Kyndryl's Cost and Asset Manager (CAM) provides a comprehensive solution for monitoring and analyzing cost and usage data through GCP billing and resource metrics. This guide offers detailed instructions for configuring GCP accounts to integrate seamlessly with CAM, ensuring effective cost and asset management. You can securely manage and access data by leveraging delegated access and role-based access control while adhering to compliance requirements. Following this guide will enable you to utilize CAM's features effectively, optimize costs, and enhance resource utilization across your GCP accounts.

Before starting the onboarding process, ensure you have:

Be a CAM Administrator or have the appropriate permissions to perform all steps.
A GCP account with the necessary permissions.
The billing account number and the subscription details.
The project ID and other details for setting up credentials.
Details for creating the credentials: Service Account Key.
Admin/Co-admin access is required to set up the delegated access, run the scripts for implementation, and obtain configuration information.

This documentation aims to help ingest GCP data into CAM securely using best practices and without asking for customer credentials. The recommendation is to use delegated access and role-based access control to pull Cost Asset Metrics and Recommendation data to support the Inform and Optimize data of the FinOps lifecycle.

The Service Account should be separate from Billing or Asset Accounts. Follow these steps to set up the Service Account:

Login to your Kyndryl application console
Navigate to Admin - Provider Account
Click on New Master Account and select GCP
Enter a Name and Account number
Click on Add Credentials
Provide the name, purpose, credential values (account number and API key), and context, then save it.

Follow these steps to add asset accounts:

Login to your Kyndryl application console
Navigate to Admin - Provider Account
Click on New Asset Account and select GCP
Enter a Name and Account number
Click on Add Credentials
Provide the name, purpose, credential values (account number and API key), and context, then save it.

Use the Manual Ingestion screen to ingest and enrich data from either a public or a custom provider.

Navigate to
Cost & Asset Management
>
Settings
.
Select
Manual Ingestion
from the list.
Select the
Public Provider
tab.
Select the provider
'GCP'
from the list with the data needed for the ingestion.
Click
Start Ingestion.

Users can initiate and schedule the provider's ingestion directly on the Cost and Assets Management Platform.

Click on the ellipsis located on the left side of your Kyndryl application screen and go to the Cost & Asset Management drop-down menu.
Click on the
Settings
drop-down menu and select
Scheduled Jobs
.
A new window will display with the Scheduled Ingestion List, which contains the name of the ingestion, creation date, next run time, name of the user that initiated the ingestion, recurring, and status.
To create a new Scheduled Job, click
Add Schedule
.
Add a name on the Job Name bar and select a provider from the drop-down menu on the Provider bar.
Select the schedule frequency by entering the Minute, Hour, Day, Month, and Week in all the cron fields and then click
Schedule
. The default schedule is 12:00 am (midnight) GMT.
To Edit, Pause, or Delete any scheduled ingestion, click on the three-dot menu on the right side of the Scheduled Ingestion name.

The below steps need to be performed on the GCP Portal:

To enable the billing account, please follow the instructions in the link below:

Service Account Setup

Create a new Service Account in GCP. This Service Account will be used for enabling Cloud billing export to BigQuery dataset. (We refer to this service account as "KYNDRYL Service Account" further in the document)
Enable the following permissions for the KYNDRYL Service Account:
BigQuery User
BigQuery Data Viewer
Compute Viewer
Monitor Viewer
ApiGateway Viewer

Refer to: Export Data BigQuery Setup

For GCP labeling job, enable the following permissions for the Service account:
BigQuery Admin
BigQuery Data Owner
Editor

Refer to: Updating Label

Create a Dataset in BigQuery within the GCP portal:

Open the console Navigation menu and select BigQuery.
Open SQL workspace, you will get the project name from where you wish to capture the cost and usage data.
Click on the vertical dots, you will see an option to Create dataset.
Enter the Data set ID, select data location. Click on Create Data set button. Note: We support US multi-region as a default one.

Billing Export to BigQuery

Open the console Navigation menu, and then select Billing.
In the Billing navigation menu, select Billing export.
Select the
Big Query export
tab.
Click Edit settings for the ‘Standard usage cost’ section to enable the export and update the export settings.
From the Project list, select the project where your BigQuery dataset is stored.
The project you select is used to store the exported Cloud Billing data in the BigQuery dataset. The Cloud Billing data includes usage/cost data for all projects related to the Cloud Billing account.
From the Billing export dataset list, specify the dataset to export data that was created in step 3 above.
Click
Save
.

Enable the following set of APIs in the GCP portal by following the steps below:

In the GCP portal, Select option “
API’s and services
”
Choose “
Library
”
Search for the below APIs and choose enable button if the API is not enabled already. Screenshots are provided only for reference:

API List	Details fetched
Google Compute Engine API	For CPU utilization
BigQuery API	Asset status (on/off/terminate), Provisioned date, Region
Container Registry API	Asset status (on/off/terminate), Provisioned date, Region
Google App Engine Admin API	Asset status (on/off/terminate), Provisioned date, Region
Google Cloud APIs	Asset status (on/off/terminate), Provisioned date, Region
Google Cloud Datastore API	Asset status (on/off/terminate), Provisioned date, Region
Google Cloud Deployment Manager V2 API	Asset status (on/off/terminate), Provisioned date, Region
Google Cloud Pub/Sub API	Asset status (on/off/terminate), Provisioned date, Region
Google Cloud SQL	Asset status (on/off/terminate), Provisioned date, Region
Google Cloud SQL Admin API	Asset status (on/off/terminate), Provisioned date, Region
Google Cloud Storage	Asset status (on/off/terminate), Provisioned date, Region
Google Cloud Storage JSON API	Asset status (on/off/terminate), Provisioned date, Region
Google Kubernetes Engine API	Asset status (on/off/terminate), Provisioned date, Region
Google Service Management API	Asset status (on/off/terminate), Provisioned date, Region
Google Resource Manager API	Asset status (on/off/terminate), Provisioned date, Region
Google Cloud DNS API	Asset status (on/off/terminate), Provisioned date, Region
Google API Gateway API	Asset status (on/off/terminate), Provisioned date, Region
Google AI Platform Training & Prediction API	Asset status (on/off/terminate), Provisioned date, Region. This permission is required for GCP labeling job
Google Artifact Registry API	Asset status (on/off/terminate), Provisioned date, Region. This permission is required for GCP labeling job
Google Certificate Authority API	Asset status (on/off/terminate), Provisioned date, Region. This permission is required for GCP labeling job
Google Cloud Bigtable API	Asset status (on/off/terminate), Provisioned date, Region. This permission is required for GCP labeling job
Google Cloud Composer API	Asset status (on/off/terminate), Provisioned date, Region. This permission is required for GCP labeling job
Google Cloud Functions API	Asset status (on/off/terminate), Provisioned date, Region. This permission is required for GCP labeling job
Google Cloud Healthcare API	Asset status (on/off/terminate), Provisioned date, Region. This permission is required for GCP labeling job
Google Cloud Key Management Service (KMS) API	Asset status (on/off/terminate), Provisioned date, Region. This permission is required for GCP labeling job
Google Cloud Run Admin API	Asset status (on/off/terminate), Provisioned date, Region. This permission is required for GCP labeling job
Google Cloud Spanner API	Asset status (on/off/terminate), Provisioned date, Region. This permission is required for GCP labeling job
Google Cloud Dataproc API	Asset status (on/off/terminate), Provisioned date, Region. This permission is required for GCP labeling job
Google Cloud Filestore API	Asset status (on/off/terminate), Provisioned date, Region. This permission is required for GCP labeling job
Google Cloud Memorystore for Memcached API	Asset status, Provisioned date, Region