CustomRole.yaml

# This was retroactively put together to match a role that is already in
# production. It's not entirely clear why it was built this way, for example
# why all of the permission exclusions from roles/billing.viewer
#
# TODO: CustomRole is a brittle name, we should migrate to a better named role
title: Billing Viewer
description: View access to billing info
name: CustomRole
include:
  roles:
  - roles/billing.viewer
  - roles/browser
  permissions:
  # not sure what role this permission comes from
  - billing.resourceCosts.get
exclude:
  permissionRegexes:
  # unclear why the exclusion of billing.account.* except getSpendingInformation
  - ^billing.accounts.get$
  - ^billing.accounts.getPaymentInfo
  - ^billing.accounts.getUsageExportSpec
  - ^billing.accounts.list
  # unclear if these were intentionally excluded
  - ^consumerprocurement.
  - ^dataprocessing.
  - ^recommender.
  # we may want to allow these two for org hierarchy navigation
  - ^resourcemanager.folders.
  - ^resourcemanager.organizations.
  - getIamPolicy$