Enabling and Disabling a Google Cloud Platform (GCP) Billing Account

After you create your GCP billing account or receive permission from your research team to use an existing one, you’ll complete a couple of tasks to set up for use within the All of Us Researcher Workbench. If you haven’t set up your GCP billing account yet, you’ll need to do that first.

Linking your GCP billing account to the Researcher Workbench

To link your GCP billing account to the Researcher Workbench

Once your GCP billing account is established, you will need to grant permission to the workbench to use the billing account for connection to pods and workspaces.

Steps to complete in GCP Billing Console 

1. Log in to GCP Billing Console.
2. Select the billing account to be used.
3. Choose “Account Management” on the left hand panel.
4. Navigate to “My Billing Account” on the right hand panel.
5. Select “Add Principal.”
6. Add billing@workbench.verily.com as a "Billing Account User" and save.

• Note: Adding this username as “billing user” on your GCP account only allows for a connection between the Researcher Workbench platform and user accounts to be made. It does not grant view access to the payment or project details of your GCP account. Read about how Google uses role-based permissions to manage billing.

Steps to complete in Researcher Workbench

1. In the Researcher Workbench, select your profile > “Linked accounts”
2. Select “Link Account” under the Google section.
3. This will bring up a dialog window. You will need to sign in with your @researchallofus.org username and check the "View and manage your Google Cloud Platform billing accounts" box.

4. Allow Verily Workbench access to the GCP account. 

   

Creating a billing pod in the Researcher Workbench

When you create a workspace in the Researcher Workbench 2.0, you will be prompted to select a pod. Billing pods are created and linked to a Google Cloud Platform billing account. Consider a billing pod as the GCP billing account.

1. Navigate back to the Researcher Workbench landing page. Select “Pods” on the left hand menu. 

   

2. On the next page, select “New Pod” on the upper right hand side. 

   

3. Enter in the appropriate information related to the GCP billing account for this pod. Then select “Create Pod.”

   

4. After pod creation, you can view your new pod under the “Pods” page. This page will show both the pods that you have created, and those to which others have granted you access.
5. You can now use the pod when creating new workspaces.

Billing is managed at the workspace level. Note: Once you select a billing pod for the workspace, it cannot be changed. You will be required to duplicate the workspace to add a new billing pod.

Pod Permissions - Upon pod creation or update, do not share your pod with the groups aou-prod/aou-prod-ct or aou-prod/aou-prod-rt. This will share your pod will all researcher workbench users, meaning they will have access to use your pod in their own workspace. Instead, to share your pod, please navigate to "Permissions" and add individual users.

Disabling your GCP billing account

To disable your GCP billing account to the Researcher Workbench

Billing is managed at the workspace level. In GCP billing terms, workspaces are referred to as “projects” and are listed that way in your GCP billing account console.

To fully remove permission for a researcher to bill for existing and future work, you’ll need to remove both the  account and existing workspace projects from the GPC account in the GCP billing console. 

To remove a GCP billing account entirely from the Researcher Workbench 

1. Log in to GCP Console Billing.
2. Select the billing account to be used.
3. Click “Manage” in the top right next to "Billing account."
4. Navigate to the Role/Principle list.
5. Expand the section header labeled “Billing Account User.”
6. Use the edit icon to remove the “billing@workbench.verily.com" account for which no future billing permissions are allowed.

Note - once a valid GCP billing account is removed from a workspace or project, stored cloud resources such as workspace buckets may be deleted. 

To remove access to a billing pod in the Researcher Workbench

If you are a pod admin in the Researcher Workbench, you can remove user access to a pod by the following: 

1. Navigate back to the Researcher Workbench landing page. Select “Pods” on the left hand menu. 
2. Select the billing pod of your choice
3. Click “Permissions”, which will display a page with a full list billing pod users and admins.
4. Select the three dots on the right hand side of the user name > 'Remove'

Note: Workspaces will continue to incur a charge of $0.20 a month through the billing account unless they are deleted inside the Researcher Workbench. Applications that are left running when a project gets disabled will continue to charge until the application is turned off and data stored in a workspace bucket will continue to incur costs.

As a best practice when disabling projects, researchers should log in to the Researcher Workbench, delete projects they no longer need, and ensure no applications are accidentally running.

Next article