GCP Permissions List

Detailed mapping of GCP IAM roles and permissions required by Wiv for cost optimization and resource analysis.

Written By Dotan Cohen

Last updated About 2 months ago

GCP Permissions List

1. Billing Data & BigQuery Analysis

Processing the billing export, and BigQuery-specific optimization.

PermissionSpecific Actions UsedReasoning / Functionality Enabled
roles/billing.viewerbilling.accounts.get, billing.accounts.listAllows Wiv to discover Cloud Billing accounts and validate billing configuration before querying exported cost data.
roles/bigquery.jobUserbigquery.jobs.createAllows Wiv to run queries against your GCP Billing Export tables to generate cost reports.
roles/bigquery.dataViewerbigquery.tables.getData, bigquery.tables.listGrants read-only access to the specific datasets containing your billing exports.
roles/bigquery.resourceViewerbigquery.datasets.get, bigquery.tables.getAllows Wiv to see the schema and metadata of datasets without reading the content (essential for mapping table structures).
roles/recommender.bigQueryCapacityCommitmentsViewerrecommender.bigqueryCapacityCommitmentsInsights.listSpecifically checks for unused BigQuery slots or opportunities to purchase committed slots for savings.

2. Core Compute & Optimization Engine

These permissions are critical for primary Compute Engine recommendations (Rightsizing, Idle VMs, Snapshots, etc.).

PermissionSpecific Actions UsedReasoning / Functionality Enabled
roles/compute.viewercompute.instances.list, compute.disks.list, compute.snapshots.listRequired to list all VMs, Disks, and Snapshots to detect idle resources and unattached disks.
roles/monitoring.viewermonitoring.timeSeries.list, monitoring.metricDescriptors.listAllows Wiv to read CPU, RAM, and Disk IO metrics. Without this, we cannot determine if a machine is "Idle" or "Oversized."
roles/recommender.computeViewerrecommender.computeInstanceIdleResourceRecommendations.list, recommender.computeInstanceMachineTypeRecommendations.listAllows Wiv to retrieve Google's native compute suggestions to validate our own models.
roles/recommender.viewerrecommender.locations.list, recommender.locations.getAllows Wiv to retrieve Google's native suggestions across various categories.

3. GKE & Kubernetes Optimization

These roles specifically power the Container and Cluster analysis features.

PermissionSpecific Actions UsedReasoning / Functionality Enabled
roles/container.viewercontainer.clusters.list, container.nodes.list, container.pods.listRequired to view GKE clusters, node pools, and pod configurations for rightsizing.
roles/gkebackup.viewergkebackup.backupPlans.list, gkebackup.backups.listAllows analysis of GKE backup configurations to identify storage waste or policy gaps.

4. Database & Storage Optimization

Permissions required for analyzing managed databases.

PermissionSpecific Actions UsedReasoning / Functionality Enabled
roles/cloudsql.viewercloudsql.instances.list, cloudsql.instances.getRequired to view CloudSQL instance configuration and status (enables Idle Google CloudSQL detection).
roles/redis.viewerredis.instances.listIdentifies Redis instances that are provisioned but unused or over-provisioned (Cost Visibility).
roles/spanner.viewerspanner.instances.list, spanner.databases.listProvides detailed visibility into Spanner instance node counts and configuration for cost allocation.

5. Resource Inventory & Network Visibility

These permissions allow us mapping "Ghost" costs—resources that appear on the bill but are hard to locate without specific viewer roles.

PermissionSpecific Actions UsedReasoning / Functionality Enabled
roles/cloudasset.viewercloudasset.assets.searchAllResourcesAllows Wiv to map every asset in the organization to a project (The "Safety Net" for cost allocation).
roles/compute.networkViewercompute.networks.list, compute.subnetworks.listProvides ability to analyze VPCs, Interconnects, and Egress paths for network cost optimization.
roles/logging.viewerlogging.logEntries.listRead-only access to Cloud Audit Logs used to validate recent resource activity and prevent false idle recommendations.

6. Serverless, PaaS & Security Posture

While your current primary list focuses on Compute/GKE, these permissions are required for comprehensive cost observability. If a client spends money on Cloud Run or Dataflow, Wiv needs these to visualize and attribute those costs correctly.

PermissionSpecific Actions UsedReasoning / Functionality Enabled
roles/run.viewerrun.services.listInventory of Cloud Run services to map serverless spend to specific teams/projects.
roles/cloudfunctions.viewercloudfunctions.functions.listInventory of Cloud Functions to detect high-frequency invocations driving up costs.
roles/pubsub.viewerpubsub.subscriptions.list, pubsub.topics.listVisibility into unattached subscriptions or massive message backlogs causing storage costs.
roles/dataflow.viewerdataflow.jobs.listAnalysis of Dataflow jobs (which can be notoriously expensive if stalled or looping).
roles/cloudbuild.builds.viewercloudbuild.builds.listVisibility into build history to identify expensive, long-running, or frequent build pipelines.
roles/artifactregistry.readerartifactregistry.repositories.listAnalyzing stored container images (e.g., identifying old/untagged images taking up storage space).
roles/iam.securityRevieweriam.serviceAccounts.list, iam.roles.listIdentifies over-privileged identities or unused Service Accounts (targets for "Shadow IT" cost cleanup).
roles/securitycenter.viewersecuritycenter.findings.listVisibility into Security Command Center findings that may influence resource termination decisions.
roles/cloudkms.viewercloudkms.cryptoKeys.listVisibility into KMS keys (identifying expensive active keys that are no longer encrypting data).

Summary

Wiv requests Viewer-only permissions. We do not request permissions to modify, delete, or deploy resources. The roles requested allow us to:

  1. Read Metrics: To mathematically prove a resource is idle or oversized (Monitoring/Compute/Container roles).

  2. Process Billing: To aggregate your spend data securely (BigQuery roles).

  3. Map Inventory: To ensure every line item on your invoice corresponds to a visible resource (Cloud Asset/PaaS roles).