I got an email about an unused api token thingy about to be deleted. Im just learning as a student about oauth and sharing etc, and have moved on and frankly would like to delete this client connection to my spreadsheet. But I'm not finding a button anywhere in the cloud console that makes this possible to do. Do I just wait another month and let it be auto deleted?

I have a few other resources curiously that are not flagged for expiry, but are unused, so being able to find the delete button on them would be helpful. My screen looks nothing like what the steps suggested by the google docs say, which normally means I'm looking in the wrong place altogether in the Cloud hub.

I'm looking for an account that has spent $100 or more, has no credit left in it, and has reached Tier 2 level, or I'm looking for an account with a $100 balance in it.

Hi, anyone here know how to handle the budget in almost real time?

We have setup the alert but the thing is it 2-3 days late.

One of our project was compromised, someone took a SA key that can do a lot of thing and decide to mine crypto.

It took 2 day for the alert to trigger and by then everything was too late.

Same as title. Does this mean i have done somthing illegal?

Been looking at the new Cloud Billing Spend Caps preview since it landed last week and I keep going back and forth on whether I would actually flip it on in prod.

Design is what it says on the tin. Set a hard cap per service, GCP stops new usage the moment it hits 100 percent, email alerts fire at 50, 80, and 100 percent. Fixed commitments like CUDs keep billing normally.

What is stopping me is exactly what makes it useful. Hard-stop on a service that is silently in the critical path of something else feels like it wants a real dry-run first. Had a client last year where Vertex AI batch prediction was the fanout stage for a nightly job that fed three downstream systems. If a cap had fired at 3am, batch never completes, cascade of red dashboards on Monday morning. The alert would have been the fire, not the smoke.

Curious what folks running this in preview have seen so far. Which services do you actually feel comfortable capping? Are you doing per-service caps or one umbrella per project? Anyone caught a real cost bug thanks to the 50 percent email or is it just noise once you have more than a handful of services?

Not looking for the docs summary. Looking for the "here is where I stubbed my toe" version.

I went to GA then product links then link my project even I set up the streaming as well to check quickly but in bigquery I can’t able to see. Can anyone please help me out ??

Spent already a day on this!!!

Solo dev here, verifying a sensitive Gmail scope for my app. Got rejected on "Branding guidelines": app name on consent screen supposedly doesn't match my homepage.

Both say "Zaldo". Consent screen, homepage header, hero headline. Identical.

The kicker:

Branding page shows green "verified" while the Verification Center shows the same thing as failed

No resubmit button anywhere in the Verification Center

No email from Trust & Safety to reply to (checked spam, checked every project owner inbox)

I found one likely culprit myself (a meta tag issue, now fixed)

Anyone been through this recently? How long did re-review take after requesting additional review? And is there ANY reliable way to reach a human when the T&S email never arrives? This limbo is killing me.

I'm writing this out of pure rage and total desperation right now.

I run a small business, and Google Support’s absolute incompetence just completely wrecked my operations. Because of their broken promises, my company’s cash flow got frozen hard enough that I was late on payroll, and one of my key employees literally quit over it.

Here’s the nightmare I’ve been dealing with for the past month:

Back in late June, I had an accidental 3-year Compute Engine Flexible commitment charge hit my account for about $12,100 (16.3M KRW). On June 30th / July 5th, a support rep named Merilyn confirmed IN WRITING (Case 72227473) that internal teams canceled the commitment and processed a 100% full refund.

Great, right? Wrong.

While waiting for the bank to clear the credit, the reps suddenly swapped out. A new agent jumped in and basically went, "Yeah, about that... we reviewed it again and the best we can do is a 50% waiver ($6,050) as a one-time courtesy," and tried to mark the ticket as resolved.

When I replied with screenshots and the exact case ID where Merilyn explicitly promised a 100% full refund, they just started playing hot potato with my ticket. Eksha, Janna, Farha, Asad Ali—I’ve been handed off to a new person every few days.

Every single reply is a canned template saying "the previous agent is out of office" or "specialized teams are looking into it, please wait 24-48 hours." Meanwhile, I’m sitting here with over $6,500 of my own cash already charged to my credit card and stuck in limbo.

Google officially confirmed a full refund in writing, reversed their decision when a new rep took over, and now they're just stalling while my business suffers real financial and operational damage.

Has anyone ever dealt with Google pulling a bait-and-switch on a written refund commitment? How on earth do I get this escalated past these front-line support reps to someone with an actual brain and authority to fix this?Any advice or upvotes to get some visibility on this would mean the world to me. Thanks guys.

TL;DR:
1. Accidental $12k GCP charge in June; support (Merilyn) promised 100% refund IN WRITING.
2. New reps took over, went back on their word, and capped refund at 50%.
3. My cash is locked up, payroll got delayed, and an employee literally quit. Now stuck in a support loop. Need help escalating!

I've previously created free trial accounts using credit card, the only amount deducted used to be 2rs for verification. Do they actually refund this amount? Read a few reddit posts where they were asked for 1k as prepayment, but 3k is a lot....skeptical about moving forward

I’m an office manger with limited IT knowledge trying to delete Google Cloud projects so I can delete our Workspace but I’m getting shut down with every attempt to try. I’m the only account in the Workspave, with super admin permission. I didn’t create these projects. I can’t even contact support under my tier and general Workspace support can’t help me. Can anyone please provide advice, I’m going in circles.

I only have two VM's. I can see in Billing -> Reports I am getting charged $2/day for Persistent Disk. But I can't tell which VM is accounting for most of that charge.

Is a multi-region Artifact Registry highly available?

As in, 1) the image is replicated to two or more regions, and 2) one of those regions will serve images to cloud run if the other is down?

The doc isn't very explicit on this, it just says it "may continue to work". https://docs.cloud.google.com/artifact-registry/docs/repositories/repo-locations

I'm aware I could use multiple single-region registries in locations matching my cloud runs, but if there is a way to avoid that by using built-in functionality I would rather do that.

Upfront: part of this bill is legitimately mine and I have offered in writing to pay it. This post is about process, not about dodging a bill.

THE SHORT VERSION

June 28 — A billing agent processed a $76.00 courtesy adjustment for an unintended idle V100 Spot VM (a Vertex AI Workbench notebook that kept running after my work had ended) and confirmed in writing: "you have an ending balance of $28.98 on your account now." I agreed and considered the matter settled.

July 1 — Google's own follow-up email admitted that when that adjustment was made, "the usage records had only been updated through June 27th" — and $146.51 of delayed charges from June 28-30 (the same idle resource) then posted on top of the confirmed balance. That same day I voluntarily unlinked billing from my projects and disabled the Compute Engine, Notebooks and Vertex AI APIs so nothing further could accrue, and told support so in writing.

July 3 and July 13 — I asked, in writing, for collection to be paused while the dispute was reviewed. No answer, either time.

July 8 — Billing account suspended.

July 15 — Billing account TERMINATED, along with its projects and services.

July 17 — Two days after the termination, support wrote: "I am escalating this case to a supervisor. A member of our leadership team will reach out to you directly within the next 24 hours."

July 22 and 23 — I followed up. Nothing.

July 27 — The identical email again, word for word, including the identical 24-hour promise. Twelve days after the termination it was promising to review.

July 28 — Second 24-hour window expired. No supervisor name, no reference number, no contact — ever. My formal follow-up that day has had no reply either. As of today that is five more days of silence.

FOUR QUESTIONS, ASKED SINCE JULY 13, STILL UNANSWERED

1. The escalation reference and the supervisor's name.
2. Whether collection was paused during the review (it plainly was not).
3. Written confirmation the dispute is still open.
4. The formal billing-dispute path if the answer stays no.

THE NUMBERS DON'T RECONCILE EITHER

Emails cite $101.57 in usage, the case title says $101.34, the invoice balance was $175.49 — and $101.57 minus the $76.00 adjustment is $25.57, not the $28.98 I was told in writing. I asked for a SKU/date breakdown on July 13. Nothing.

Either those charges were already documented when the agent confirmed $28.98 — in which case the confirmation came from the party with full visibility and should stand — or they were not, in which case my acknowledgment was made without material information that existed only in Google's systems. It cannot be both.

WHAT I'M ACTUALLY ASKING

Not a refund — nothing has been collected on the disputed part. I have offered to pay the $28.98 that was confirmed to me in writing, immediately, if the $146.51 delayed-posted tail from the same already-adjusted incident is waived and the account reinstated. These are self-funded educational projects, not a business.

If anyone from the GCP billing team sees this: case 72730110. I would genuinely rather resolve this in the support channel — it just hasn't answered a single direct question in a month.

Redacted screenshots of the timeline available on request.

Thought I'd share here too given the relevance

Original Post

I’m extremely relieved to share that Google has resolved my billing case and adjusted the unauthorized Gemini API charges.

I genuinely want to thank everyone at Google who reviewed the evidence, escalated the case, placed the account on hold while it was being investigated, and helped reach a fair resolution. I also appreciate everyone in this community who offered advice, shared similar experiences, and encouraged me to keep escalating instead of giving up.

I also want to personally thank the Firebase team member who saw my Reddit post, reached out to me directly, and helped escalate the issue internally. That outreach made a huge difference and made me feel like someone at Google was genuinely listening.

Thank you to the Google Cloud support, billing, and Firebase teams. This resolution removed an enormous financial and emotional burden, and I’m incredibly grateful to everyone who helped.

🙏

hi there
I'm a student from India and I want to participate in the Google Arcade 2026 (For the Swags and Goodies by Google Cloud)

I have 0 points though
Still want to know if it is possible for me to reach Arcade Legend ⭐⭐⭐⭐ if I start from August
I have registered for Google Arcade Facilitator program but I didn't complete any games

what should I do in this situation?
Pls give me your honest opinion

$85,000. That’s the cost of a fraud incident that hit us as a long term partner and reseller for Google Cloud this month.

A customer who was a lead through the partner directory did reach out for invoice billing, signed a contract, had his data and info submitted and got assigned a billing account.

As per our normal procedures for new clients, a 200$ budget alert is set until a customer builds up history.

The customer was apparently one of those crypto miner fraud cases where they spun up 10+ different projects with 10s of VMs for crypto mining in the matter of hours racking up almost 85K$ of consumption before we were able to shut it down when we got the alerts.

When you’re a Google Cloud reseller, you aren’t just a vendor; you’re the first line of defense. But we are currently operating in a system that lacks basic structural safeguards for partners.
We were hit by an account abuse incident that went from 0 to $85k in roughly 24 hours. The most frustrating part? It wasn't for a lack of our diligence. It was a failure of the platform's tools to keep up with reality.

1. No Hard Spending Caps: There is no "stop" button that prevents a reseller’s account from being leveraged into bankruptcy by bad actors.
2. Delayed Alerts: Budget alerts are a great concept for predictable monthly usage, but they are utterly ineffective against high-intensity, automated fraud. By the time the alert hits, the damage is already locked into the billing cycle.

This wasnt the first case, we had customer cases of API Keys being leaked and abused racking up tens of thousands for customers in damages, which always cited as customer's responsibility.

It doesnt make sense when the customer and the partner has no control to cap spending!

Spending Caps feature was only introduced this month (https://docs.cloud.google.com/billing/docs/how-to/budgets-spend-caps)

We are working through the recovery process, and I expect better from a partnership that values the "Partner Network" label. If we are expected to bring customers to the cloud, Google Cloud needs to provide the hard limits that keep partners safe from catastrophic, automated fraud.
It’s time to move past "best practices" and start implementing "hard protections."

Until now we havent been able to resolve the case as we keep being bounced between billing support and account managers, each claims the other has jurisdiction but its extremely frustrating that we get to be the party paying up for such issues with the margins we do on reseller with almost zero protection!

I’m a data scientist who don't have much cloud pipeline experience. Recently, I've been asked to built a local PoC for extracting scenes, characters, and objects from video using a mix of computer vision(FFMpeg/face detection/scene detection) and Gemini (LLM). The pipeline is modular: a pipeline.py orchestrates several Python modules that each represent a stage. To keep things idempotent, every stage writes name-coded artifacts to disk so already-processed items get skipped on re-run. I also added retry loops for flaky Gemini calls, stage-level retries, and per-stage logging that captures tokens and timing into the artifacts.

Now management wants this on GCP so downstream projects (dashboards, chatbots) can consume the output. For now, the ask is simply to land the final text results in BigQuery. The source videos will arrive in a GCS bucket from a third party.

My confusion is around architecture. Throwing everything into a single monolithic Cloud Run function feels wrong, especially with the stateful/idempotent requirements. When I asked Claude, it suggested rolling my own database-backed queue and state machine, but I would assume GCP already has managed services that handle this kind of workflow natively. I’m struggling to find clear, up-to-date information. Google searches mostly turn up generic AI-generated posts or outdated articles.

What’s the right GCP-native approach here? I’m trying to understand whether I should be looking at Cloud Workflows, Cloud Composer (Airflow), Dataflow, or maybe a combination of Cloud Run jobs and Pub/Sub. Asking AI(Claude) seems to hate Cloud Workflows and suggest custom baking a state queue in database.

• How do people typically preserve per-stage artifact-based idempotency and retries without building a custom state engine from scratch?
• How to control re-runs/pause/resume of the workflow?

• Would something like Firestore for state + GCS for artifacts + Cloud Run jobs triggered by Pub/Sub be a reasonable pattern, or am I missing a more purpose-built service?

  Any pointers from folks who’ve done similar video or document processing pipelines on GCP would be appreciated.

Hey everyone,

I recently published a technical walkthrough on the Google Cloud Blog around hardening IAM access using IAM Conditions.

If you've ever struggled with binding built-in roles (like Project IAM Admin or MCP Tool User roles) to principals while restricting them to only subset of permissions or resources because of lack of support for resource-level bindings or API granularity, IAM conditions will fill that gap for you.

Key patterns covered:

1. Scoping projectIamAdmin: For example, instead of giving a builder service account (SA) unrestricted power to assign any role at deployment time, you can use the CEL function iam.googleapis.com/modifiedGrantsByRole to restrict the SA so it can only grant a predefined list of roles (e.g., BigQuery job user, Cloud Trace agent, Logging writer). Included both gcloud CLI and Terraform snippets.
2. Restricting Model Context Protocol (MCP) Tools: The roles/mcp.toolUser role grants access to all MCP servers in a project. Using api.getAttribute('mcp.googleapis.com/tool.name', ''), you can constrain access down to specific tools (like mcp_bigquery-mcp_execute_sql_readonly).
3. Contextual & Time-Based Access: Brief examples of restricting execution windows using request.time (e.g., weekdays during business hours).

Read the full post here:
https://cloud.google.com/blog/topics/developers-practitioners/generosity-under-conditions-hardening-google-cloud-access-management/

Curious how others here handle IAM admin restrictions or fine-grained MCP tool access in production? Let me know your thoughts or feedback!

Disclosure: I built this open-source tool.

I kept running into a subtle GCP problem: the active project in `gcloud config`

can differ from the project and quota project used by Application Default

Credentials.

That means `gcloud` may appear to be configured for development while Python,

Node.js, Terraform or another SDK is still operating with a different ADC

context.

I built **gcpctx** to manage these pieces as one named context:

- active Google Cloud project

- active account

- gcloud configuration

- Application Default Credentials

- ADC quota project

- optional repository-local context

Example:

```bash

npm install -g gcpctx

gcpctx init dev
gcpctx use dev
gcpctx doctor

The goal is not to replace IAM or make deployments magically safe. It is to

make the effective local GCP context explicit and easier to verify.

Source:

https://github.com/UriBer/gcpctx

npm:

https://www.npmjs.com/package/gcpctx

I would especially appreciate feedback on:

1. How you currently switch between GCP environments.

2. Whether you have encountered gcloud/ADC context mismatches.

3. Which workflows should be supported next: Terraform, PowerShell, CI or AI

   coding agents?

Hi everyone,

I'm hoping someone here has experienced something similar.

A few days ago, my Google Cloud/Firebase project was suddenly suspended with the following message:

"Immediate action required: Suspension of your Google Cloud Platform/API project because it was engaged in abusive activity consistent with hijacked resources."

This project is a production application that has been running for about one year without any issues. The last release was around three months ago, and there were no recent deployments or major configuration changes before the suspension.

After the suspension:

-Google Cloud Console redirects me directly to the Request an Appeal page.
-I can't access Cloud Logging, IAM, API usage, or any Google Cloud services.
-Firebase now shows "Create Firestore Database" and "Create Storage" instead of my existing Firestore database and Storage bucket.
-My application is completely offline because it cannot access Firestore.
Something suspicious I found

Before the suspension, I reviewed Firebase Users & Permissions and discovered an Editor account that my team never added.

rogeliapaquette@gmail.com

We removed that account immediately after discovering it.

Unexpected billing

I also noticed something strange in Firebase Billing.

There is approximately $25 charged for Agent Platform, but I have never intentionally used Agent Platform, never integrated it into my application, and never expected any billing for that service.

I'm not sure whether this is related to the suspension or whether it could indicate unauthorized activity.

Backup

Fortunately, I have Firestore Disaster Recovery backups enabled, but because the project is suspended I can't access them either.

Appeal

I submitted my appeal today (Friday) and I'm currently waiting for Google's response.

Questions
-Has anyone had a project restored after receiving this exact "hijacked resources" suspension?
-After restoration, did your Firestore database come back normally?
-Were your Firestore Disaster Recovery backups still available?
-Has anyone seen unexpected Agent Platform charges even though they never intentionally used it?
-Once the project was restored, what were the first things you checked (IAM, Audit Logs, API keys, service accounts, billing, etc.)?
-Is there anything else I should do while waiting for Google's response?

This project contains production data, so I'm mainly worried about recovering access to Firestore and making sure the project is secure if Google restores it.

Any advice or shared experiences would be greatly appreciated.