`billing_account_permissions` — version 1.2

Source: presets/billing-account-permissions.satz

Purpose

Billing-account IAM, split by audience.

Everyone in the domain may USE and VIEW the billing account (link projects, read costs); the full administration — and every other billing-account role — goes to ONE group, named by a param so no customer forks the pack for it. The IaC service account keeps billing.admin: it manages this account's budgets and project links on every apply.

Use it

params {
  // the pack's own defaults — copy only the lines you change
  billing_admins_group = "gcp-billing-admins@{customer_domain}"
}

use "presets/billing-account-permissions.satz"

Needs from outside the pack:

billing_account_infra — declared by estate_core; use one of them alongside, or declare it in the estate.
customer_domain — declared by estate_core; use one of them alongside, or declare it in the estate.
infra_project_name — declared by estate_core; use one of them alongside, or declare it in the estate.
svc_iac_account — declared by estate_core; use one of them alongside, or declare it in the estate.

Params

param	default
`billing_admins_group`	`"gcp-billing-admins@{customer_domain}"`

Questions

What to ask before this pack is configured, and what changing the answer costs.

asks about	prompt	reversal	blast	recommends
`billing_admins_group`	The group that administers the billing account (a full address)	edit	high	—

billing_admins_group — This group gets billing.admin and billing.costsManager on the account: it can move projects between billing accounts and see every cost. The default is the S1 model's billing-admins group; another model names its own.

Contributes

resource type	labels
`google_billing_account_iam_member`	`billing_account_id (grant map)`, `serviceAccount:{svc_iac_account}@{infra_project_name}.iam.gserviceaccount.com (grant map)`, `domain:{customer_domain} (grant map)`, `group:{billing_admins_group} (grant map)`

Claims

None — this pack proves no control by itself.

History

version	date	change
1.2	2026-09-10	one `question` block on the billing-admins group: it can move projects between billing accounts and see every cost. Nothing emitted changes
1.1	2026-09-01	split by audience: the domain gets `billing.user` + `billing.viewer`; a `billing_admins_group` param (default `gcp-billing-admins@{customer_domain}`) gets `billing.admin` + `billing.costsManager`; the IaC SA keeps `billing.admin`. Adoption adds three grants per estate — a real plan
1.0	2026-08-20	billing-account IAM for the S1 groups and the IaC service account

The whole library's history: the changelog in presets/CHANGELOG.md.

Notes

The IaC service account keeps billing.admin here because it links projects and manages budgets on every apply — narrowing it breaks bootstrap and any project creation.

A reseller billing account lives in another organisation: the grant is applied by whoever administers that account, not by this estate's service account.

billing_account_permissions — version 1.2