> For the complete documentation index, see [llms.txt](https://docs.onelens.cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-gcp/using-gcloud.md). # Using gcloud This guide covers the same integration as [Manual](/integrations/cloud-and-cost-sources/connecting-to-gcp/manual.md), performed from the command line with the `gcloud` CLI instead of the Google Cloud console. The resulting service account, external user and IAM roles are identical. {% hint style="info" %} The user performing the integration must have the following roles assigned: 1. **Organisation Administrator** on your organisation 2. **Billing Account Administrator** on your organisation/billing account **Why this is needed?** Organisation Administrator role is used to create the billing project and to assign the organisation-level IAM roles. Billing Account Administrator role is used to assign the Billing Account Viewer role. {% endhint %} {% hint style="warning" %} Below APIs must be enabled on your projects for OneLens to be able to read usage data on the respective services: 1. `Vertex AI API` *(aiplatform.googleapis.com)* 2. `Cloud Functions API` *(cloudfunctions.googleapis.com)* 3. `Cloud SQL Admin API` *(sqladmin.googleapis.com)* 4. `Compute Engine API` *(compute.googleapis.com)* 5. `Kubernetes Engine API` *(container.googleapis.com)* 6. `Dataflow API` *(dataflow\.googleapis.com)* 7. `Cloud Dataproc API` *(dataproc.googleapis.com)* 8. `Cloud Filestore API` *(file.googleapis.com)* 9. `Cloud Monitoring API` *(monitoring.googleapis.com)* 10. `Network Management API` *(networkmanagement.googleapis.com)* 11. `Recommender API` *(recommender.googleapis.com)* 12. `Google Cloud Memorystore for Redis API` *(redis.googleapis.com)* 13. `Service Usage API` *(serviceusage.googleapis.com)* 14. `Cloud Asset API` *(cloudasset.googleapis.com)* 15. `BigQuery API` *(bigquery.googleapis.com)* 16. `Cloud Logging API` *(logging.googleapis.com)* 17. `Cloud Storage API` *(storage.googleapis.com)* APIs are enabled per project, as Google Cloud has no organisation-level equivalent, so the above must be enabled for ***each*** project to be onboarded. For steps on how to enable APIs, please follow this link to Google's [documentation](https://cloud.google.com/apis/docs/getting-started#enabling_apis). {% endhint %} {% hint style="warning" %} Setting up the billing exports is the one part of this guide that cannot be done from the CLI. Google provides no `gcloud` command or API for configuring Cloud Billing exports to BigQuery, so that step is performed in the Google Cloud console. {% endhint %} ### Identities involved | Identity | Where it lives | Purpose | | ------------------------------------------------------------------------------------------ | -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **OneLens Reader SA**, `@.iam.gserviceaccount.com` | Created by you, in your billing project | Holds the read-only IAM roles OneLens uses. The address is unique to your environment, since it contains your own billing project ID. | | `onelens.finops@astuto.ai` | Invited into your organisation as an external user | OneLens FinOps team, console login and manual validation | | `onelens-customer-sa@astuto-prod-mum.iam.gserviceaccount.com` | OneLens, in our own environment | Our platform identity. You grant it `Service Account Token Creator` on your OneLens Reader SA so it can generate short-lived credentials to impersonate it. It receives no other role, and no service account keys are ever shared. | The external user email above is the default. If the OneLens team provided you with a different address during onboarding, use that address in place of `onelens.finops@astuto.ai` throughout this guide. ### Values to collect before you start | Field | Example value | | ------------------------- | ------------------------- | | Organisation ID | `111111111111` | | Billing Account ID | `XXXXXX-XXXXXX-XXXXXX` | | Billing Export Project ID | `onelens-billing-project` | {% stepper %} {% step %} ### Set the environment variables Before running any commands, set the shell variables below. Every command in this guide references them, so no manual substitution is required. Replace the placeholder values with your own, then run the block once in the shell you will use for the rest of the guide. {% code overflow="wrap" %} ```bash export ORG_ID="111111111111" export BILLING_ACCOUNT_ID="XXXXXX-XXXXXX-XXXXXX" export BILLING_PROJECT_ID="onelens-billing-project" export SA_ID="onelens-reader-sa" export SA_EMAIL="$SA_ID@$BILLING_PROJECT_ID.iam.gserviceaccount.com" export LOCAL_SA="serviceAccount:$SA_EMAIL" ``` {% endcode %} {% hint style="info" %} `SA_EMAIL` is derived from `SA_ID` and your billing project, so it is different for every customer. That derived address is the Service Account email you send to OneLens at the end of this guide. {% endhint %} {% endstep %} {% step %} ### Verify your variables and permissions Run the check below before making any changes. It confirms that the variables are set and that your user holds the roles required to proceed. Nothing is modified.
Pre-flight check script {% code overflow="wrap" %} ```bash echo -e "RESOURCE\t\tVALUE/ROLE\t\t\t\tSTATUS" echo -e "---------------------------------------------------------------" # 1. Check Environment Variables for var in ORG_ID BILLING_ACCOUNT_ID BILLING_PROJECT_ID; do if [[ -z "${!var}" ]]; then printf "%-23s %-40s [\e[31mMISSING\e[0m]\n" "$var" "Not Set" else printf "%-23s %-40s [\e[32mOK\e[0m]\n" "$var" "${!var}" fi done # 2. Check IAM Roles ACCOUNT=$(gcloud config get-value account 2>/dev/null) check_iam() { local cmd=$1 local role=$2 local label=$3 if [[ -z "$ACCOUNT" ]]; then return; fi RESULT=$(eval "$cmd" --flatten='bindings[].members' \ --filter="bindings.members:$ACCOUNT AND bindings.role:$role" \ --format='value(bindings.role)' 2>/dev/null) if [[ -n "$RESULT" ]]; then printf "%-23s %-40s [\e[32mPRESENT\e[0m]\n" "$label" "$role" else printf "%-23s %-40s [\e[31mABSENT\e[0m]\n" "$label" "$role" fi } check_iam "gcloud organizations get-iam-policy $ORG_ID" \ "roles/resourcemanager.organizationAdmin" "Org Admin" check_iam "gcloud beta billing accounts get-iam-policy $BILLING_ACCOUNT_ID" \ "roles/billing.admin" "Billing Admin" ``` {% endcode %}
{% endstep %} {% step %} ### Create the Billing Project Create the project that will hold your exported billing data, link it to your billing account, and enable the APIs it needs. {% code overflow="wrap" %} ```bash gcloud projects create "$BILLING_PROJECT_ID" \ --name="OneLens Billing Project" \ --organization="$ORG_ID" gcloud beta billing projects link "$BILLING_PROJECT_ID" \ --billing-account="$BILLING_ACCOUNT_ID" gcloud services enable bigquery.googleapis.com \ cloudbilling.googleapis.com \ cloudasset.googleapis.com \ serviceusage.googleapis.com \ apikeys.googleapis.com \ --project="$BILLING_PROJECT_ID" ``` {% endcode %} If you already have a project set up to host billing data through BigQuery, skip the project creation above and set `BILLING_PROJECT_ID` to that project. {% endstep %} {% step %} ### Enable Detailed Usage Export Create the dataset that will hold the detailed usage cost export. {% code overflow="wrap" %} ```bash bq mk --location=US --dataset "$BILLING_PROJECT_ID:billing_export" ``` {% endcode %} {% hint style="info" %} The dataset location is set to `US` so that cost data can be exported retroactively from the start of the previous month during the initial setup. Table expiry is left unset, which keeps your cost history intact indefinitely. {% endhint %} Enabling the export must be completed in the Google Cloud console, it cannot be performed via CLI. Print the billing export URL for your account, then open it in a browser: {% code overflow="wrap" %} ```bash echo "https://console.cloud.google.com/billing/$BILLING_ACCOUNT_ID/export" ``` {% endcode %} * On the `BigQuery export` tab, enable `Detailed usage cost` with the following options: * Under `Projects`, select the billing project (*OneLens Billing Project*). * Under `Dataset`, select the dataset created above (*billing\_export*). * Click `Save`.
{% endstep %} {% step %} ### Enable CUD Export This step must be completed in the Google Cloud console, it cannot be performed via CLI. Print the billing export URL for your account, then open it in a browser: {% code overflow="wrap" %} ```bash echo "https://console.cloud.google.com/billing/$BILLING_ACCOUNT_ID/export" ``` {% endcode %} * On the `BigQuery export` tab, enable `Committed use discounts export` with the following options: * Under `Projects`, select the billing project (*OneLens Billing Project*). * Under `Linked dataset name`, enter a new dataset name: *cud\_export*. * Under `Location type`, select *Multi-region*. * Under `Multi-region`, select *US (multiple regions in the United States)*. * Click `Save`.
{% hint style="warning" %} Do not create this dataset with `bq mk`. The committed use discounts export requires a dataset name that does not already exist, and creates the linked dataset for you. {% endhint %} {% hint style="info" %} The committed use discounts export writes a `cud_subscriptions_export` table holding the metadata of every committed use discount purchased in any project linked to this billing account: product, commitment amount, term and consumption model. {% endhint %} {% endstep %} {% step %} ### Create the Service Account Create the service account in the billing project, then assign the `Service Account Token Creator` role, allowing the OneLens backend service account and the OneLens external user to impersonate it. {% code overflow="wrap" %} ```bash gcloud iam service-accounts create "$SA_ID" \ --display-name="OneLens Reader SA" \ --description="SA used by OneLens with read-only roles for FinOps analysis" \ --project="$BILLING_PROJECT_ID" gcloud iam service-accounts add-iam-policy-binding "$SA_EMAIL" \ --member="serviceAccount:onelens-customer-sa@astuto-prod-mum.iam.gserviceaccount.com" \ --role="roles/iam.serviceAccountTokenCreator" \ --project="$BILLING_PROJECT_ID" gcloud iam service-accounts add-iam-policy-binding "$SA_EMAIL" \ --member="user:onelens.finops@astuto.ai" \ --role="roles/iam.serviceAccountTokenCreator" \ --project="$BILLING_PROJECT_ID" echo "Send this Service Account email to OneLens: $SA_EMAIL" ``` {% endcode %} {% endstep %} {% step %} ### Grant Organisation-level roles Run the following commands to grant all required organisation-level roles to both principals. Granting at the organisation covers every project in it, including projects created later. Each command is idempotent, existing bindings are never overwritten. #### Grant roles to External User () {% code overflow="wrap" %} ```bash gcloud organizations add-iam-policy-binding $ORG_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/resourcemanager.organizationViewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/cloudasset.viewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/browser" gcloud organizations add-iam-policy-binding $ORG_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/viewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/bigquery.resourceViewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/bigquery.metadataViewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/bigquery.jobUser" ``` {% endcode %} #### Grant roles to OneLens Service Account ($LOCAL\_SA) {% code overflow="wrap" %} ```bash gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/resourcemanager.organizationViewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/cloudasset.viewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/browser" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/aiplatform.viewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/cloudfunctions.viewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/cloudsql.viewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/compute.viewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/container.viewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/dataflow.viewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/dataproc.viewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/file.viewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/monitoring.viewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/networkmanagement.viewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/recommender.viewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/redis.viewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/serviceusage.serviceUsageViewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/logging.viewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/storage.bucketViewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/bigquery.resourceViewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/bigquery.metadataViewer" gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/bigquery.jobUser" ``` {% endcode %} {% hint style="info" %} `roles/storage.bucketViewer` is a Beta role in Google Cloud. It holds two permissions, `storage.buckets.get` and `storage.buckets.list`, which let OneLens read bucket names, locations, storage classes and lifecycle configuration. It gives no access to the objects inside a bucket, and it cannot read bucket IAM policies. `roles/logging.viewer` reads log entries and log-based metric metadata in the `_Required` and `_Default` log buckets. It does not cover Data Access audit logs, which require `roles/logging.privateLogViewer`, and OneLens does not ask for that role. {% endhint %} #### Create and grant the AI key inventory role (Service Account only) OneLens reports on the API keys in your organisation, so that keys which can reach Vertex AI or Gemini without a restriction are visible alongside their cost. That needs one permission, `apikeys.keys.list`, which returns a key's name, display name, API restrictions and creation time. There is a predefined role for this, `API Keys Viewer`, and this guide deliberately does not use it. It also contains `apikeys.keys.getKeyString`, which reads live key strings. The custom role below holds `apikeys.keys.list` and nothing else, so the key strings in your organisation stay unreachable. {% code overflow="wrap" %} ```bash gcloud iam roles create onelensAiKeyInventory \ --organization="$ORG_ID" \ --title="OneLens AI Key Inventory" \ --description="Lists API key metadata for OneLens AI cost reporting. Cannot read key strings." \ --permissions=apikeys.keys.list gcloud organizations add-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="organizations/$ORG_ID/roles/onelensAiKeyInventory" ``` {% endcode %} {% hint style="info" %} This role is granted to the service account only, not to the external user. {% endhint %} {% endstep %} {% step %} ### Grant Billing project roles Grant BigQuery access to the billing export project for both principals. The service account additionally needs `BigQuery Read Session User` for programmatic reads. {% code overflow="wrap" %} ```bash # External user gcloud projects add-iam-policy-binding $BILLING_PROJECT_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/bigquery.dataViewer" gcloud projects add-iam-policy-binding $BILLING_PROJECT_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/bigquery.metadataViewer" gcloud projects add-iam-policy-binding $BILLING_PROJECT_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/bigquery.jobUser" # OneLens Service Account gcloud projects add-iam-policy-binding $BILLING_PROJECT_ID \ --member=$LOCAL_SA \ --role="roles/bigquery.dataViewer" gcloud projects add-iam-policy-binding $BILLING_PROJECT_ID \ --member=$LOCAL_SA \ --role="roles/bigquery.metadataViewer" gcloud projects add-iam-policy-binding $BILLING_PROJECT_ID \ --member=$LOCAL_SA \ --role="roles/bigquery.jobUser" gcloud projects add-iam-policy-binding $BILLING_PROJECT_ID \ --member=$LOCAL_SA \ --role="roles/bigquery.readSessionUser" ``` {% endcode %} {% endstep %} {% step %} ### Grant Billing Account Viewer role {% code overflow="wrap" %} ```bash gcloud beta billing accounts add-iam-policy-binding $BILLING_ACCOUNT_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/billing.viewer" gcloud beta billing accounts add-iam-policy-binding $BILLING_ACCOUNT_ID \ --member=$LOCAL_SA \ --role="roles/billing.viewer" ``` {% endcode %} {% endstep %} {% step %} ### Verify access After completing all steps above, run the following commands to confirm that roles have been applied correctly. #### Check Organisation-level roles, External User {% code overflow="wrap" %} ```bash gcloud organizations get-iam-policy $ORG_ID \ --flatten="bindings[].members" \ --filter="bindings.members:onelens.finops@astuto.ai" \ --format="table(bindings.role)" ``` {% endcode %} #### Check Organisation-level roles, OneLens Service Account {% code overflow="wrap" %} ```bash gcloud organizations get-iam-policy $ORG_ID \ --flatten="bindings[].members" \ --filter="bindings.members:$SA_EMAIL" \ --format="table(bindings.role)" ``` {% endcode %} #### Check Billing account and Billing project roles {% code overflow="wrap" %} ```bash gcloud beta billing accounts get-iam-policy $BILLING_ACCOUNT_ID \ --flatten="bindings[].members" \ --filter="bindings.members:$SA_EMAIL" \ --format="table(bindings.role)" gcloud projects get-iam-policy $BILLING_PROJECT_ID \ --flatten="bindings[].members" \ --filter="bindings.members:$SA_EMAIL" \ --format="table(bindings.role)" ``` {% endcode %} {% endstep %} {% endstepper %} {% hint style="success" %} **You have now ****successfully**** integrated your Google Cloud Platform environment with OneLens.** \ **Please share the following values to the OneLens team to facilitate the connection on our end:** * *Service Account email ID* * *Billing project ID* * *Billing Account ID(s)* * *BigQuery dataset ID (billing\_export)* * *BigQuery dataset ID (cud\_export)* {% endhint %} ### Role summary The table below lists every IAM role granted, the resource level at which it is applied, the member it is assigned to, and its purpose. Both = `onelens.finops@astuto.ai` and the OneLens Reader service account. | Role | Scope | Member | Purpose | | ------------------------------------------ | ---------------------- | ------------------------------------ | ------------------------------------------------------------ | | `roles/resourcemanager.organizationViewer` | Organisation | Both | View the organisation, folder and project hierarchy | | `roles/cloudasset.viewer` | Organisation | Both | View the asset inventory across the organisation | | `roles/browser` | Organisation | Both | Browse the resource hierarchy without reading resource data | | `roles/viewer` | Organisation | User only | Read-only console access for FinOps analysis | | Service viewer roles\* | Organisation | SA only | Read metadata for Compute, GKE, Cloud SQL and other services | | `roles/bigquery.resourceViewer` | Organisation | Both | View BigQuery datasets, tables and jobs | | `roles/bigquery.metadataViewer` | Organisation | Both | Read dataset and table metadata | | `roles/bigquery.jobUser` | Organisation | Both | Run BigQuery jobs and queries | | `roles/billing.viewer` | Billing account | Both | Read billing account costs, invoices and spend data | | `roles/bigquery.dataViewer` | Billing project | Both | Read the data inside the billing export tables | | `roles/bigquery.readSessionUser` | Billing project | SA only | Create read sessions for programmatic data reads | | `roles/iam.serviceAccountTokenCreator` | Your OneLens Reader SA | OneLens backend SA and external user | Impersonate the OneLens Reader service account | | `onelensAiKeyInventory` (custom) | Organisation | SA only | List API key metadata for AI cost reporting | \**Service viewer roles are* `roles/aiplatform.viewer`*,* `roles/cloudfunctions.viewer`*,* `roles/cloudsql.viewer`*,* `roles/compute.viewer`*,* `roles/container.viewer`*,* `roles/dataflow.viewer`*,* `roles/dataproc.viewer`*,* `roles/file.viewer`*,* `roles/monitoring.viewer`*,* `roles/networkmanagement.viewer`*,* `roles/recommender.viewer`*,* `roles/redis.viewer`*,* `roles/serviceusage.serviceUsageViewer`*,* `roles/logging.viewer` *and* `roles/storage.bucketViewer`*.* ### Revoking access (if required) Access is fully reversible. The commands below remove every binding this guide created and delete the service account.
Remove Organisation-level access, External User {% code overflow="wrap" %} ```bash gcloud organizations remove-iam-policy-binding $ORG_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/resourcemanager.organizationViewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/cloudasset.viewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/browser" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/viewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/bigquery.resourceViewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/bigquery.metadataViewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/bigquery.jobUser" ``` {% endcode %}
Remove Organisation-level access, OneLens Service Account {% code overflow="wrap" %} ```bash gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/resourcemanager.organizationViewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/cloudasset.viewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/browser" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/aiplatform.viewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/cloudfunctions.viewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/cloudsql.viewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/compute.viewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/container.viewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/dataflow.viewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/dataproc.viewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/file.viewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/monitoring.viewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/networkmanagement.viewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/recommender.viewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/redis.viewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/serviceusage.serviceUsageViewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/logging.viewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/storage.bucketViewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/bigquery.resourceViewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/bigquery.metadataViewer" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="roles/bigquery.jobUser" gcloud organizations remove-iam-policy-binding $ORG_ID \ --member=$LOCAL_SA \ --role="organizations/$ORG_ID/roles/onelensAiKeyInventory" gcloud iam roles delete onelensAiKeyInventory \ --organization="$ORG_ID" ``` {% endcode %}
Remove Billing account and Billing project access, and delete the Service Account {% code overflow="wrap" %} ```bash gcloud beta billing accounts remove-iam-policy-binding $BILLING_ACCOUNT_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/billing.viewer" gcloud beta billing accounts remove-iam-policy-binding $BILLING_ACCOUNT_ID \ --member=$LOCAL_SA \ --role="roles/billing.viewer" gcloud projects remove-iam-policy-binding $BILLING_PROJECT_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/bigquery.dataViewer" gcloud projects remove-iam-policy-binding $BILLING_PROJECT_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/bigquery.metadataViewer" gcloud projects remove-iam-policy-binding $BILLING_PROJECT_ID \ --member="user:onelens.finops@astuto.ai" \ --role="roles/bigquery.jobUser" gcloud projects remove-iam-policy-binding $BILLING_PROJECT_ID \ --member=$LOCAL_SA \ --role="roles/bigquery.dataViewer" gcloud projects remove-iam-policy-binding $BILLING_PROJECT_ID \ --member=$LOCAL_SA \ --role="roles/bigquery.metadataViewer" gcloud projects remove-iam-policy-binding $BILLING_PROJECT_ID \ --member=$LOCAL_SA \ --role="roles/bigquery.jobUser" gcloud projects remove-iam-policy-binding $BILLING_PROJECT_ID \ --member=$LOCAL_SA \ --role="roles/bigquery.readSessionUser" gcloud iam service-accounts delete "$SA_EMAIL" \ --project="$BILLING_PROJECT_ID" ``` {% endcode %}
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-gcp/using-gcloud.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.