> ## Documentation Index
> Fetch the complete documentation index at: https://help.nops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Cloud Platform - Permissions & Resources - Commitment Management

> Complete reference of all permissions nOps requires and all resources created or needed in your GCP environment to run commitment management.

## Overview

nOps offers two integration tiers, each requiring different levels of access:

1. **[Savings Analysis](/gcp/integration-setup)** -- Read-only cost visibility, resource inventory, and optimization recommendations
2. **[Commitment Management](/gcp/commitment-management-setup)** -- Automated purchasing and management of GCP Committed Use Discounts (CUDs), via both an Automation Agent (service account) and the nOps Operations Team

***

## Permissions

Commitment Management requires elevated permissions beyond Savings Analysis, split into two access paths:

* **Automation Agent (Service Account)** -- For autonomous purchasing and quota management
* **nOps Support Team** -- For GCP Console access, dashboards, and manual overrides

### Automation Agent (Service Account)

#### Organization-Level Roles

| Role                              | Role ID                                | Purpose                                          |
| --------------------------------- | -------------------------------------- | ------------------------------------------------ |
| Browser                           | `roles/browser`                        | Browse organization hierarchy                    |
| Cloud Asset Viewer                | `roles/cloudasset.viewer`              | Enumerate assets across services                 |
| Recommender Viewer                | `roles/recommender.viewer`             | Read cost recommendations at project/org scope   |
| Cloud SQL Viewer                  | `roles/cloudsql.viewer`                | Read Cloud SQL instances                         |
| Cloud Run Viewer                  | `roles/run.viewer`                     | Read Cloud Run services                          |
| Compute Recommender Viewer        | `roles/recommender.computeViewer`      | View CUD/SUD recommendations                     |
| Cloud Support Tech Support Editor | `roles/cloudsupport.techSupportEditor` | Create support tickets (paid support plans only) |

#### Billing Account Roles

| Role                                  | Role ID                                    | Purpose                          |
| ------------------------------------- | ------------------------------------------ | -------------------------------- |
| Billing Account Viewer                | `roles/billing.viewer`                     | View spend data                  |
| Consumer Procurement Order Admin      | `roles/consumerprocurement.orderAdmin`     | Purchase spend-based (Flex) CUDs |
| Recommender Billing Account CUD Admin | `roles/recommender.billingAccountCudAdmin` | Access CUD recommendations       |

#### Project-Level Roles (CUD Project)

| Role                  | Role ID                 | Purpose                                 |
| --------------------- | ----------------------- | --------------------------------------- |
| Compute Viewer        | `roles/compute.viewer`  | View VMs for coverage analysis          |
| nOps Resource Manager | Custom role (see below) | Purchase and manage resource-based CUDs |

### nOps Support Team

#### Organization-Level Roles

| Role                              | Role ID                                | Purpose                                           |
| --------------------------------- | -------------------------------------- | ------------------------------------------------- |
| Browser                           | `roles/browser`                        | See organization and list projects in GCP Console |
| Compute Viewer                    | `roles/compute.viewer`                 | View VMs and compute resources                    |
| Cloud Support Tech Support Editor | `roles/cloudsupport.techSupportEditor` | Create support tickets (paid support plans only)  |

#### Billing Account Roles

| Role                                   | Role ID                                     | Purpose                  |
| -------------------------------------- | ------------------------------------------- | ------------------------ |
| Billing Account Viewer                 | `roles/billing.viewer`                      | View billing dashboard   |
| Recommender Billing Account CUD Viewer | `roles/recommender.billingAccountCudViewer` | View CUD recommendations |

#### Project-Level Roles (CUD Project)

| Role           | Role ID                | Purpose                                      |
| -------------- | ---------------------- | -------------------------------------------- |
| Compute Viewer | `roles/compute.viewer` | Populate Machine Family and Region dropdowns |

### Custom Role: nOps Resource Manager

Created at the **organization level**, granted at the **CUD project level**.

* **Title:** nOps Resource Manager
* **ID:** `nOpsResourceManager`

**Included Permissions:**

| Category          | Permission                               |
| ----------------- | ---------------------------------------- |
| Compute Lifecycle | `compute.commitments.create`             |
| Compute Lifecycle | `compute.commitments.update`             |
| Compute Lifecycle | `compute.commitments.updateReservations` |
| Compute Lifecycle | `compute.commitments.get`                |
| Compute Lifecycle | `compute.commitments.list`               |
| Compute Lifecycle | `compute.regionOperations.get`           |
| Reservations      | `compute.reservations.list`              |
| Reservations      | `compute.reservations.get`               |
| Reservations      | `compute.reservations.create`            |
| Quota Management  | `serviceusage.quotas.get`                |
| Quota Management  | `serviceusage.quotas.update`             |
| Quota Management  | `serviceusage.services.get`              |
| Quota Management  | `serviceusage.services.list`             |
| Quota Management  | `serviceusage.services.use`              |
| Quota Management  | `cloudquotas.quotas.get`                 |
| Quota Management  | `cloudquotas.quotas.update`              |
| Asset Export      | `cloudasset.assets.exportResource`       |
| Monitoring        | `monitoring.timeSeries.list`             |

## Resources You Must Create

| Resource                                               | Details                                                                                                |
| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------ |
| **Dedicated GCP Project** (e.g., `nops-cud-purchases`) | Must be linked to your billing account. With CUD sharing enabled, discounts apply across all projects. |
| **Custom IAM Role** (`nOpsResourceManager`)            | Created at the organization level, granted at the CUD project level. See permission list above.        |

***

## Required APIs

Enabled on the **dedicated CUD project**.

| API                                     | Service ID                                        |
| --------------------------------------- | ------------------------------------------------- |
| Compute Engine API                      | `compute.googleapis.com`                          |
| Cloud Commerce Consumer Procurement API | `cloudcommerceconsumerprocurement.googleapis.com` |
| Cloud Asset API                         | `cloudasset.googleapis.com`                       |
| Cloud Quotas API                        | `cloudquotas.googleapis.com`                      |
| Service Usage API                       | `serviceusage.googleapis.com`                     |
| Recommender API                         | `recommender.googleapis.com`                      |

***

## CUD Sharing Requirement

For Commitment Management with resource-based CUDs, **CUD sharing must be enabled** on your billing account. CUD sharing is disabled by default in GCP.

<Warning>
  After you enable CUD sharing, **you cannot disable it yourself**. Cloud Billing Support must perform this action.
</Warning>

<Info>
  Spend-based (Flex) CUDs automatically apply across all projects without requiring CUD sharing.
</Info>

***

## Related Guides

<CardGroup cols={2}>
  <Card title="Prerequisites" icon="list-check" href="/gcp/prerequisites">
    Configure billing exports and prepare your GCP environment.
  </Card>

  <Card title="Integration Setup" icon="plug" href="/gcp/integration-setup">
    Link GCP billing data and grant service account permissions.
  </Card>

  <Card title="Commitment Management Setup" icon="chart-line" href="/gcp/commitment-management-setup">
    Configure automated CUD purchasing and nOps operations team access.
  </Card>

  <Card title="Permissions and Resources - Savings Analysis" icon="shield-check" href="/gcp/permissions-and-resources-sa">
    Overview of all permissions and resources needed for Savings Analysis.
  </Card>
</CardGroup>