remove roles/billing.user from required roles

Author: Zheng Qin

metadata.yaml

@@ -359,12 +359,11 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/resourcemanager.organizationAdmin
           - roles/serviceusage.serviceUsageAdmin
-          - roles/billing.user
           - roles/iam.serviceAccountAdmin
           - roles/iam.serviceAccountUser
           - roles/logging.logWriter
-          - roles/resourcemanager.organizationAdmin
     services:
       - cloudbilling.googleapis.com
       - cloudresourcemanager.googleapis.com

modules/budget/metadata.yaml

@@ -122,7 +122,6 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/billing.budgetAdmin
           - roles/logging.logWriter
     services:
       - billingbudgets.googleapis.com

modules/fabric-project/metadata.yaml

@@ -153,8 +153,8 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/resourcemanager.projectIamAdmin
           - roles/logging.logWriter
+          - roles/resourcemanager.projectIamAdmin
     services:
       - cloudresourcemanager.googleapis.com
       - serviceusage.googleapis.com

modules/gsuite_enabled/metadata.yaml

@@ -250,8 +250,8 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/logging.logWriter
           - roles/cloudidentity.groupMemberAdmin
+          - roles/logging.logWriter
     services:
       - cloudidentity.googleapis.com
       - serviceusage.googleapis.com

modules/project_services/metadata.yaml

@@ -104,8 +104,8 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/logging.logWriter
           - roles/serviceusage.serviceUsageAdmin
+          - roles/logging.logWriter
     services:
       - serviceusage.googleapis.com
     providerVersions:

modules/shared_vpc_access/metadata.yaml

@@ -106,9 +106,9 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/logging.logWriter
           - roles/compute.networkUser
           - roles/iam.serviceAccountUser
-          - roles/logging.logWriter
     services:
       - compute.googleapis.com
       - serviceusage.googleapis.com

test/setup/iam.tf

@@ -53,13 +53,11 @@ locals {
     core_project_factory = [
       "roles/resourcemanager.projectCreator",
       "roles/resourcemanager.projectDeleter",
-      "roles/billing.user",
       "roles/resourcemanager.projectIamAdmin",
       "roles/compute.networkUser",
       "roles/logging.logWriter",
     ]
     budget = [
-      "roles/billing.budgetAdmin",
       "roles/logging.logWriter",
     ]
     app_engine = [
@@ -69,7 +67,6 @@ locals {
     root = [
       "roles/resourcemanager.organizationAdmin",
       "roles/serviceusage.serviceUsageAdmin",
-      "roles/billing.user",
       "roles/iam.serviceAccountAdmin",
       "roles/iam.serviceAccountUser",
       "roles/logging.logWriter",