Overview
This guide explains how to connect GCP to Opriven for traces, logs, and metrics, and add optional permissions for cost optimization.
Set up in Opriven
Go to the GCP integration setup in the Opriven dashboard.
Prerequisites
A GCP account with permissions to create service accounts
Access to IAM & Admin settings
Admin access to the projects you want to monitor
Setup
GCP Console
Terraform / IaC
1
Create the service account
Go to
Google Cloud Console
Navigate to the project where you do your monitoring/observability work
Go to
IAM & Admin > Service Accounts
Click
+ CREATE SERVICE ACCOUNT
Fill in the details:
Name:
opriven-monitoring
ID:
opriven-monitoring
Description:
Service account for Opriven monitoring integration
Click
CREATE AND CONTINUE
Copy the created service account email address
2
Grant permissions to each project
For each project you want to monitor (including the one where you created the service account):
Navigate to the target project
Go to
IAM & Admin > IAM
Click
+ GRANT ACCESS
In
New principals
, enter the service account email:
opriven-monitoring@[YOUR-PROJECT-ID].iam.gserviceaccount.com
Assign these roles:
Monitoring Viewer
(roles/monitoring.viewer)
Logs Viewer
(roles/logging.viewer)
Cloud Trace User
(roles/cloudtrace.user)
Error Reporting Viewer
(roles/errorreporting.viewer)
Cloud Asset Viewer
(roles/cloudasset.viewer)
Click
Save
Repeat for all projects you want to monitor
3
Generate the JSON key
Go to
IAM & Admin > Service Accounts
Click on your
opriven-monitoring
service account
Go to the
Keys
tab
Click
ADD KEY > Create new key
with JSON format
1
Create service account and permissions
Create the service account in your monitoring/observability project and add IAM bindings for each project you want to monitor, granting these roles:
roles/cloudasset.viewer
roles/errorreporting.viewer
roles/monitoring.viewer
roles/logging.viewer
roles/cloudtrace.user
2
Generate JSON key
Create a JSON key for the service account. This can be done through IaC output or manually through the console.
Configure the Opriven integration
Navigate to the Opriven GCP integration page
Upload or paste the contents of the downloaded JSON key file
Specify the project IDs you granted permissions to
Required permissions summary
The service account will have these read-only permissions across your specified projects:
Role
Access
Monitoring Viewer
Read access to metrics and monitoring data
Logs Viewer
Read access to Cloud Logging data
Cloud Trace User
Read access to distributed tracing data
Error Reporting Viewer
Read access to error groups and events
Cloud Asset Viewer
Read access to cloud resource metadata and configurations
Cost optimization permissions (Beta)
These permissions help Opriven identify unused or oversized infrastructure, assess existing commitments, and estimate potential savings using your resource usage and pricing.
To let Opriven assess your GCP resources for cost-saving opportunities, add the permissions below to the service account created above or already connected to Opriven. Reuse its existing JSON key and keep its current permissions.
Project access
This role provides read-only access. It does not permit changing or deleting infrastructure.
Open
IAM & Admin > IAM
in each relevant project. Find the existing service-account email and click
Edit principal
, or select
Grant access
if it is not listed. Add the role below:
Role
Where to grant it
What it enables
Recommender Viewer (
roles/recommender.viewer
)
Projects included in the cost assessment
Read Google’s optimization recommendations and supporting insights.
Include projects that purchased resource-based commitments, even if they are outside the workload projects.
Billing account access
Billing account access adds the commitment and pricing information that project access alone cannot provide:
Existing API-visible supported spend-based and flexible commitment orders:
the amount purchased, commitment term, and expiry. This helps estimate future commitment costs and account for commitments you already own where coverage is available.
Resource-based committed use discount (CUD) recommendations and insights:
Google’s assessment of additional commitment opportunities across the billing account.
Customer-specific prices:
discover available SKUs and their current account-specific rates to estimate savings using your pricing rather than public list prices.
This supports commitment planning and estimated savings. It does not provide historical billed spend or a forecast of your total cloud bill.
A billing account administrator must grant the following roles to your existing Opriven service account on each billing account included in the assessment.
1
Create the custom role
Using an account with permission to create organization-level custom roles, open
IAM & Admin > Roles
and select the organization that owns the billing account. Create a custom role named
Opriven Cost Viewer
with these permissions:
Permission
What it enables
consumerprocurement.orders.list
List API-visible orders, including supported spend-based and flexible commitment orders.
consumerprocurement.orders.get
Read commitment amounts, terms, and expiry details for a supported API-visible commitment order.
billing.billingAccountPrice.get
Read the current account-specific price for an identified supported usage-rate SKU.
billing.billingAccountSkus.list
List account-visible SKUs and their metadata.
billing.billingAccountPrices.list
List current account-specific SKU prices in bulk.
Create the role at
organization scope
, not project scope. Project-defined custom roles cannot be assigned to billing accounts.
Google’s custom-role instructions
2
Assign the roles
For each billing account, open
Billing
, select the account, and go to
Account management
. Add the existing service-account email as a principal and assign the applicable roles below. If it is already listed, edit its access without removing existing roles.
Role
What it enables
Where to grant it
Opriven Cost Viewer
(created above)
Read supported commitment orders, discover SKUs, and retrieve customer-specific prices.
Relevant billing account.
Spend Based Commitment Recommender Viewer
(
roles/recommender.ucsViewer
, Beta)
Read spend-based CUD recommendations and supporting insights.
Relevant billing account.
Billing Account Usage Commitment Recommender Viewer
(
roles/recommender.billingAccountCudViewer
, Beta)
Read resource-based CUD recommendations and supporting insights.
Billing account when commitment discounts are shared across projects. If discounts apply only to the purchasing project, use
roles/recommender.viewer
on that project instead, as described under Project access.
What billing data is accessible
Order access covers the billing account and can include other Marketplace purchases, not only CUDs. Account-price reads expose customer pricing through Google’s Preview Pricing API.
Check API access
In
APIs & Services > Library
, check that the following APIs are enabled. Enable only those that are missing.
Recommender API
(
recommender.googleapis.com
) for recommendations and insights
Cloud Commerce Consumer Procurement API
(
cloudcommerceconsumerprocurement.googleapis.com
) for existing commitment orders
Cloud Billing API
(
cloudbilling.googleapis.com
) for pricing
Provide Opriven with the project IDs and billing account IDs accessible to this service account.
Permissions and Access
The cost optimization roles add read-only resource, commitment, and pricing access to the monitoring integration. Opriven does not use these permissions to change infrastructure or purchase commitments.