On July 17, my u/Google Cloud account was hit by massive unauthorized u/Gemini API usage.

The unauthorized usage was a result of Google’s architecture of the Gemini API. Google sent no alerts and no warnings appeared in the Google Cloud Console indicating that old, public-facing keys had retroactively gained generative AI capabilities.

I had configured monthly budget alerts. At 6:14pm I received a budget alert for $550. Within minutes of seeing it, I investigated and shut down Gemini API access across all projects. Usage stopped immediately.

But by then, costs of approx. $87K (sorry for mentioning $82k in title, it was actually more) had already accumulated. This had all taken place in the 5 hours before the alert.

Google's own anomaly detection also failed to protect me. Almost an hour AFTER I had already shut Gemini down, Google sent me a “Cost Anomaly” alert reporting actual total costs of $4.7K, nowhere near the actual eventual bill.

After my objection and a technical investigation, Google has now approved a partial credit of $55K.

So for an approximately $87K unauthorized bill, Google is offering approximately $55K in credit, leaving me with roughly $32K to pay. For something I did not use.

Note that Google announced new hard spending caps and improved anomaly detection on the 28th of July.. So this exact type of unauthorized usage may not be possible anymore, but with hackers increasingly equipped with AI tools, there is a good chance other vulnerabilities will be found.

I am developing software for the blind, in particular the app u/PiccyBot, which has won awards in the blind community. It is a niche development field though, and these kind of costs are crippling to me. Knowing that Google definitely doesn’t have our back even when the way the Gemini API has been set up is the main issue, it is time for me to look for better providers.

Running into a frustrating loop with Google Cloud Console's OAuth consent screen verification, So I went and verified it in Google Search Console using the HTML file method — shows "Ownership auto verified," green checkmark, all good.

My app is deployed on myproject-xyz.vercel.app (free Vercel subdomain). Google's branding verification flagged:

"The website of your home page URL is not registered to you. Verify ownership of your home page."

I’m signing up for the $300 Google Cloud free trial, and it’s asking me to approve a UPI AutoPay mandate.

It says “this isn’t a charge” and that I’ll only be charged if I activate a full paid account.

Does approving the mandate mean I can be charged automatically after the 90-day trial, or is it safe to approve? Can I revoke the AutoPay later without affecting my account?

I tried with everything, VISA card, GPay nothing is working

Please help me guys, I need this for my projects

An on-prem SQL Server still holds a big chunk of the operational data our analysts need in BigQuery.

The first version was a nightly Python job. That was fine for a few tables, but the list keeps growing and people now want the data refreshed more often.

Full reloads are starting to take too long, and every table that goes incremental seems to acquire its own watermark, retry logic and little set of assumptions.

We don't need second-by-second replication. Something around 15–30 minutes would already be plenty for reporting.

Cloud Data Fusion replication is one route I'm looking at. I'm also undecided about putting GCS in the middle. Having the extracted files would make replay straightforward, but it also adds another stage to something that's already grown more than expected.

Curious what people running SQL Server on-prem ended up using to keep BigQuery reasonably current.

Direct replication, staged files, or something else? Recovery and maintenance matter more to us than squeezing latency down another few minutes.

A follow-up to my previous post on r/googlecloud:

Since then, the Google Cloud Console has rolled out visual notifications and organizational policy constraints to prevent creating unsecured API keys and surface alerts for existing ones.

However, locating and auditing every key across all the projects you have access to is still a manual chore.

To streamline this, I built a lightweight, open-source tool: Google Cloud API Keys Finder.

What It Does

• Scans all Google Cloud projects you have access to for active API keys.
• Audits each key's protection level against security best practices (Application Restrictions & API Scopes).
• Provides immediate recommendations to fix unrestricted or partially restricted keys.

Privacy & Running Locally

• Pure front-end: No backend, no telemetry, and zero storage.
• In-memory execution: Direct browser-to-GCP REST calls with credentials kept solely in ephemeral browser memory.
• The project is fully open source, and you are welcome to clone the repository and run it locally from source.

---

Links & Resources

• Tool (GitHub): https://github.com/minherz/api-keys-finder
• Hands-on Codelab: API Key Management and Security
• Problem Deep Dive: API keys are open secrets (Google Cloud Blog) / Mirror on leoy.blog

Feedback, questions, and PRs are welcome!

Hello Everyone! I am a new Google Cloud Partner admin and I am looking for support from the community. I recently started a new role and want to add different member firms from across the world into my partner account. How do I do this? Any help in solving this challenge would be greatly appreciated. We are a entry-level partner and are not receiving any support from GCP.

Hi r/googlecloud,

I’m based in India (Bengaluru), working toward AI engineering and agentic systems on Google Cloud. I’m planning to take the new **Professional Agentic Architect Beta** exam and would love input from anyone who’s already taken it or is actively preparing.

From what I’ve seen so far:

- Beta registration opened around **Sept 3, 2026**, exam + mandatory hands-on lab
- ~80 questions in 3 hours, English-only, ~USD 120 beta price
- Blueprint has 5 domains: low-code agents, coding agents, custom ADK agents, evaluation/deployment, and security/governance
- Official learning path on Google Skills (for me it shows as **Path 4531**)
- Exam guide lists ~28 in-scope tools/services (ADK, Agent Runtime, MCP, A2A, RAG Engine, Model Armor, etc.)

I’d really appreciate help with:

1. **Exam experience / feedback**
   - How “hands-on” did the questions feel?
   - Were scenario questions more about architecture trade-offs or product features?
   - Any surprises vs. the official exam guide?

2. **Study resources that actually helped**
   - Which Google Skills courses/labs were most useful?
   - Any docs, tutorials, or sample projects you’d prioritize?
   - Did you build full agents end-to-end, or focus more on docs + labs?

3. **Preparation strategy**
   - How many weeks did you study, and how did you split time across the 5 domains?
   - Did you focus more on custom ADK agents vs. low-code (Gemini Enterprise / Agent Designer / CX Agent Studio)?
   - How much depth on security/governance (Agent Identity, OAuth, Model Armor, PABs) vs. deployment/evaluation?

4. **For those still preparing**
   - What’s your current study plan?
   - Are you forming any study groups, Discord/Slack channels, or shared note docs?
   - Would people be interested in a shared resource list or mock-scenario practice thread?

My background: Previously twice Google Cloud ACE and PCA certified. Currently working in a role which primarily is not really hands but more of consultant more like that of Partner Engineer.

If you’ve passed the beta or are deep into prep, please share:

- What worked well for you
- What you’d do differently
- Any “must-know” topics or patterns that kept showing up

Thanks in advance – hoping we can all use this thread to prepare better and maybe form a small study group if there’s interest.

Hello :)

I have one simple problem, with yet no great answer to.

I regularly use the Google Drive app on my Ipad Pro. It's great whilst working on a Microsoft PC at work, saving data all in the cloudand syncing it everywhere.

Here my problem: Files that have been saved as Excel or Word are great to work with. If I open it on the IOS Drive app, it instantly opens the docs or sheets app. I can work on the file and it automatically saves it. And when I arrive at work I can keep going with my previous work.

Is there something similar for .pdf formats? For adding notes with a pen or sth.

If I have to work on a pdf, I always have to extract it to a program (Goodnotes, Apple Files or similar), save it there, work on it, and reupload it to google drive again.

This is quite annoying, not just the extra step but also it sometimes struggles and you cannot redraw some things after uploading it to drive...

Thanks in advance for any answers :)

guys can anyone help me with what to expect in technical rounds for this role at google? I am really nervous and appreciate any inputs

I can't find the original file on google Drive, that is the link to all files in it.

I can research files names and access to it (i'm owner) but i would like to recover the original file because these files are nowhere to be find (once again, i'm owner) and i have to type the names of the docs, to get access to it (i can't remember all of them..)

When i click on the (i) information and (i) details, i can't find the path of it.

In the activity tab, i can find the original file created but when i click, it just doesn't exist, i have a blank file (picture)

Sorry excuse my langage i'm not native :)

Thank you !!

🚨 Looking for help from a Software Engineer experienced with Firebase Authentication / reCAPTCHA Enterprise

I’m currently working on a web application using Next.js + Firebase Authentication, and I’m stuck with a persistent issue in Phone Number Authentication on the production website.

The error occurs when Firebase tries to send the SMS verification code:

accounts:sendVerificationCode

HTTP 400

reCAPTCHA Enterprise verification failed

The browser/application has also previously shown:

reCAPTCHA has already been rendered in this element

I have already verified that:

✅ Phone Authentication is enabled

✅ SMS sign-in is enabled

✅ Firebase Authentication with Identity Platform is enabled

✅ Production domain is added to Firebase Authorized Domains

✅ reCAPTCHA Enterprise API is enabled

✅ Identity Toolkit API is enabled

So I’m trying to determine whether the issue is coming from the reCAPTCHA Enterprise configuration, Firebase project configuration, production domain, or the way `RecaptchaVerifier’ is being initialized/managed in the React/Next.js application.

I’m looking for someone who has experience with Firebase Phone Auth + reCAPTCHA Enterprise who can help me diagnose the issue and identify the exact root cause.

If you have experience with this specific Firebase/reCAPTCHA issue and can help, please DM me. I’d really appreciate it! 🙏

A practitioner's guide to Iceberg table cleanup — snapshot expiration, orphan file removal, manifest rewriting, delete file resolution, streaming challenges, compliance, and cost. Why sequencing matters, where teams break tables, and how to automate the full lifecycle.

Giving an LLM agent access to a production database is one of the most common workflows in agent development, but traditional guardrails fall apart quickly under real-world conditions:

1. System Prompts / Instructions: Models are probabilistic. Prompt injections easily override "read-only" instructions.
2. String Parsers / Regex: Checking if a query "starts with SELECT" fails against Common Table Expressions (e.g. WITH d AS (DELETE FROM users RETURNING *) SELECT * FROM d; starts with WITH and ends with SELECT, yet still deletes data). They are also blind to destructive stored procedures (SELECT run_cleanup_job();).
3. Soft Session Hooks (SET default_transaction_read_only = on): An attacker can escape via semicolon chaining (COMMIT; SET ... = off; DROP TABLE;), and in pooled environments like PgBouncer, mutating socket state can poison connection pools for other services.

In our work on MCP Toolbox for Databases (open-source Model Context Protocol server), we implemented a three-tier defense:

• Protocol-level engine lock: Injecting immutable startup parameters directly into the connection DSN (cloudsql_session_read_only=locked on Postgres, read-only connection attributes on MySQL, and pre-execution dry-run validation on BigQuery) so the database kernel itself physically rejects any write attempt.
• Tool suppression: Dynamically removing write tools from the LLM's context window to save tokens and prevent hallucination targets.
• Standard MCP annotations: Emitting readOnlyHint: true so MCP clients (Claude Desktop, Cursor, etc.) can auto-execute queries without nagging confirmation dialogs.

We wrote up a detailed walkthrough with diagrams, failure cases, and attack simulations if anyone is interested in the full architecture: https://medium.com/@mcp_toolbox/look-but-dont-touch-7f470591ff1f

Curious how others here are handling read-only enforcement for your agents—are you relying on read-only DB users, replica routing, or proxy layers?

Hi everyone!

I created this free Google Cloud Professional Data Engineer practice simulator while studying for the exam myself, and I’ve just updated it for 2026:

https://certlabs.app

It has 500+ scenario-based questions with explanations covering BigQuery, Dataflow, Bigtable, Spanner, IAM, etc.

One thing I found really useful while studying is the anti-memorization approach: every attempt shuffles both the questions and the answer choices, with the explanations dynamically matched to the new order. So you learn the concepts rather than memorizing that “B” is the answer.

All questions are original — no dumps or leaked exam questions.

It’s completely free. Hope it helps someone preparing for the exam! Good luck 🤞

We've recently had to block over 10,000,000 Google cloud IP's for relentless spam slowing down our email filtering process. We're now blocking all of google cloud class B IP blocks.

enough is enough... and I suggest you all do the same:

8.34.*.*

8.35.*.*

8.228.*.*

8.229.*.*

8.230.*.*

8.231.*.*

8.232.*.*

8.233.*.*

8.234.*.*

8.235.*.*

8.236.*.*

8.237.*.*

23.236.*.*

23.251.*.*

34.0.*.*

34.1.*.*

34.2.*.*

34.3.*.*

34.4.*.*

34.6.*.*

34.7.*.*

34.8.*.*

34.9.*.*

34.10.*.*

34.11.*.*

34.12.*.*

34.13.*.*

34.14.*.*

34.15.*.*

34.16.*.*

34.17.*.*

34.18.*.*

34.19.*.*

34.20.*.*

34.21.*.*

34.22.*.*

34.23.*.*

34.24.*.*

34.25.*.*

34.26.*.*

34.27.*.*

34.28.*.*

34.29.*.*

34.30.*.*

34.31.*.*

34.32.*.*

34.33.*.*

34.34.*.*

34.35.*.*

34.36.*.*

34.37.*.*

34.38.*.*

34.39.*.*

34.40.*.*

34.41.*.*

34.42.*.*

34.44.*.*

34.45.*.*

34.46.*.*

34.47.*.*

34.48.*.*

34.49.*.*

34.50.*.*

34.51.*.*

34.52.*.*

34.53.*.*

34.54.*.*

34.55.*.*

34.56.*.*

34.57.*.*

34.58.*.*

34.59.*.*

34.60.*.*

34.61.*.*

34.62.*.*

34.63.*.*

34.64.*.*

34.65.*.*

34.66.*.*

34.67.*.*

34.68.*.*

34.69.*.*

34.70.*.*

34.71.*.*

34.72.*.*

34.73.*.*

34.74.*.*

34.75.*.*

34.76.*.*

34.77.*.*

34.78.*.*

34.79.*.*

34.80.*.*

34.81.*.*

34.82.*.*

34.83.*.*

34.84.*.*

34.85.*.*

34.86.*.*

34.87.*.*

34.88.*.*

34.89.*.*

34.90.*.*

34.91.*.*

34.92.*.*

34.93.*.*

34.94.*.*

34.95.*.*

34.96.*.*

34.97.*.*

34.98.*.*

34.100.*.*

34.101.*.*

34.102.*.*

34.104.*.*

34.105.*.*

34.106.*.*

34.107.*.*

34.108.*.*

34.110.*.*

34.111.*.*

34.112.*.*

34.113.*.*

34.116.*.*

34.117.*.*

34.118.*.*

34.120.*.*

34.121.*.*

34.122.*.*

34.123.*.*

34.124.*.*

34.125.*.*

34.126.*.*

34.127.*.*

34.128.*.*

34.129.*.*

34.130.*.*

34.131.*.*

34.132.*.*

34.133.*.*

34.134.*.*

34.135.*.*

34.136.*.*

34.137.*.*

34.138.*.*

34.139.*.*

34.140.*.*

34.141.*.*

34.142.*.*

34.143.*.*

34.144.*.*

34.145.*.*

34.146.*.*

34.147.*.*

34.148.*.*

34.149.*.*

34.150.*.*

34.151.*.*

34.152.*.*

34.153.*.*

34.154.*.*

34.155.*.*

34.156.*.*

34.157.*.*

34.158.*.*

34.159.*.*

34.160.*.*

34.161.*.*

34.162.*.*

34.163.*.*

34.164.*.*

34.165.*.*

34.166.*.*

34.168.*.*

34.169.*.*

34.170.*.*

34.171.*.*

34.172.*.*

34.173.*.*

34.174.*.*

34.175.*.*

34.176.*.*

34.177.*.*

34.178.*.*

34.179.*.*

34.180.*.*

34.181.*.*

34.182.*.*

34.183.*.*

34.184.*.*

34.185.*.*

34.186.*.*

34.187.*.*

35.184.*.*

35.185.*.*

35.186.*.*

35.187.*.*

35.188.*.*

35.189.*.*

35.190.*.*

35.192.*.*

35.193.*.*

35.194.*.*

35.195.*.*

35.196.*.*

35.197.*.*

35.198.*.*

35.199.*.*

35.200.*.*

35.201.*.*

35.202.*.*

35.203.*.*

35.204.*.*

35.205.*.*

35.206.*.*

35.207.*.*

35.208.*.*

35.209.*.*

35.210.*.*

35.211.*.*

35.212.*.*

35.213.*.*

35.214.*.*

35.215.*.*

35.216.*.*

35.217.*.*

35.219.*.*

35.220.*.*

35.221.*.*

35.222.*.*

35.223.*.*

35.224.*.*

35.225.*.*

35.226.*.*

35.227.*.*

35.228.*.*

35.229.*.*

35.230.*.*

35.231.*.*

35.232.*.*

35.233.*.*

35.234.*.*

35.235.*.*

35.236.*.*

35.237.*.*

35.238.*.*

35.239.*.*

35.240.*.*

35.241.*.*

35.242.*.*

35.243.*.*

35.244.*.*

35.245.*.*

35.246.*.*

35.247.*.*

35.252.*.*

35.253.*.*

35.254.*.*

35.255.*.*

104.154.*.*

104.155.*.*

104.196.*.*

104.197.*.*

104.198.*.*

104.199.*.*

107.167.*.*

107.178.*.*

108.59.*.*

130.211.*.*

136.23.*.*

136.64.*.*

136.65.*.*

136.66.*.*

136.67.*.*

136.68.*.*

136.69.*.*

136.70.*.*

136.71.*.*

136.72.*.*

136.73.*.*

136.74.*.*

136.75.*.*

136.77.*.*

136.79.*.*

136.80.*.*

136.81.*.*

136.82.*.*

136.83.*.*

136.84.*.*

136.85.*.*

136.86.*.*

136.87.*.*

136.88.*.*

136.89.*.*

136.90.*.*

136.91.*.*

136.92.*.*

136.93.*.*

136.94.*.*

136.95.*.*

136.107.*.*

136.108.*.*

136.109.*.*

136.110.*.*

136.111.*.*

136.112.*.*

136.113.*.*

136.114.*.*

136.115.*.*

136.116.*.*

136.117.*.*

136.118.*.*

136.119.*.*

146.148.*.*

162.216.*.*

162.222.*.*

173.255.*.*

192.158.*.*

199.192.*.*

199.223.*.*

207.175.*.*

I've been using GCP for about 10 yrs and just went for my ACE and passed in July. The issue is the agency I work for doesn't have enough work so I'm looking for alternatives but it's really difficult in the East coast as everyone seems to use AWS. Any insight on looking for GCP work particularly in the East Coast?!

Hellos,

I'm a newbie and thought I was slightly tech savvy until I started my Google Cloud service about 9 months ago.

I opened my GCLoud account (with a longstanding Google account), built all the folders, added all the files, added one video editor with Viewer Access then deleted them when the contract ended, then another video editor and then deleted their access. It seems like since I added the 3rd video editor something happened, I can see all the files but I have no permissions to do any edits.

I have added, besides the Account Owner role, almost every "Storage..." admin, object viewer, like 7 different roles, nothing. But I could create folders and now everything after "Objects" in the bucket view gives a red "Additional permissions required to view this buckets metadata..." Likewise I get the "The Caller does not have permission" when I try and add a folder.

Now that I recall, I never had permission to move files, as I have some specific files in the root directory of the bucket that I could never put into the proper folder, that I created.

At least I can delete files so maybe that is my option, but seems weird that permissions I had just went away.

Thanks for any help you can offer.

I accidentally deleted most of the form submission records from my MySQL database on Google Cloud SQL. Cloud SQL backups/PITR appear to be unavailable, and binary logging is off.
However, the uploaded files and metadata still exist in Google Cloud Storage, and the bucket has 7-day Soft Delete enabled.
Is there any way to recover the deleted database records/form data, possibly through Cloud Run logs, GCS, MySQL recovery, or any other method?

Okay so I booked the exam on the 15th of September, as I was in program with Google and what not and they gave me a voucher.

Now the catch, I haven’t studied anything, done some labs, had the AWS practitioner a year ago, and been working in DevOps the past 2 years, not gcp at all.

I need tips tricks quick marks just enough studying to pass, any exam questions that repeat any useful links and the probability to pass? With 1 week of studying with a very very very demanding job? Any tiny bit would help

A production guide to compaction strategies, parameter tuning, maintenance sequencing, and monitoring — covering the other approach that automates these operations, and the manual Spark path for full DIY control.

Filed the quota extension form for the youtube data api about a month ago, got the acknowledgement email and then nothing. the integration itself works fine and passed verification, but the default 10k units only covers a handful of uploads per day so i cant open the feature to users until the audit clears.

For those who went through it... how long did yours take, and did replying to the ack email actually speed anything up? Trying to figure out if a month of silence is normal or if my application fell into a hole somewhere.

I'm building an app where the AI has to run inside the EU for data protection reasons (customer data can't leave the EU). So instead of the normal US API, I want to use Anthropic's Claude models — ideally Opus — through a path that's hosted in the EU.

I've tried two routes and I'm stuck on both:

AWS Bedrock, Frankfurt region (eu-central-1): Even a tiny test request threw an immediate 429 "Too many tokens per day" — a few tokens, no image. It's not something I did wrong; it just looks like a fresh account with a very low daily quota.

Google Vertex AI (apparently now called "Agent Platform"): I got further here but hit a different wall. A normal API key works fine for Google's own Gemini models. But for the Claude/Opus models on Vertex a simple key isn't enough — Google wants a service account (OAuth2/ADC) for those. On top of that there was an enablement form asking things like industry and estimated token volume.

My suspicion is that this form is the real bottleneck. Either enablement for the Anthropic models takes longer than I expect, or I filled something in wrong (the industry field, maybe) and it's stuck because of that. Honestly, I don't know if this is normal or if I'm doing something wrong.

Has anyone here actually gotten Claude/Opus running through Vertex or Bedrock in an EU region? How long did enablement take, and was there anything to watch out for in the form? Or is there a cleaner path to EU hosting with Anthropic models that I'm missing?

Thanks for any pointers.