In the following sections, you create a service account and upload its information to Kion. Before you do that, you must create a dedicated Google Cloud project to house the service account. If you've already created a Google Cloud project for the Kion deployment, you can add the service account to that project and skip to the "Create a Service Account and Service Account Key (SAK)" section below.

If you wish to build out your resource hierarchy before creating this project, you can follow steps 5 and 6 in Google's onboarding checklist before you create the project, but this is not required.

The service account must be located in its own Google Cloud project.

Google Cloud projects are different from Kion projects. Google Cloud projects are equivalent to Kion accounts.

To create a project for the service account:

1. Log into your G Suite account and navigate to console.cloud.google.com.
2. On the top blue ribbon, a dropdown menu will say Select a project. Click this menu to open the project selection screen.
3. On the project selection screen, click New Project on the top right.
4. Enter a Project name.
5. Select the Organization and Location (parent organization or folder) from the dropdown menu.
6. Set and take note of the Project ID that is shown below the Project Name field. You will need this ID later.
7. Click Create.

1. Log into your G Suite account and navigate to console.cloud.google.com.
2. Select the project you created for your service account from the dropdown menu on the top blue ribbon.
3. In the left navigation menu, click APIs & Services.
4. Click Enable APIs and Services at the top of the screen.
5. Search for and select Cloud Resource Manager API.
6. Click Enable.
7. Click the back arrow until you have reached the APIs & Services page.
8. Search for and select Cloud Billing API.
9. Select Enable APIs and Services.
10. Click the back arrow to return to the API Library.
11. Search for and select Identity and Access Management (IAM) API.
12. Click Enable.

Next, create a service account within Google Cloud that represents your Google Cloud organization. A service account is a special type of Google account intended to represent a non-human user that needs to authenticate and be authorized to access data in Google APIs. You can read more about service accounts in Google's service account documentation.

To create the service account:

1. Log into your G Suite account and navigate to console.cloud.google.com.
2. Select the project you just created in the previous section from the dropdown menu on the top blue ribbon.
3. In the left navigation menu, click IAM & Admin > Service Accounts.
4. If prompted, select the card for the project you created.
5. Click Create Service Account below the top ribbon.
6. Enter a Service Account Name and an optional Description.
7. Click Create and Continue.
8. Skip the Grant the service account access to project section by clicking Continue.
9. Optional: You can grant other users access to this service account. You can add a user's Google email address, Google Groups email address, Service account address, or G Suite domain to either text entry field. Users added to the Service Account Users Role field will become users. Users added to the Service Account Admins Role field will become administrators. For more information, see the Google documentation on Managing Service Account Impersonation.
10. Click Done.
11. If you already have your billing account(s) set up, you should be prompted to choose one to link to the project during this process. If you only have one billing account set up, it will be selected automatically. If you haven't set up a billing account yet or need to change it later, we go over the process in the Create a billing account within Google Cloud and attach it to the service account section below.
12. Copy the email of the service account you just created. You will need it in the next section when assigning org-wide permissions.

To create a service account key:

1. In the list of service accounts for your project, click the ellipsis menu icon under Actions on the right of the service account, and select Manage Keys.
2. Select Add Key > Create New Key.
3. Set the Key Type to JSON.
4. Click Create. The SAK JSON file downloads to your computer. Save this file to a safe location.

In addition to the roles you just assigned to the project housing the service account, you need to assign the service account permissions at the organization level.

There are two approaches you can take when granting permissions. You can grant the service account high-level permissions, which ensures the necessary permissions are in place for all current and future Kion features, or you can grant minimal permissions, which may require permission modifications when new features are released.

Follow one of the following guides to grant permissions to your service account.

If the BigQuery financial export is not present in one of the Google Cloud projects under the organization or folders you specified above, assign the service account permissions at the project level where BigQuery is located.

To assign BigQuery permissions:

1. Log into your G Suite account and navigate to console.cloud.google.com.
2. Select your project containing BigQuery from the dropdown menu on the top blue ribbon.
3. In the left navigation menu, click IAM & Admin > IAM.
4. Click Add.
5. Enter the email of the service account.
6. Add the following roles:
   • BigQuery > BigQuery User
   • BigQuery > BigQuery Data Viewer
7. Click Save.

If you have an existing billing account, you can link that account instead of creating a new one. After step 3, select Link a Billing Account and follow the prompts.

An account with the Billing Account Creator role for your organization is required to complete this step.

To add a billing account and attach it to the service account:

1. Log into your G Suite account and navigate to console.cloud.google.com. For this process, you must log in as a user with the Billing Account Creator role.
2. Select the project you created for your service account from the dropdown menu on the top blue ribbon.
3. In the left navigation menu, click Billing.
4. Click Manage Billing Accounts.
5. Click Add Billing Account.
6. Select your organization from the dropdown menu.
7. Enter an account name.
8. Select your country.
9. Click Continue.
10. Enter your account information. Please note that your selections here may be used for tax and identity verification. For more information, see Google's Create, Modify, or Close Your Billing Account article.
11. Click Submit and Enable Billing. By default, the person who creates the billing account is made a Billing Account Administrator for the billing account.
12. From the home screen, in the left navigation menu, click Billing.
13. Select your organization from the dropdown menu and click the My Projects tab.
14. Click the ellipsis menu icon under Actions on the right of the service account and select Change Billing.
15. Choose the new billing account from the list.
16. Click Set Account.

Create a BigQuery dataset and enable the export of data to BigQuery to send Google Cloud information to Kion.

To set up billing data export to BigQuery:

1. Log into your G Suite account and navigate to console.cloud.google.com.
2. Select the project you created for your service account from the dropdown menu on the top blue ribbon.
3. In the left navigation menu, scroll to the Big Data section and click BigQuery.
4. In the Explorer menu, select your project.
5. Click the ellipses menu next to the project ID, and select Create Dataset.
6. Enter a Dataset ID. For example, kionbillingdata.
7. Select a multiple region location identifier as the Data location. Do not select an individual region.
8. Click Create dataset.
9. In the left navigation menu, click Billing.
10. Click Go to Linked Billing Account.
11. In the billing navigation menu on the left, select Billing export.
12. Under the Standard usage cost section, click Edit settings.
13. Select your project.
14. Select the dataset you created.
    The BigQuery API is required to export data to BigQuery. If the project you selected doesn't have the BigQuery API enabled, you will be prompted to enable it. Click Enable BigQuery API to enable the API.
15. Click Save.
16. Under the Detailed usage cost section, click Edit settings.
17. Select your project.
18. Select the dataset you created.
19. Click Save.

To enable OAuth to support GCP federation for users:

1. Log into your G Suite account and navigate to console.cloud.google.com.
2. Select the project you created for your service account from the dropdown menu on the top blue ribbon.
3. In the left navigation menu, click APIs & Services.
4. Click OAuth consent screen.
5. Select Internal and click Create.
6. On the app registration screen, enter the app name, user support email, and developer contact information email.
7. Click Save and Continue.

To generate OAuth access keys to support GCP federation for users:

1. Log into your G Suite account and navigate to console.cloud.google.com.
2. Select the project you created for your service account from the dropdown menu on the top blue ribbon.
3. In the left navigation menu, click APIs & Services.
4. Select Credentials.
5. Select Create Credentials > OAuth client ID.
6. From the Application type dropdown, select Web application.
7. Enter an application name.
8. In the Authorized Redirect URIs section, click Add URI and enter: https://Kion.example.com/api/v3/account/link-google-callback.
9. Change "kion.example.com" to the URL of your Kion instance.
10. Click Create.
11. Store the client ID and client secret for use in the Kion application.

1. Log in to Kion.
2. In the left navigation menu, click Accounts > Google Cloud Service Accounts.
3. Click Add New on the top right.
4. Enter a Name and Description for the service account.
5. Select Enable IAM Federation.
6. Enter the OAuth Client ID and OAuth Client Secret you created above. This allows federation into GCP subscriptions for users.
7. Upload the Google Cloud service access key by clicking Upload and selecting the JSON file you saved in section 3.
8. Click Create Google Cloud Service Account.

1. Log in to Kion.
2. In the left navigation menu, click Accounts > Billing Sources.
3. Click Add New on the top right.
4. For Account Type, select Google Cloud.
5. Enter a Billing Source Name.
6. Choose a Billing Start Date. This is the earliest month Kion will try to fetch financial data for the billing source.
7. Select the Service Account that will be used to access the billing data.
8. Leave the Input Type dropdown set to Auto-fill. This allows the form to query information from the Google API as you fill in the remainder of the form.
9. In the Google Cloud Billing Account dropdown, select the Google Cloud billing account that this billing source will represent.
   
   • If you are using the manual input method, enter the Google Cloud Billing Account ID for the Google Cloud billing account you want to add. You can find it in the Google Cloud console by selecting the project name from the dropdown in the blue ribbon, clicking Billing in the left navigation menu, clicking Go to Linked Billing Account, and looking in the box that says Billing Account on the right. The billing account ID is the ID listed after the billing account name.
10. In the Big Data Billing Export Project ID dropdown, select the Google Cloud project where the billing account selected above is exporting financial data to BigQuery.
    • If using the manual input method, enter the Big Data Billing Export Project ID. You can find it in the Google Cloud console by clicking the dropdown in the blue ribbon. The project ID is displayed in the ID column next to the name of the project housing your service account. This may be a variation of your project name with a unique identifier on it.
11. In the Big Query Billing Export Dataset ID dropdown, select the BigQuery dataset ID where the billing account selected above is exporting its financial data.
    • If the table where the billing account is exporting data is unusually named (usually gcp_billing_export_v1_{BILLING ACCOUNT NUMBER}), override the default table name by checking the Override the Default Table Name checkbox.
    • If using the manual input method, enter the Big Data Billing Export Dataset Name. You can find it in the Google Cloud console by selecting the project name from the dropdown in the blue ribbon, clicking BigQuery in the left navigation menu under Big Data. The name of your project will display in the left navigation menu, and the dataset name will display below.
12. Click Test Billing Source. If you receive an error message, verify your credentials and permissions.
13. Click Create Billing Source.

Add your Google Cloud projects to Kion as accounts. Google Cloud projects are different from Kion projects. Google Cloud projects are equivalent to Kion accounts.

Your service account is already connected, so there's no need to add the project that houses the service account.

To add your Google Cloud projects to Kion as accounts, see Add an Account.