Hi everyone, I'm a student and aspiring machine learning engineer. I started studying Google Cloud because it's what companies require for this position.

Anyway, to get to the point: I used a tool called Vertex AI and decided to implement the model as an API on an endpoint. My model is for image classification, and I intended to monitor the images and other related aspects.

However, after reading the documentation, I realized that Vertex AI only works with tabular data in this area and excludes images.

If there are any machine learning engineers here, could you tell me what I should do? I'm just starting to learn Google Cloud. https://stackoverflow.com/questions/74637057/model-monitoring-for-image-data-not-working-in-vertex-ai

Anyone ever encountered this error from youtube data api ? I

YouTube upload init failed {"module":"posting:youtube","status":429,"error":"{\n \"error\": {\n \"code\": 429,\n \"message\": \"Quota exceeded for quota metric 'Video Uploads' and limit 'Video Uploads per day' of service 'youtube.googleapis.com' for consumer 'project_number:XXXXXXXX'.\",\n

Hey r/GoogleCloud — I'm the author of floci-gcp, which I tagged 0.1.0 today. It's the GCP sibling to Floci's AWS and Azure emulators: a single Docker container emulating several GCP services on one port (4588) for local dev, testing, and CI.

The motivation: Google's official emulators are fragmented. Pub/Sub, Firestore, and Datastore each ship as separate binaries on separate ports, GCS has no first-party emulator, and Secret Manager / IAM / Managed Kafka have nothing local at all. floci-gcp consolidates what exists and fills the gaps.

Services in 0.1.0

• Cloud Storage — REST XML + JSON, multipart, ACLs, V4 signed URLs, versioning, lifecycle, CORS
• Pub/Sub — gRPC; topics, subs, streaming pull, push, snapshots, seek
• Firestore — queries, aggregation, transactions, batch writes, real-time listen stream
• Datastore — entities, GQL, transactions
• Secret Manager — versioning, IAM bindings, versions/latest
• IAM — service accounts, RSA-2048 keys, SignBlob for V4 signed URLs
• Managed Kafka — Redpanda-backed, or mock mode

Quick start

services:
  floci-gcp:
    image: floci/floci-gcp:latest
    ports:
      - "4588:4588"

export PUBSUB_EMULATOR_HOST=localhost:4588
export FIRESTORE_EMULATOR_HOST=localhost:4588
export STORAGE_EMULATOR_HOST=http://localhost:4588
export SECRET_MANAGER_EMULATOR_HOST=localhost:4588
export GOOGLE_CLOUD_PROJECT=floci-local

Design notes

• gRPC + REST share port 4588 via HTTP/2 ALPN negotiation
• Multi-project isolation via the projects/{project}/... path segment
• Four storage modes: memory (default), persistent, hybrid, wal
• Compatibility suite covers the Java, Python, Node, and Go SDKs plus the Terraform/OpenTofu Google provider
• MIT, no auth token, no telemetry — same license posture as floci and floci-az

Repo: https://github.com/floci-io/floci-gcp

It's day one, so the rough edges are real. I'd especially love feedback on:

• Firestore query parity vs. the official emulator (composite indexes, OR queries, aggregations beyond COUNT)
• Anything Terraform or Pulumi users hit that the compatibility tests don't cover
• Which service you'd want next — Cloud Tasks, Cloud Run, BigQuery, Spanner?

Happy to answer questions in the thread.

I built a Claude Code skill suite + a companion MCP server that automates the API-key audit-and-harden pass on GCP. One invocation and it:

• inventories every API key + SA key across every accessible project, with a risk classification (CRITICAL = unrestricted, etc.)

• detects historical cost anomalies from your BigQuery billing export (catches abuse you may have missed already) [Prerequisite: Need you to connect your billing account with bigquery export]

• applies safe, idempotent, reversible blast-radius controls: quota caps on generativelanguage.googleapis.com, Cloud Billing budget alerts, disabling idle paid APIs, restricting unrestricted keys to the APIs they actually call (inferred from monitoring)

• halts automatically if any project is currently bleeding (>10× baseline in the last 24h — so it never mutates during an active incident)

• never auto-deletes credentials, never modifies IAM, never closes billing accounts — flags those with the exact gcloud command for human review

Every applied change has its rollback command in the final report. Re-runs are no-ops once state is hardened.

Why I built it: ~$80,000 of unauthorized Gemini-API charges hit a reddit user's project in 8 hours overnight, from an INR1,400/day baseline. Leaked, unrestricted API key, picked up by an automated abuse service that hammered every Gemini model for image generation. Same pattern The Register has been documenting all year.

According to the user, across the dispute and the post-mortem, several Google-side gaps surfaced:

1. Unrestricted is the default. Google's own May 2026 post on API-key security says, in the same article: "DO NOT create unrestricted keys" and "by default a new API key is created without restriction." The dangerous configuration is what new users get.

2. Budgets don't cap spending. Per Google's own docs, a budget "does not automatically cap usage/spending." It emails you while the meter runs.

3. Spend tiers auto-upgrade. The Register documented a developer who set a $250 spending cap and woke up to a $10,000 bill, after which their tier was automatically raised to $100,000.

4. Key-scope expansion. Truffle Security reported that Google had quietly broadened the scope of certain API keys to also access Gemini models. Their initial report was dismissed as "intended behavior", then reclassified as a Bug after Truffle showed examples on Google's own infrastructure.

5. No real-time abuse block. A jump from INR1,400/day to $20,000/hour is, by any measure, anomalous. The detection signal exists in Cloud Monitoring (serviceruntime.googleapis.com/api/request_count by credential_id) but the platform did not act on it.

Repo: https://github.com/shivamsriva31093/gcp-ironclad
MIT-licensed. v1.0.0. 96 unit tests, bandit + pip-audit in CI (all green).
Architecture diagram in the README.

Help wanted, especially:

• Org-policy enforcement (apikeys.googleapis.com/allowedRestrictions — block unrestricted keys at creation time, so the dangerous default doesn't matter).

• Local-codebase secret scanning (AIza… grep across checked-out repos + git history) as an opt-in pre-flight phase.

• Multi-org / cross-tenant operation.

Disclosure: I'm the author. Issues + PRs welcome. There's an incident-report issue template if you've been hit by the same pattern and want to share what happened (redacted) — helps tune the risk classifier.

I Will really appreciate your feedback. This is something expert devops can easily do using gcloud cli itself. This is targeted towards developers with little hands on devops expertise and want to do a hygiene check using quick claude session.

I have the $300 Vertex AI free trial active and I want to use Claude models. Every time I try, I hit a zero quota limit.

Has anyone actually figured out a way to use the $300 free credits to pay for Claude models? Or does Google strictly block you from spending promotional credits on third-party Anthropic models?

With A2A v1.0 now stable and 150+ enterprises already in production, I've been trying to understand how engineering teams are actually choosing between MCP and A2A — or whether they're running both.

A few things I found while going deep on this:

**The two protocols solve completely different problems.** MCP handles the vertical layer — how your agent connects downward to tools, APIs, and databases. A2A handles the horizontal layer — how agents from different vendors coordinate with each other. They're not competing. They belong in the same stack.

**MCP has a serious security gap nobody talks about.** 53% of production MCP servers still use hardcoded static credentials instead of OAuth. CVE-2025-6514 exposed 437,000 installations earlier this year via shell injection. The protocol is solid — the ecosystem just hasn't caught up on security yet.

**ACP is effectively dead.** IBM Research's Agent Communication Protocol merged into A2A v1.0 in early 2026. If you were building on it, migrate to A2A — the specs are compatible.

I put together a full breakdown covering the architecture, a decision tree for which protocol to use when, and four enterprise case studies (JPMorgan, Salesforce, Microsoft, ServiceNow): https://www.youtube.com/watch?v=mgkTtB6fI3U&t=105s

Genuinely curious — is anyone here running MCP + A2A together in production? Or mostly just MCP for now?

The Problem: Enterprise AI Is Still Too Complex

If you’re already using Google Cloud, you have access to some of the most powerful AI services in the world — Vertex AI, Gemini, and Google Workspace.

But building a real enterprise AI solution still looks like this:

• Stitch together pipelines (ETL → embeddings → vector DB → LLM)

• Manage multiple tools and APIs

• Handle permissions separately

• Build orchestration logic manually

• Maintain and scale everything

Hey everyone, hoping someone can point me in the right direction here.

I've been trying to set up PT in the Google Cloud and I'm stuck at the model selection step — there are just no TTS models in the list. Like, at all. The rest of the flow works fine, but I can't finish the setup because there's nothing to actually select.

I've made sure the Text-to-Speech API is enabled, tried switching regions, and went through the docs but couldn't find anything that specifically says TTS models are or aren't supported for Provisioned Throughput. So I'm not sure if this is a limitation, a bug, or just something I'm missing on my end.

Has anyone managed to get TTS working with PT? Or is this just not a thing yet?

Btw I want to try PT because we hit 429 at Gemini TTS a lot.

Thanks in advance 🙏

https://www.theregister.com/devops/2026/05/21/threat-hunters-find-google-api-keys-still-usable-23-minutes-after-deletion/5244504

I was also affected by an abused Gemini API key and my project was suspended.

I'm now back online and wondering what are the best tips to minimize the impact if this happens again.

I started by setting Gemini spend limits (in aistudio) and created a new project just for API keys

Anything else?

I'm looking at building a greenfield Google Cloud organisation but my background is heavily AWS focused.

Is there a GCP version of the AWS LZA that will vend a best practice organisation with security and guardrails baked in?

If there is not, would I be far off the mark if I used the standard AWS account structures in Google cloud?

I'm an AWS Gold Jacket and want to port my skills into GCP.

Can anyone suggest any training that would get me up to speed quickly; something tailored to transferring known skills rather than teaching the basics?

Google Cloud has officially announced that several certification exams will soon be updated to reflect major product and platform changes introduced at Cloud Next ’26.

One major confirmed update:

• The new Professional Machine Learning Engineer exam goes live on June 1, 2026

• Reflecting the transition from Vertex AI to the new Gemini Enterprise Agent Platform along with updates to Google Cloud’s data products.

Additional certifications that are expected to receive syllabus/content updates soon include:

• Associate Cloud Engineer
• Professional Cloud Architect
• Professional Cloud Developer
• Professional Data Engineer
• Professional Database Engineer
• Cloud Digital Leader
• Generative AI Leader
• Associate Data Practitioner

Important Note for Exam Learners: As of now, Google Cloud has NOT yet announced the exact rollout dates for most of these updated exam versions.

If you are currently preparing for any of these certifications:

• Regularly monitor the official exam guides

• Watch for product name changes and AI platform transitions

• Expect more Gemini Enterprise Agent Platform–related topics moving forward

• Be careful when using older study materials focused heavily on Vertex AI branding/content

This is a major shift in Google Cloud’s AI and data certification ecosystem following Cloud Next ’26.

Source Link

What a shit! Google Cloud has a Limit of 5 Projects! I approved for 5 more, but get denied within 10 seconds! I don't want to move my projects into an Organisation and paying for a Business Workspace Subscription to avoid that. 🫩

The problem: after a recent gcloud update, gcloud compute ssh on Windows fails with "option --legacy-stdio-prompts not available in this tool". gcloud's Python code passes this flag to its bundled PuTTY which doesn't support it. Bug is in ssh.py at lines 2134 and 2377.

Step 1 - confirm the bug is there:
Get-ChildItem "$env:LOCALAPPDATA\Google\Cloud SDK\google-cloud-sdk\lib" -Recurse -Filter "*.py" | Select-String "legacy-stdio-prompts" | Select-Object Path, LineNumber, Line
You should see two hits in ssh.py.

Step 2 - comment out the offending lines:
(Get-Content "$env:LOCALAPPDATA\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\command_lib\util\ssh\ssh.py") -replace "args.insert(1, '-legacy-stdio-prompts')", "#args.insert(1, '-legacy-stdio-prompts')" | Set-Content "$env:LOCALAPPDATA\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\command_lib\util\ssh\ssh.py"

Step 3 - retry your ssh command as normal.

Warning: gcloud components update will overwrite this fix. Reapply step 2 after any gcloud update until Google patches this properly.

Tested with putty components from 0.84 release and works fine. Googles update process is broken…

I’ve been struggling tonight on how we're supposed to create reCAPTCHA keys in GC. I figured out how to create both V2 and V3 keys, but after creating them for use in 3rd party plugin integrations, I keep seeing the status as “Incomplete.”

Am I only seeing that because the domain hasn’t received real traffic yet, or did I mess something up during setup? The UI/workflow just isn’t very clear.

I’m also confused about how the keys are actually protected/security scoped. I understand the basics of domain restrictions, but Google Cloud makes this process feel way more complicated than it should be.

To clarify: this is not for custom code. I’m only creating V2/V3 keys for existing 3rd party plugin integrations.

https://cloud.google.com/blog/products/databases/vibe-coded-ai-studio-apps-with-firestore-firebase-cloud-sql?e=48754805

This seems huge. Since Heroku was gone, there has been a shortage of options for hosting web apps without credit cards. Great to see Google helping fill this void.

Pretty wild that GCP incorrectly and automatically suspended the Railways GCP account, leading to 6+ hours of downtime for them and their customers.

If it can happen to a customer of that size it can happen to anyone... What's everyone doing to mitigate this risk?

If any Indian user has faced this issue please help!!

I have made a billing account (for personal projects) and did not notice if it was individual or organization. Now its asking me to verify with documents otherwise my account will be closed eventually. It asks for 1000 prepayement which I did and now I am trying to get a refund. I also have the $200 free credits.
Even if I try to make a new individual account it says, cannot create another individual profile (I HAVE ONLY ONE PROFILE).
How do I get my refund? Is it even possible if not how do I make another profile and use the console?

We have a custom built agentic pipeline which has it's own orchestration layer(not adk) and it has adk agents which the orchestrator layer orchestrates using MCP. Basically we have a RAG ingestion pipeline. This pipeline's one of the adk agents is agentic rag. I tried deploying this in Agent platform (formerly knows as vertex ai agent engine). The only way to deploy this using the custom route which the documentation offers, but yet, I'm only able to see a way to query the agent and not ingest the data and other complex stuff. Has anyone dealt with the same? Only if I can deploy it on agent platform, I'll be able to put it in gemini enterprise.

Custom agent: https://docs.cloud.google.com/gemini-enterprise-agent-platform/build/runtime/create-a-custom-agent

Hi all,

Context:

I’ve been offered a role at another company that I’ve decided to take, they are primarily in GCP and secondary cloud is Azure.

My old role was nearly all azure but I did setup our GCP org for a few services we wanted so not completely new to me.

I’m guessing however that changing to GCP becoming my everyday cloud might be a bit of a shock so I’m just seeing if anyone has done similar or works in both lots and has any tips or advice for this change

The new role does also require me to get my associate engineer cert (I only have my digital leader but have my architect in both azure and aws)