GCP服务账户列表计费帐户节点GCP

Question

我们正在尝试检索GCP中的计费帐户列表，为此目的，我们使用了一个服务帐户。我们编写的代码如下：

async function listBillingAccounts(project)
{
    let keys = JSON.parse(Buffer.from(process.env.SERVICE_ACCOUNT_BASE64_JSON, "base64").toString("ascii"));
    const client = new CloudBillingClient({credentials : keys});
    if (project !== undefined)
    {
        const [accounts] = await client.listBillingAccounts({ project, });
        console.log(accounts);
    }
    else
    {
        const [accounts] = await client.listBillingAccounts({});
        console.log(accounts);
    }
    console.info(`found ${accounts.length} billing accounts:`);
    for (const account of accounts) {
        console.info(`${account.displayName}:`);
        console.info(`\topen: ${account.open}`);
        console.info(`\tparentBillingAccount: ${account.masterBillingAccount}`);
    }
}

SERVICE_ACCOUNT_BASE64_JSON包含以下服务帐户信息：

{
    "type": "service_account",
    "project_id": "xxxx",
    "private_key_id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "private_key": "-----BEGIN PRIVATE KEY----------END PRIVATE KEY-----\n",
    "client_email": "xxxxx@xxxxx",
    "client_id": "xxxxxxxxxxxxxxxxxxxxx",
    "auth_uri": "https://accounts.google.com/o/oauth2/auth",
    "token_uri": "https://oauth2.googleapis.com/token",
    "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
    "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/xxxxx"
}

如果指定或不指定项目名称，则帐户结果始终是空数组。你知道会发生什么吗？我们向IAM团队询问服务帐户是否具有所需的权限，并且他们确认它具有：

https://www.googleapis.com/auth/cloud-billing.readonly ->计费帐户使用承诺推荐查看器是正确的吗？

Answer 1

结果为空，因为服务帐户未被授权查看计费帐户。

您必须将服务帐户电子邮件地址以授权用户的身份添加到每个计费帐户中，并具有角色计费帐户查看器(roles/billing.viewer)。角色被添加到记帐帐户中。

云计费访问控制综述