Set up billing with pods in the Workbench UI

Purpose: This document describes how Verily Workbench admins can create and manage pods for Workbench billing purposes.

Note: This guide includes steps for setting up and managing billing via the Workbench web UI for Google Cloud accounts. For CLI instructions, please see Set up billing with pods with the Workbench CLI.

Introduction

Verily Workbench enables users to take advantage of public cloud platforms for storage, compute, and other services. An important step in user setup is to enable Workbench to create resources and perform cloud operations that have cloud costs associated with them, with flexibility on who is billed. This document describes the steps to enable and manage the association between user profiles and how cloud services are paid for.

For more information about what Workbench operations lead to cloud charges and how to manage cloud costs, see Cloud cost management.

What is a pod?

A pod is a way of organizing workspaces, people, and resources within an organization, so that they share the same cloud platform and billing. Each pod is linked to a cloud account, which is used for billing. One pod can be used for many workspaces. Since pods are linked to cloud accounts, the pod used determines which cloud platform the workspace belongs to.

With billing controls at a pod level, users within one organization can choose to use multiple billing accounts, and users across organizations can be allowed to collaborate in a given pod.

Institutions can use pods to connect people and workspaces to cloud infrastructure and billing.

How pods work

Each pod is linked to a cloud account, which is used for billing. One pod can be used for many workspaces. Since pods are linked to cloud accounts, the pod specified upon workspace or data collection creation determines which cloud platform (Google Cloud Platform or Amazon Web Services) the workspace or data collection belongs to.

Pods are administered by organizations ("orgs"). The image below illustrates the relationship between a pod and an org.

To create a pod, a user must have the Organization Admin or Pod Manager role. For more information on organization-level roles and permissions, see Organization roles and permissions.

When a Pod Manager creates a pod, they can then administer it by automatically being granted the Pod Admin role on that pod. Pod Admins can grant permission to other users or groups to use the pod. Users can be granted permission to access as many pods as needed.

When a user creates a workspace or data collection, they pick the pod in which to allocate the workspace or data collection, chosen from the pods they have permission to access. (As with pods, workspaces can be shared with users from other organizations.)

Use Workbench without belonging to a pod

You don’t need to be a pod member to use some Workbench features. For example, you can:

• Browse read-only any workspaces to which you have been granted Reader access
• Work read-write in any workspace to which you have been granted Owner or Writer access

For more information about workspace permissions, see Access control and sharing.

Pod roles and permissions

The table below shows pod-level roles and permissions. Note that Pod Manager is not on this list because it is an organization-level role.

• Note: Pod admins will need to have pod user access as well to perform these actions.

How to create a pod

Video tutorial

Learn how to set up billing with pods by watching the video below.

Step-by-step guide

Step 1: Create a Cloud Billing account

To use an existing Cloud Billing account, your Google Cloud account will need access to the Billing account that you use. The setup process will check that you have access permissions.

To set up billing for yourself, follow Google's instructions to create a new self-serve Cloud Billing account. Note that while you'll need to set up some billing method, you may also be eligible for $300 in free credits from Google. Information and instructions for usage can be found at Free cloud features and trial offer.

Step 2: Grant permission to Workbench to use the Billing account

Sign in to the Billing account management page in the Google Cloud console. Check the box for the relevant account. An Account Profile panel will open. Click the Add principal button.

Enter billing@workbench.verily.com in New principals and assign the role to Billing Account User. Click Save.

Step 3: Allow Workbench to confirm your access to the Billing account

You must also allow Workbench to confirm your account's access to a given Google Cloud Billing account. This allows Workbench to check that you have authority to use a billing account ID for a pod.

In the Workbench web UI, go to the Linked accounts section in your profile. Click the Link account button in the Google tile.

A Sign in with Google dialog will open. You may first be asked to sign in to Verily Workbench. If so, click Continue.

Next, you'll see a screen indicating that Workbench wants access to your Google Account. Check the box next to View and manage your Google Cloud Platform billing accounts and then click Allow.

Step 4: Create a pod

Click the + New Pod button on the Pods page of the Workbench web UI. If you see an alert prompting you to link your Google Cloud account, click Go to accounts to complete this step first.

After you've linked your account, complete the fields to create a new pod. You'll need to know the 18-character Google Billing account ID of the GCP account that you want to use. You can find this on your billing account management page. Click Create pod.

You'll see your new pod listed on the main Pods page. You can now use this pod when creating new workspaces. Enterprise users can also use the pod for creating new data collections. See below for more details.

How to update a pod (for Pod Admins)

Grant permission or revoke users’ access

A Pod Admin may grant use of the pod to other Workbench users, or revoke that access.

From the Pods page, click the name of the pod you want to update. Select the Permissions tab and click the Assign roles button to grant User or Admin roles to other Workbench users.

You can also update a user's role from the Permissions tab or remove them from a pod entirely.

Update a pod's billing information or description

You can update a pod's description, billing account ID, and pod ID (must be unique). You cannot modify the organization.

Click the Edit button at the top right of a pod's details page. A dialog will open, allowing you to edit the pod's details. Click Update to save your changes.

Delete a pod

You must contact Workbench support at workbench-support@verily.com to delete a pod.

Use a pod when creating resources

When you create a new workspace or data collection, you select the pod you want to use for that resource.

For example, create a new workspace by navigating to the Workspaces page and clicking + New workspace. Select the pod from the dropdown.

Obtain admin access to a pod

As noted above, only Workbench Org Admins or Pod Managers may initially create a pod. After the pod has been created, the Org Admin can grant any user the Pod Admin role, even if the user is not in the same org. Users with the Pod Admin role can then perform pod update actions, including renaming the pod ID, changing the pod’s billing account, and adding additional users.

If you know who your Org Admins are, you can contact them and request to be added as a Pod Admin.

If you don't know who your Org Admins are, please contact Workbench support for help.

Troubleshooting

If you've not been granted use of any pod, or have not been granted permission to create a pod and believe you should have been, please contact your Org Admin or Workbench support for assistance.