Learn how to use permissions (roles) and managed groups to control how much - and with whom - you share in Terra. Note that Terra workspace permissions determine who can incur GCP costs for an analysis. All workspace costs are billed through the Terra Billing project you assign to  th workspace when you create it.   

Contents

Controlling access to resources (data and analysis tools in workspaces, and billing) 
   - Workspace permissions (i.e. who can analyze, access and share resources)
   - Billing permissions (i.e. who can create Billing projects and workspaces)
   - Managed groups - Enabling large sets of users to access resources
Best practices - Using a group to share resources 
Evolution of permissions - a lab scenario 

Controlling access to resources (data and analysis tools in workspaces, and billing)

You may already be familiar with the idea of using permissions (aka "roles") to control what collaborators can do with shared resources (such as datasets or analysis tools). Roles and permissions are "granted" by the owner (or other person with the right permissions). Typical roles include owner, administrator, and user.

In Terra, you can assign roles for each resource (Google Cloud Billing account, Terra Billing project, and workspace) in boxes in the diagram below. Blue boxes are Google resources and grey are Terra resources. Read on for more details about what roles and permissions of each resource allow. 

Workspace permissions/roles

Workspace permissions control who can analyze, access, and share data.

When you share a workspace, you grant each collaborator a role, or permission level, in the share screen (screenshot at left). Note that collaborators with can-compute access can incur costs, even if they are not in the workspace Billing project.

Workspace (not billing) permissions determine who can incur GCP costs

Workspace roles that allow users to incur costs include "Writer" and "Owner" and anyone with "Can-compute" permission.  Note that workspace creators are owners, by default When you create a workspace, Terra automatically makes you the "owner". Owners control who can share the workspace, access data and accrue costs (run workflows or interactive analyses) by assigning roles (permission) to collaborators.

Billing permissions/roles

Roles on a Cloud Billing account or Terra Billing project determine who can create billing projects and workspaces (respectively).

Billing resources in Terra include Google Cloud Billing accounts and Terra Billing projects. Access to billing (i.e. accounts and projects) allows you to create resources (i.e. Terra billing projects and workspaces, respectively). Google Cloud Billing account owners, admins, and users can also access workflow spend reporting in Terra, detailed cost breakdowns in GCP and set budget alerts (in GCP console).

Billing project roles don't directly affect who can work in a workspace

Billing project roles determine whether you can create resources like projects or workspaces. Note that the creator is the initial owner, by default (but this can be modified). Once someone creates a workspace using a Terra Billing  project, they will be able to accrue costs (charged to that Terra Billing project) Workspace permissions are what determine who can incur cost in a workspace. Workspace permissions can be very granular. Workspace owners can grant roles including "can-compute" or "can share" as well as the traditional "Owner," "Reader," and "Writer" roles. Note that a workspace creator is the owner by default.

Google Cloud Billing account and Terra Billing project roles

• Administrator - can see and manage all billing aspects
• Viewer - can view billing account information 
• User - can access Billing account (to create Terra Billing projects)

	Workspace creators are owners by default
	When you create a workspace, you are automatically the owner. Owners control who can share the workspace, access data, and accrue costs (run workflows or interactive analyses) by assigning roles (permission) to collaborators.

Example cases (some unintuitive billing permissions scenarios)

• A Billing project user won't have access to a workspace created by a collaborator under the same Billing project without the right workspace permission. The workspace owner would need to share the workspace and give them permission. 
  
  
• Removing collaborators from a Google Cloud Billing account or Terra Billing project means they cannot create Terra Billing projects or workspaces (respectively). It does not impact their ability to accrue charges in a workspace where they already have "can-compute" permission.

Managed groups - Enabling many users to access the same resources

A collaborative team may have many team members, numerous workspaces and even separate billing projects. To streamline resource management, especially since teams often change, owners can assign permissions (roles) to a managed group as well as to an individual. A managed group could include everyone in a research team, for example, who might need access to the same workspace or billing project.

Best practices for managing changing teams with groups

Groups are especially useful when team members change. Owners can simply adjust the group membership in the Groups page of Terra. This automatically updates the users for every resource shared with the group. This way, owners don't have to update every individual workspace, billing project etc. 

Roles for managed groups

• Member - any individual in the group. When any form of access is granted to a group, the members include all who have that access.
• Admin - may add or remove members or other admins to or from the group. Admins are also members of the group.
• Admin-notifier - users who are allowed to send notifications to the admins of a group. When a group is created, this access policy is set to public - meaning all users are able to request access to a group.

Group roles versus resource permissions

Permissions for managed groups are not the same as permissions for other resources. If a group is given access to a workspace, the workspace owner controls the role of the group with respect to the workspace (i.e. reader or writer), but the group's owner controls the role of the user in the group. For example, if a group has the role of writer (not owner) in a workspace, even group admins will only have writer access. The admins would need to be given writer access individually.

Create your team Terra group in four steps

1. Go to your Groups page (Main menu > Groups from the top left of any page in Terra).

2. In the Create a New Group card, click on the blue "+" icon.

3. Enter your human-friendly team group name and click the Create Group button.

4. You can share resources with the group just like with an individual.

Note that the group admin can change who is in the group at any time in Terra.