gcpdiag sets billing project id for API calls using the X-Goog-User-Project header, either to what was passed as --billing-project, or by default to the project that is being inspected. The reason for this is that otherwise the Oauth client project would be used for billing/quota enforcement.
Unfortunately, this creates a requirement to have the following permission in the inspected project: serviceusage.services.use. That permission is included in the following roles:
- Owner
- Editor
- Service Usage Consumer
Note that Viewer is not enough, so we need to tell users that Viewer+Service Usage Consumer is required.
gcpdiag sets billing project id for API calls using the X-Goog-User-Project header, either to what was passed as --billing-project, or by default to the project that is being inspected. The reason for this is that otherwise the Oauth client project would be used for billing/quota enforcement.
Unfortunately, this creates a requirement to have the following permission in the inspected project:
serviceusage.services.use. That permission is included in the following roles:Note that Viewer is not enough, so we need to tell users that Viewer+Service Usage Consumer is required.