost and usage data for savings analysis, unless you are using Terraform setup, which can enable them for you. APIs only need to be enabled in the project that hosts your billing exports, not across all projects. Required APIs (Savings Analysis):
Additional APIs for full resource analysis (Cloud Asset API, Cloud Quotas API, Compute Engine API) are enabled during Commitment Management setup.
Optional APIs:
1

Navigate to APIs & Services

Go to APIs & Services → Library in the Google Cloud Console.
2

Select Project

Select the project that hosts your billing exports from the top dropdown menu.
3

Enable Required APIs

Click Enable for each of the following APIs:
  • Cloud Billing API (cloudbilling.googleapis.com)
  • Recommender API (recommender.googleapis.com)
Optional: Only enable the BigQuery Reservation API if you use flat-rate or reservation-based BigQuery pricing. Most customers use on-demand pricing and can skip this.

​
Terraform Setup (Alternative to Console)

If you manage GCP with Terraform or OpenTofu, you can provision the organization-, billing-, project-, and BigQuery dataset-level IAM bindings for the nOps service account, and enable the required APIs on your billing export project, using the official nOps module. Use this path instead of the manual console instructions under Finding Your BigQuery Dataset IDs (BigQuery Data Viewer), Section 3, and Section 4. Repository: nops-io/terraform-gcp-nops-integration Complete the same prerequisites and nOps-side steps first:
  1. GCP Integration Prerequisites (including billing exports)
  2. Domain Restricted Sharing, if it applies to your organization
  3. Section 2: create the integration in nOps, enter your billing export details, and copy the nOps service account email. The module uses this as an input
Follow the README in the repository for variables (for example organization ID, service account email, and billing account / dataset configuration), the examples/basic layout, and how to run terraform apply or tofu apply.
The repository README is the source of truth for Terraform inputs and optional settings. If anything conflicts with this guide, follow the module documentation for Terraform-specific behavior.

​
Next Steps

Once the basic integration is configured, you can optionally enable Commitment Management for automated CUD purchasing:

GCP Commitment Management Setup

Configure nOps to manage GCP Committed Use Discounts (CUDs) on your behalf, including Resource-based and Spend-based commitments.

Prerequisites

Configure billing exports and prepare your GCP environment.

Commitment Management Setup

Configure automated CUD purchasing and nOps support team access.

Permissions and Resources - Savings Analysis

Overview of all permissions and resources needed for Savings Analysis.

Permissions and Resources - Commitment Management

Overview of all permissions and resources needed for Commitment Management.