> ## Documentation Index
> Fetch the complete documentation index at: https://help.nops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Cloud Platform - Permissions & Resources - Savings Analysis

> Complete reference of all permissions nOps requires and all resources created or needed in your GCP environment to run a savings analysis.

<Info>
  Setup takes approximately **20 minutes** to complete.
</Info>

## Overview

nOps offers two integration tiers, each requiring different levels of access:

1. **[Savings Analysis](/gcp/integration-setup)** -- Read-only cost visibility, resource inventory, and optimization recommendations
2. **[Commitment Management](/gcp/commitment-management-setup)** -- Automated purchasing and management of GCP Committed Use Discounts (CUDs), via both an Automation Agent (service account) and the nOps Operations Team

***

## Permissions

All roles below are granted to the nOps service account.

### Organization-Level Roles

| Role               | Role ID                    | Purpose                                |
| ------------------ | -------------------------- | -------------------------------------- |
| Browser            | `roles/browser`            | Enumerate projects and folders         |
| Recommender Viewer | `roles/recommender.viewer` | Read cost optimization recommendations |
| Compute Viewer     | `roles/compute.viewer`     | Read Compute Engine data               |

### Billing Account Roles

| Role                   | Role ID                | Purpose                                         |
| ---------------------- | ---------------------- | ----------------------------------------------- |
| Billing Account Viewer | `roles/billing.viewer` | Access billing metadata and currency validation |

### Dataset-Level Roles

Granted on **each BigQuery dataset** containing billing export data, including the FOCUS dataset if you configured one.

| Role                 | Role ID                     | Purpose                    |
| -------------------- | --------------------------- | -------------------------- |
| BigQuery Data Viewer | `roles/bigquery.dataViewer` | Read billing export tables |

### Project-Level Roles

Granted on the project hosting your billing export datasets.

| Role                     | Role ID                                   | Required                                             | Purpose                                        |
| ------------------------ | ----------------------------------------- | ---------------------------------------------------- | ---------------------------------------------- |
| Service Usage Consumer   | `roles/serviceusage.serviceUsageConsumer` | Yes                                                  | Run BigQuery jobs against billing data         |
| BigQuery Resource Viewer | `roles/bigquery.resourceViewer`           | Only if using flat-rate/reservation BigQuery pricing | Read BigQuery reservation and slot information |

***

## Resources Created by nOps

nOps creates a **per-client service account** (`nops-billing-sa-{clientId}@nops-billing-export.iam.gserviceaccount.com`) when you set up the integration. This service account lives in the nOps GCP project -- no infrastructure resources are created in your environment.

***

## Resources You Must Create

| Resource                                        | Details                                                                                                               |
| ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| **BigQuery Dataset -- Detailed Usage Cost**     | Location must be US or EU                                                                                             |
| **BigQuery Dataset -- Pricing**                 | Must use the same project and location as Detailed Usage Cost                                                         |
| **BigQuery Dataset -- Committed Use Discounts** | Must use the same project and location as above                                                                       |
| **BigQuery Dataset -- FOCUS** (optional)        | Created and named by Google when you enable the FOCUS export: `gcp_billing_immutable_<BILLING_ACCOUNT_ID>_<LOCATION>` |

<Tip>
  The Detailed Usage Cost and Pricing exports can share the same BigQuery dataset. The FOCUS dataset is always separate, because Google creates it for you.
</Tip>

***

## Required APIs

Enabled on the **project that hosts your billing exports**.

| API               | Service ID                    |
| ----------------- | ----------------------------- |
| Cloud Billing API | `cloudbilling.googleapis.com` |
| Recommender API   | `recommender.googleapis.com`  |

**Optional:**

| API                      | Service ID                           | When Required                                        |
| ------------------------ | ------------------------------------ | ---------------------------------------------------- |
| BigQuery Reservation API | `bigqueryreservation.googleapis.com` | Only if using flat-rate/reservation BigQuery pricing |

***

## Domain Restricted Sharing

If your GCP organization has **Domain Restricted Sharing** enabled, you must add the nOps Google Workspace Customer ID to your allowed domains list before granting IAM roles to the nOps service account.

The nOps Customer ID is available in the GCP integration wizard at [Settings > Cloud Provider Integrations](https://clara.nops.io/settings).

<Info>
  If your organization does not have Domain Restricted Sharing enabled, this does not apply. See [Integration Setup](/gcp/integration-setup#1-domain-restricted-sharing) for detailed instructions.
</Info>

***

## Related Guides

<CardGroup cols={2}>
  <Card title="Prerequisites" icon="list-check" href="/gcp/prerequisites">
    Configure billing exports and prepare your GCP environment.
  </Card>

  <Card title="Integration Setup" icon="plug" href="/gcp/integration-setup">
    Link GCP billing data and grant service account permissions.
  </Card>

  <Card title="Commitment Management Setup" icon="chart-line" href="/gcp/commitment-management-setup">
    Configure automated CUD purchasing and nOps operations team access.
  </Card>

  <Card title="Permissions and Resources - Commitment Management" icon="shield-check" href="/gcp/permissions-and-resources-cm">
    Overview of all permissions and resources needed for Commitment Management.
  </Card>
</CardGroup>