...
The service account key is required for setup in Cloudaware.
...
For Cloudaware to be able to collect the list of Google Billing Accounts, assign the role 'Billing Account Viewer' to the service account* that has access to billing accounts in question.
1. Go to Billing.
...
2. Go to the tab 'My Billing Accounts'. Check the box near the billing account. Click Add Principal on the right to manage permissions.
...
3. Select the service account* and assign the role Billing Account Viewer → Save.
...
*Note that the service account should be added to Cloudaware.
...
A custom role is necessary if you are going to use backups and labels.
Go to IAM & admin, select "Roles" and click +Create Role.
...
Add the name and the description of the custom role. Set 'Role launch stage' as General Availability and click + Add Permissions.
...
Select the following permissions:
...
For backups
...
For labels
...
compute.disks.get
compute.disks.createSnapshot
compute.disks.list
compute.disks.setLabels
compute.snapshots.create
compute.snapshots.delete
compute.snapshots.get
compute.snapshots.list
compute.snapshots.setLabels
compute.zones.get
compute.zones.list
...
bigquery.datasets.update
bigquery.tables.update
cloudsql.instances.update
compute.addresses.setLabels
compute.disks.setLabels
compute.forwardingRules.setLabels
compute.globalAddresses.setLabels
compute.globalForwardingRules.setLabels
compute.images.setLabels
compute.instances.setLabels
compute.snapshots.setLabels
compute.targetVpnGateways.setLabels
compute.vpnTunnels.setLabels
dataproc.clusters.update
dataproc.jobs.update
cloudkms.cryptoKeys.update
storage.buckets.update
Assign the custom role to the service account you have just created (IAM & admin → IAM → select the service account).