In the following sections, you create a service account and upload its information to Kion. Before you do that, you must create a dedicated Google Cloud project to house the service account. If you've already created a Google Cloud project for the Kion deployment, you can add the service account to that project instead of creating a new one. The service account must be located in its own Google Cloud project.

Google Cloud projects are different from Kion projects. Google Cloud projects are equivalent to Kion accounts.

1. Log in to the Google Cloud console.
2. In the top ribbon, click Select a project.
3. Click New Project.
4. Enter a Project name.
5. Select the Organization and Location (parent organization or folder) from the dropdown menu.
6. Set and take note of the Project ID. You will need this ID later.
7. Click Create.

1. Log in to the Google Cloud console.
2. In the top ribbon, select the project you created for your service account.
3. In the left navigation menu, click APIs & Services.
4. Click Enable APIs and Services.
5. Search for and select Cloud Resource Manager API.
6. Click Enable.
7. Navigate to the APIs & Services page.
8. Search for and select Cloud Billing API.
9. Select Enable APIs and Services.
10. Navigate to the API Library.
11. Search for and select Identity and Access Management (IAM) API.
12. Click Enable.

A service account is a special type of Google account intended to represent a non-human user that needs to authenticate and be authorized to access data in Google APIs. You can read more about service accounts in Google's service account documentation.

1. Log in to the Google Cloud console.
2. In the top ribbon, select the project you created for your service account.
3. In the left navigation menu, click IAM & Admin > Service Accounts.
4. If prompted, select the card for the project you created.
5. Click Create Service Account.
6. Enter a Service Account Name.
7. Click Create and Continue.
8. Skip the Grant the service account access to project section by clicking Continue.
9. (Optional) You grant other users access to this service account. You can add a user's Google email address, Google Groups email address, service account address, or G Suite domain. For more information, see the Google documentation on Managing Service Account Impersonation.
10. Click Done.

If you already have a billing account, you will be prompted to choose one to link to the project during this process. If you haven't set up a billing account yet, we go over the process later in this guide.

1. Log in to the Google Cloud console.
2. In the top ribbon, select the project you created for your service account.
3. In the list of service accounts for your project, click the ellipsis menu under Actions and select Manage Keys.
4. Select Add Key > Create New Key.
5. Set the Key Type to JSON.
6. Click Create. The SAK JSON file downloads to your computer. Save this file to a safe location.

In addition to the roles you just assigned to the project housing the service account, you need to assign the service account permissions at the organization level.

There are two approaches you can take when granting permissions. You can grant the service account high-level permissions, which ensures the necessary permissions are in place for all current and future Kion features, or you can grant minimal permissions, which may require permission modifications when new features are released.

Follow one of the following guides to grant permissions to your service account.

If the BigQuery financial export is not present in one of the Google Cloud projects under the organization or folders you specified above, assign the service account permissions at the project level where BigQuery is located.

To assign BigQuery permissions:

1. Log in to the Google Cloud console.
2. In the top ribbon, select your project containing BigQuery.
3. In the left navigation menu, click IAM & Admin > IAM.
4. Click Add.
5. Enter the email of the service account.
6. Add the following roles:
   • BigQuery > BigQuery User
   • BigQuery > BigQuery Data Viewer
7. Click Save.

If you have an existing billing account, you can link that account instead of creating a new one. After step 3, select Link a Billing Account and follow the prompts.

To add a billing account and attach it to the service account:

1. Log in to the Google Cloud console. For this process, you must log in as a user with the Billing Account Creator role.
2. In the top ribbon, select the project you created for your service account.
3. In the left navigation menu, click Billing.
4. Click Manage Billing Accounts.
5. Click Add Billing Account.
6. Select your organization from the dropdown menu.
7. Enter an account name.
8. Select your country.
9. Click Continue.
10. Enter your account information. Please note that your selections here may be used for tax and identity verification. For more information, see Google's Create, Modify, or Close Your Billing Account article.
11. Click Submit and Enable Billing. By default, the person who creates the billing account is made a Billing Account Administrator for the billing account.
12. From the home screen, in the left navigation menu, click Billing.
13. Select your organization from the dropdown menu and click the My Projects tab.
14. Click the ellipsis menu under Actions and select Change Billing.
15. Choose the new billing account from the list.
16. Click Set Account.

Create a BigQuery dataset and enable the export of data to BigQuery to send Google Cloud information to Kion.

To set up billing data export to BigQuery:

1. Log in to the Google Cloud console.
2. In the top ribbon, select the project you created for your service account.
3. Navigate to Big Data > BigQuery.
4. In the Explorer menu, select your project.
5. Click the ellipses menu next to the project ID and select Create Dataset.
6. Enter a Dataset ID. For example, kionbillingdata.
7. Select a multiple region location identifier as the Data location. Do not select an individual region.
8. Click Create dataset.
9. In the left navigation menu, click Billing.
10. Click Go to Linked Billing Account.
11. In the billing navigation menu on the left, select Billing export.
12. Under the Standard usage cost section, click Edit settings.
13. Select your project.
14. Select the dataset you created.
    The BigQuery API is required to export data to BigQuery. If the project you selected doesn't have the BigQuery API enabled, you will be prompted to enable it. Click Enable BigQuery API to enable the API.
15. Click Save.
16. Under the Detailed usage cost section, click Edit settings.
17. Select your project.
18. Select the dataset you created.
19. Click Save.

1. Log in to the Google Cloud console.
2. In the top ribbon, select the project you created for your service account.
3. In the left navigation menu, click APIs & Services.
4. Click OAuth consent screen.
5. Select Internal and click Create.
6. On the app registration screen, enter the app name, user support email, and developer contact information email.
7. Click Save and Continue.

1. Log in to the Google Cloud console.
2. In the top ribbon, select the project you created for your service account.
3. In the left navigation menu, click APIs & Services.
4. Click Credentials.
5. Click Create Credentials > OAuth client ID.
6. From the Application type dropdown, select Web application.
7. Enter an application name.
8. In the Authorized Redirect URIs section, click Add URI and enter: https://Kion.example.com/api/v3/account/link-google-callback.
9. Change "kion.example.com" to the URL of your Kion instance.
10. Click Create.
11. Store the client ID and client secret for use in the Kion application.

1. Log in to Kion.
2. Navigate to Accounts > Google Cloud Service Accounts.
3. Click Add New.
4. Enter a Name and Description for the service account.
5. Select Enable IAM Federation.
6. Enter the OAuth Client ID and OAuth Client Secret you created above. This allows federation into Google Cloud accounts.
7. Upload the Google Cloud service access key by clicking Upload and selecting the JSON file you saved earlier.
8. Click Create Google Cloud Service Account.

1. Log in to Kion.
2. Navigate to Accounts > Billing Sources.
3. Click Add New.
4. For Account Type, select Google Cloud.
5. Enter a Billing Source Name.
6. Choose a Billing Start Date. This is the earliest month Kion will try to fetch financial data for the billing source.
7. Select the Service Account that will be used to access the billing data.
8. Leave the Input Type dropdown set to Auto-fill. This allows the form to query information from the Google API as you fill in the remainder of the form.
9. In the Google Cloud Billing Account dropdown, select the Google Cloud billing account that this billing source will represent.
   
   • If you are using the manual input method, enter the Google Cloud Billing Account ID for the Google Cloud billing account you want to add. You can find it in the Google Cloud console by selecting the project, clicking Billing in the left navigation menu, clicking Go to Linked Billing Account. The billing account ID is listed after the billing account name.
10. In the Big Data Billing Export Project ID dropdown, select the Google Cloud project where the billing account selected above is exporting financial data to BigQuery.
    • If using the manual input method, enter the Big Data Billing Export Project ID. You can find it in the Google Cloud console by clicking the dropdown in the blue ribbon. The project ID is displayed next to the name of the project housing your service account. This may be a variation of your project name with a unique identifier on it.
11. In the Big Query Billing Export Dataset ID dropdown, select the BigQuery dataset ID where the billing account selected above is exporting its financial data.
    • If the table where the billing account is exporting data is unusually named (usually gcp_billing_export_v1_{BILLING ACCOUNT NUMBER}), override the default table name by checking the Override the Default Table Name checkbox.
    • If using the manual input method, enter the Big Data Billing Export Dataset Name. You can find it in the Google Cloud console by selecting the project, and navigating to Big Data > BigQuery. The name of your project is shown in the left navigation menu, and the dataset name will display below.
12. Ensure the This Billing Source Supports Google Cloud Project Creation option is enabled.
13. Click Test Billing Source. If you receive an error message, verify your credentials and permissions.
14. Click Create Billing Source.