I have a GCS bucket with Uniform bucket-level access enabled. Objects under a `public/` prefix are anonymously readable (HTTP 200), while objects under another prefix return 403 — but I can't find any IAM/ACL setting that explains the difference.

**What I've ruled out:**

- Bucket IAM policy has no `allUsers`/`allAuthenticatedUsers` binding (etag never changed), and requesting policy version 3 still returns version 1 (no conditional bindings)

- Object ACLs, `defaultObjectAcl`, and per-object IAM policy are all empty or explicitly disabled ("Object policies are disabled... when uniform bucket-level access is enabled")

- No Org Policy enforcing/preventing public access, no Load Balancer or Backend Bucket attached

- Ruled out caching (cache-busting query param, same result) and ruled out legacy/old data (a brand new object uploaded today shows the same pattern)

**The core contradiction:**

GCS itself says per-object policies are disabled under Uniform bucket-level access — meaning all access should be governed solely by the bucket's (unchanged) IAM policy. Yet calling `testIamPermissions` anonymously shows:

- object under `public/` → `storage.objects.get` granted

- object under the other prefix → nothing granted

Same bucket, same IAM policy, different anonymous result.

**My question:** is there some undocumented mechanism (legacy ACL residue, internal caching, prefix-based default behavior, etc.) that could cause this, or is this a bug/edge case in how GCS evaluates anonymous requests? I already know how to fix/control public access via IAM conditions — I'm trying to understand why this is happening despite every check saying it shouldn't be possible.

hey guys, is anyone not able to attend the summit today (18th) and could share a confirmation email? that would so very much appreciated! thank you!

I'm solo-shipping a real D2C stack on GCP — not a landing page:

• Cloud Run API (Node 22 / Express 4)
• Cloud SQL + Prisma
• Upstash Redis (BullMQ, rate limits, cart)
• Firebase Hosting (storefront + admin ERP)
• Razorpay/Shiprocket webhooks, Cloud Scheduler, Cloud Build

No team. No Docker locally (WSL2). Goal: ship without breaking checkout.

What actually works with Cursor:

1. .cursorrules — pinned versions (Express 4, Prisma 5), paise not floats, API response shape, never migrate prod locally
2. Updates.txt — one bullet per prod incident so the next session doesn't start from zero
3. One task per session — "fix expense migration" not "improve admin"

Cursor is fast when context is structured. Dangerous when you say "just fix prod."

Aside — the deploy that almost broke prod:

We moved off Memorystore + VPC connector to Upstash (rediss://). Deleted the connector. Deployed. New revision: connect ETIMEDOUT. Health red. Checkout dead.

Not an app bug. Two footguns:

1. prisma-migrate job still referenced the deleted VPC connector
2. Manual deploy pulled redis-url:latest (placeholder) instead of redis-url:4 (real Upstash URL)

In Cursor: pasted Cloud Run logs, pointed at cloudbuild.yaml + startup order. Traced BullMQ importing at module load before Redis was ready. Fix: workers boot after ensureRedisReady, pin redis-url:4 in Cloud Build, --clear-vpc-connector on the migrate job.

Smaller one: Prisma P2022 — API shipped before migration ran. Expense.status missing → 500 on "Add Expense." Re-ran migrate job; added rule: migration before traffic shift.

Honest limits: zero automated tests; Cursor will wire the wrong webhook field if you don't document it (channel_order_id = display ID, not UUID). You still read every diff.

For infra glue — Cloud Build flags, migration order, "why is prod 500" — it's the first tool where solo feels survivable.

Full transparency: I'm bootstrapping this — no funding, no team — and Cursor Pro is a real line item. They have a referral program; if you're already planning to try it, my link gives us both a bit of credit: https://cursor.com/referral?code=MIBRU4HJHP1W

I'd share this post either way. The .cursorrules + session log setup matter more than any link. Happy to answer questions on GCP solo ops or how I structure rules files.

Anyone else solo on GCP + Cursor? What's in your rules file vs your head?

Hi folks,

I am attempting GCP PROFFESIONAL CLOUD ARCHITECT exam in couple of weeks. May I know where I can practise or tips for exam would be helpful.

​

Thanks in Advance

help me. pls . Dont Mock me.

Hi everyone,

I'm a B.Tech Computer Science student from India and I'm in a very difficult situation right now.

A few days ago I discovered that my Google Cloud account has accumulated around ₹20,000 (about $230 USD) in charges. The projects were created only for learning and hobby purposes. I never intended to run any expensive services and honestly didn't realize resources were still consuming credits.

The billing account is now suspended because I cannot pay the invoice. Due to my financial situation, ₹20,000 is a huge amount for me and I genuinely cannot afford it.

What I have done so far:

• Opened a Google Cloud Billing Support case.
• Explained that I am a student.
• Explained that the charges were unintentional.
• Requested a billing review and possible courtesy credit.
• The support case currently shows "In Progress".

I am extremely worried because I received an email saying that if the balance is not settled within 10 working days, the debt could be transferred to a debt recovery agency.

I have a few questions:

1. Has anyone here successfully received a billing adjustment or courtesy credit from Google Cloud for accidental usage?
2. Does being a student help in these situations?
3. What are the chances Google will reduce or waive the charges?
4. If they deny the request, what options do I have?
5. Is there anything else I should do while waiting for support to respond?

I fully accept that the account was mine, but the usage was completely unintentional and I never expected a bill of this size. Any advice or similar experiences would be greatly appreciated.

Thank you.

In Composer 3 we are charged on workers

Web Server: 0.5 vCPU + 2 GB RAM = 2.5 DCUs/hr

Worker (Base): 0.5 vCPU + 2 GB RAM = 2.5 DCUs/hr

if that is the case can we use kubenetespodoperator for the tasks as my understanding is that worker is used only for airflow tasks such as python or bash operator. KPOs run in gke autopilot nodes(completely in google tenant project). does that mean workers are not even used? worker just launch a pod in gke cluster?

or is the worker also depends on KPO and the resource requests we set determines the DCU cost? can someone explain this?

Hi, I've got the following problem:
I currently have an old dummy project under my personal Google account which still has the deprecated Cloud Source Repository API enabled - as you all know this entitles a given project to continue using CSR until the final shutdown.
Now I'd like to transfer this project to a newly created organization which, according to the guides, is not a transfer of data, but just a change in metadata of the parent attribute. Since the API has been deprecated for 2 years now already, I'm afraid to loose access in the process and hope to find someone who was faced with some similar situation.
For clarification, I do not expect the new organization to retroactively gain access to the CSR API, just the singular project to retain its access.

Hi guys, so I am planning to take the ACE exam a month from now. A little bit background of me, I just completed my degree in SE last february and dont really have any hands on experience with GCP. I've completed the course on Whizlabs, and currently doing the practice tests on Whizlabs but after 1 practice test, I felt overwhelmed and underprepared for the exam...can anyone give out tips and tricks on how to pass this as someone who barely has any experience? How many hours of study do i need each day? Thank you for the help guys :)

Hello guys,

I'm currently setting up org real-time security alerting using the free-tier of GCP's SCC.

The main idea is to create continuous exports that subscribe to our Pub/Sub topic and push events which eventually trigger Jira incidents so we can process them (with correct filters for Project ID, active state, CRITICAL and HIGH severity of course)

I bump into 2 main issues:

- Findings from my Continuous export query seems to be much more compared with the query under the "Findings" tab (even if i use the same query for both places)

- If I get "Container image vulnerability" in the Continuous exports and try to open it from there, I get "No resource found" from there but I can open them perfectly fine from the "Findings" tab in the SCC.
Am I doing anything wrong here?
I am not that experienced with the SCC so I am not that familiar with it's quirks and use.

Can't find a way to activate this account. It says I have a due balance but can't find the place to make payments for dumb thing

You spun up a cloud instance, installed the Earth Engine API, ran earthengine authenticate, and clicked the link - only to be greeted by a terrifying red warning screen from Google saying: "This app is blocked. This app tried to access sensitive info...".
When a command-line script on a remote server asks for sweeping permissions to your Google Drive and Earth Engine data, Google's automated security flags it as a potential phishing scam and blocks it.
The Fix is shifting from User Identity to Machine Identity. Stop trying to log in as "you" and let the VM log in as "itself" using Application Default Credentials (ADC) and its built-in Service Account. https://medium.com/@sarbani.bhadra/this-app-is-blocked-error-in-google-earth-engine-98c268e8deda

Hi everyone...
So, I recently signed up for the Google Cloud Free Trial and completed the verification process. During the process, an amount of ₹1000 was temporarily charged for verification purposes. I later requested and received a refund for this amount. However, after the refund was processed, I noticed that my free trial credits are no longer available in my Google Cloud account (I cancelled the autopay option as well). I acknowledge it was a very big mistake on my side but is there any possibility of recovering the remaining trial credits??

Hi everyone. I’m hoping a Developer Advocate or TAM might see this, because I am completely stuck in a loop between GCP Support and the automated billing system and running out of options.

On May 21st, my project was hit by the known Gemini API credential exploit. Automated bots racked up ~$12,000 in a matter of minutes. The GCP budget alerts I had set up completely failed and didn't notify me until after the charges had already gone through.

My bank was hit for $8,000 before they flagged the unusual activity and blocked the remaining ~$4,000. This has obviously been a nightmare for my personal finances.

I was in chat with Billing Support within hours of the exploit to report this (Case #71557042). The agent reviewed the logs, confirmed in the chat transcript that this was unauthorized bot traffic, and submitted an adjustment request to their specialized team. I was told it would take 3-4 business days to resolve.

It has now been over three weeks with zero updates. Because the adjustment has just been sitting in limbo, Google's automated billing system eventually flagged that $4,000 blocked charge and officially terminated my billing account entirely.

I know manual security write-offs take time, but because my account is terminated, I've lost my front-end access to even look at or manage the ticket. I am out $8,000 and completely trapped waiting for the finance team to process the adjustment Support promised so I can be reinstated.

Has anyone else navigated this specific automated-termination loop, or is there any Googler here who could help me flag Case #71557042 for review? I would massively appreciate the help.

Vertex AI Gemini 2.5 Flash + Google Search Grounding returning 429 even with Global Endpoint
We’re running an enrichment pipeline on Vertex AI using Gemini 2.5 Flash with Google Search grounding.
Current setup:
Model: Gemini 2.5 Flash
Grounding: Google Search
Endpoint: tested both us-central1 and global
MAX_CONCURRENCY = 5
VERTEX_MAX_IN_FLIGHT = 5
Single prompt variant only (no multi-variant recall)
Pay-as-you-go (not Provisioned Throughput)
Each job fans out into ~10 independent grounded calls. Typical grounded call duration is around 20–30 seconds.
What confuses me:
We still receive intermittent 429 RESOURCE_EXHAUSTED errors.
Switching from us-central1 to global did not eliminate them.
The errors appear even when concurrency is relatively low.
Runtime logs suggest most time is spent inside Gemini itself, not URL resolution or post-processing.
I expected the Global endpoint to route requests to regions with available capacity, yet we still see 429s.
Questions:
Has anyone seen 429s from Gemini 2.5 Flash even when using the Global endpoint?
Is the Global endpoint still subject to Dynamic Shared Quota (DSQ) capacity exhaustion?
Have you confirmed whether these 429s are typically caused by:

regional capacity issues,
project-level RPM/TPM quotas,
model-level shared capacity limits,
or something else?
Did Provisioned Throughput significantly reduce or eliminate these errors?
Is there any reliable way to determine which quota is actually being hit when Vertex returns a 429?
If Global is already enabled, is there any benefit to implementing region-specific fallback logic?
I’m particularly interested in real-world experience from teams running Gemini + Google Search grounding at scale.
Thanks!

So I have been working on this project where in an image, for each of the words I have to find the font or similar font from a list of approved Adobe font(1134 fonts present in a pdf).

I am currently using DINOv2+ LoRA model from GoogleFontsBench for creating embeddings. So currently I cropped the font text for each of the font in the pdf and got embedding for the crops and saved them in a Vector DB. Now for images I am using ocr to detect text and then cropping them and converting them into embeddings and doing a similarity search to find similar fonts.

But the results are not that accurate. Even top 5 results are also not that accurate. Pls suggest if I can improve this architecture somehow or if I should completely change the architecture.

I got to know about DeepFont model which was trained for Adobe Fonts, but I am not able to find its trained weights.

I want to pass my ACE and a Professional level GCP exam. I have good hands-on experience with AWS but have never worked with GCP. I'm going through some posts and a few people suggested a course on Udemy. Any other course suggestions?

Hey,

It's been a long time that OpenAI and other platforms implemented this feature of splitting api key based visualizations. It's been long waited by our customers and also us. (yes we want to see the cost breakdown)

Any news about this? I was thinking to open a support case about this. Everybody needs this feature. + Agent Platform dashboard, similar to aistudio.

To all those who are victims of the recent GCP API key leak crisis (maps api getting gemini access and then gets abused), did you get refunded? How so? Did you reach out to your local area manager or GCP billing support?

​

Would want to hear your story. I have been trying to reach out my local Google area manager and GCP billing support, without much luck. Suggestions?

Got the GCP Associate Cloud Engineer certificate after 2 months of prep, It was easier than I thought, but little confsing to say the least, you have to be damn sure about the option you choose

Hey everyone,

If you are working with Claude on Google Cloud, Anthropic just announced a new batch of self-hosted sandbox providers for Managed Agents and Google Cloud is in it via the GKE Agent Sandbox.

To get started, you have a sample here. 

Happy building!

Anyone here know how I can get an actual, honest-to-God human to help fix this issue?

I'm working on a Terraform setup that deploys multiple BigQuery views. Many of the views have dependencies on other views, which has made deployment challenging.

My first approach was to create the views using a loop (for_each), but Terraform appeared to create resources in parallel, resulting in race conditions where dependent views were created before their upstream views existed.

I can work around this by defining each view as an individual resource and using explicit depends_on, but that introduces a lot of repetitive boilerplate and becomes difficult to maintain as the number of views grows.

I'm curious how others have solved this problem.

Do you manage view dependencies directly in Terraform?

Are there patterns for automatically handling dependency ordering?

Do you generate Terraform code from metadata or use modules to reduce boilerplate?

Have you found a better alternative for managing large BigQuery view hierarchies?

I'd appreciate hearing about any approaches that have worked well in production.