GoogleCloudPlatform / GoogleCloudPlatform/pubsec-declarative-toolkit

GCP Organization removal and Billing ID multi-organization sharing procedures

Open
#659 0 comments 0 reactions 1 assignee Claimed by @fmichaelobrien View on GitHub
billing documentation onboarding
Dominant language
Shell
Stars
36
Forks
26
PR merge metrics
No merged PRs in 30d

Description

In answer to your question about deleting secondary GCP organizations and associated billing ID/project links

I have prototyped several onboarding/offboarding scenarios around the following operations around shared billing accounts and orgs - they are documented in both LZ2 and LZ1 here
https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/wiki/Onboarding#billing
https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/blob/main/docs/google-cloud-onboarding.md

specifically on organization deletion
https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/wiki/Onboarding#gcp-organization-deletion
https://cloud.google.com/billing/docs/how-to/billing-access

Note:
billing IDs are associated only at the project level (not between orgs) - administered by users that were granted billing and/or iam roles by the owner of the BID (billing id)
billing roles are separate from IAM roles - you can be both/either a BAA/BAU in billing and IAM - however it is the billing side that allows for associating BIDs in other orgs via principals in those orgs
IAM roles can also be assigned to any user in any other org - for example you can grant org admin - and administer the shared org from the shared-to org
There is the concept of owning org for a BID - in the shared billing model where a 3rd party distributes billing IDs (BIDS) - this will be out of the control of the shared-to org - they will need to request billing/iam removal from the owning org.

- adding/removing a 2nd orgs' projects associated with a shared billing account
- adding/removing a 2nd orgs' IAM principals - super admins, users, and service accounts - with roles in the sharing org (billing and iam roles)
- fully deleting a GCP org and the originating super admin google account

Discussion tracked on issue ID# (for reuse)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.