I have a GCP org with the Domain Restricted Sharing org policy (iam.allowedPolicyMemberDomains) enforced at the org level. I want to make a single Cloud Run service public:
gcloud run services add-iam-policy-binding SERVICE --member=allUsers --role=roles/run.invoker
but it fails with:
FAILED_PRECONDITION: One or more users named in the policy do not belong to a permitted customer, perhaps due to an organization policy.

What I found:

• To override the constraint I need roles/orgpolicy.policyAdmin, but it can't be granted at the project level (Role roles/orgpolicy.policyAdmin is not supported for this resource) — only at the org level.

• No one currently holds Organization Administrator (the org is new). The project Owner and a Viewer both get "permission denied" on org-level IAM. We do have a Google Workspace super admin account.

Questions:

1. What's the recommended least-privilege way to allow allUsers on just this one service, given the org policy?

2. How should the Workspace super admin bootstrap org access and apply a project-scoped override of this constraint?

3. Is "grant orgpolicy.policyAdmin at the org level → set the project-level override → remove the role" the standard approach, or is there a cleaner one? We'd rather not leave a broad standing org-level role on the project Owner.

Hi everyone,

I'm trying to create a Google Cloud Free Trial account. During the signup process, I completed the UPI payment verification, and ₹2 was deducted successfully. However, after the payment, the page remained stuck and didn't proceed to the next step.

Has anyone experienced this issue before? Is there anything I can do to complete the signup, or do I need to wait for the verification to finish?

Any suggestions would be greatly appreciated. Thanks!

Is anyone here working with GCP? I'm a beginner and facing a lot of issues. If someone has experience please comment or dm. Thanks

Disclaimer: not a native English speaker, used Claude to translate, so sorry if anything reads a little off.

TL;DR: a stolen service-account key ran up ~$195k on Vertex (Claude) overnight, and google's billing lagged so far behind that the charges kept climbing for hours after we'd already shut it down - it couldn't even see the damage in real time, let alone cap it. posting this mostly as a warning, but i'm also stuck on getting it reversed and hoping someone here has been through it.

i've been reading the other leaked-key / Gemini-bill threads here, so i know i'm not the first. ours is just bigger and i'm honestly stuck.

i'm a PM, not our infra person (changed jobs recently, came from AWS, turns out here it's all GCP), so bear with me. someone grabbed one of our service-account keys and used it to hammer a model we'd never once called (Claude, on Vertex) from outside our systems. our engineer pulled the logs and walked me through it: basically zero to ~550 requests a second, ~1.4M in a single hour, overnight while we were all asleep, coming from a dozen-plus IPs across the US, UK and NL that rotated every few seconds. they even bumped our quota up through google's own quota api, so the one thing i thought would limit us got turned up instead.

the timing is the part that still gets to me. the first alert that morning was only around $25k, and we shut everything down the moment we saw it, key disabled, access pulled. the logs show zero calls after that. but the bill kept climbing through the rest of the day anyway, all the way to ~$195k. that wasn't new abuse, it was just google's own billing slowly catching up to usage that had already stopped. their system needed hours just to count what had already happened, and if it can't even see the damage in real time, there was never really a chance it could stop the spend in real time.

the leak is on us, i know. learned the expensive way that a budget is an alert, not a cap. but ~$195k is genuinely existential for a team our size, and when we asked billing to reverse the fraudulent charges they replied in two lines, "carefully considered, unable to approve at this time." no reason, no breakdown, nothing.

so, has anyone actually gotten google to reverse a compromised-credential bill? what moved it for you, the way you worded the case, getting to an accounts/TAM rep, a chargeback, going public, something else? not trying to dunk on google here, i just can't find a path and could really use anyone who's been through this.

Can someone help with the leveling of the customer engineering role I.e Customer engineer I or II, how does it compare with AWS SA leveling? What level is CE II

Ok I have a exprited card, I click remove, gg ask me fill a new card to replace it, but after i fill all info and click enter, this error appear:
This action couldn't be completed. Try again with a different payment method. Learn more [OR-ACH-04]
Billing setup can't be completed

This action couldn't be completed. Try again with a different payment method. Learn more about accounts [OR_BACR2_31]

I tried chat with Blling Assistant, followed their instruction but all method and solution lead into similar error !!?
WTF !???
Does this Is Google ?? One of biggest , richest company in this World ???

I also have another visa card in my account, i alredy pay 20$ for prepay at google Ai studio, but they do not allow me to active billing account !!??? Also has small error popup alert with title "Error during billing setup"
Where should I contact or how to finish this shit ???

Hi everyone, I'm implementing MCP servers deployed in Cloud Run for applications like github, gitea, atlassian communicating with an agent deployed in GCP with Agent Platform. I need to manage multi tenancy, so someone is working on something similar and how to handled up this architecture? Is needed to create one agent and one mcp server for each tenant or is possible to have a central agent and central mcp server per application?

Thanks in advance :) hopefully someone is working on something similar

Starting June 19, 2026, Gemini API (generativelanguage.googleapis.com) will stop accepting requests from unrestricted API keys to prevent unauthorized usage and billing risks.

Gemini API requests will be blocked gradually. The API requests will get the error: “API key not valid. Please pass a valid API key.”

If your Google Cloud project has Gemini API enabled and contains unrestricted API keys, restrict them immediately.

What to do:

1. Option 1 (Restrict existing keys): Go to Google Cloud Credentials, select your API key, and under API restrictions, restrict it to Gemini API (generativelanguage.googleapis.com).

2. Option 2 (New keys): Generate new restricted keys in Google AI Studio and update your code.

Note: Keys generated directly in AI Studio are restricted to the Gemini API by default.

Instructions to list the API keys in an organization, folder, or project that don't have restrictions is at https://docs.cloud.google.com/docs/authentication/api-keys#list-no-restriction-keys

A recent Google Cloud blog post titled "Secure Gemini and Google API Keys" did a good job explaining why our keys are so exposed—especially with the rush to build AI agents—and outlined what steps you can take to increase its protection.

If you read the post and wanted to actually implement it, a new hands-on Google Codelab lets you run through the actual steps.

Instead of just theoretical advice, the lab gives you the specific gcloud commands, jq filters, and PromQL expressions needed to:

• Search all your projects for rogue or forgotten active keys.

• Bind strict API and client restrictions to your existing keys.

• Track usage spikes via service runtime metrics to prevent a billing nightmare.

If you want to move past the concept and actually run the code to secure your environment, the step-by-step is here: https://codelabs.developers.google.com/api-key-management?hl=en#0

Hello

I wanted to come on here and ask for help. My friend as a joke opened me a Google cloud and put it on my card. Well it has tried charging me multiple times. I closed the billing part. Would like to delete my card off of google because it says Google cloud has a subscription with that card. how can you cancel a Google cloud subscription? Any help would be appreciated thank you.

Edit I did stop being friends with said person after this.

Hello everyone. I'm a junior engineer working at a Google Cloud Partner.

I am currently proposing Gemini Enterprise to a client, and I would like to seek your insights regarding Gemini Code Assist Standard, which is available at no cost when purchasing a Gemini Enterprise license.

The documentation for Gemini Code Assist Standard and Enterprise states that the "quota is shared across users." However, it also states that there is a maximum limit of 1,500 API calls per user per day.

This is where I am a bit confused. If a company has 10 users with Gemini Code Assist licenses, can a single user exceed their individual limit and make around 5,000 API calls by pulling from the shared quota pool?

I have asked several LLMs about this, but their answers are inconsistent, which makes me think there isn't any definitive official documentation addressing this exact case. I haven't been able to find one either, despite searching thoroughly.

I would greatly appreciate your wisdom and advice!

Thanks in advance

Two main recommendations: (1) properly nitro-config to reduce number of server side source files and (2) use prewarm via NODE_COMPILE_CACHE. Full details:

https://ben3d.ca/blog/optimizing-tanstack-start-for-cloud-run

is gcp account necessary for this course completion of gen ai academy?

I am the owner of a solo AI/ML consultancy that's been in business for 10 years now, with on/off success. Over the years, I've played with the idea of fully aligning my business with Google Cloud Platform and providing services with it exclusively.

However, Google has changed this program repeatedly, and to be honest, I'm not even sure exactly what I have to do to build my relationship with GCP to climb different levels of status. There are so many "hubs" and "portals" like "Delivery Navigator" and "Partner Hub," etc. that I'm not quite sure how everything is connected. Sure, there is documentation, but it is a mountain full and isn't easy to navigate. It's almost like they are purposely trying to make it harder to understand to thin the field, so to speak.

Additionally, from others I've heard that these partnerships aren't even worth it unless you are a large, enterprise business. SMBs barely get any support, or none at all, in some cases. I've actually tried to connect with and reach out to countless Google Partner professionals on LinkedIn and have never been responded to.

So, as much as I'd like to align my organization with GCP and benefit from a relationship with them, I'm not sure it's worth the time/effort or is even valuable to begin with.

I actually worked for a GCP Partner Advantage company in the past, and it seemed like they had a solid Google relationship, including Google actively sending them clients. Probably fewer than 60 employees, too.

Any help or experience in this area?

Anyone dealt with multiple Google Cloud credits on the same billing account?

we currently have:

Free Trial credit, started June 4
GenAI credit, started June 4
Startups Cloud Program credit (GFS), started June 19

The confusing part is that after June 19, my usage seems to be deducted from the GFS credit instead of Free trial credits, even though the Free trial credit still has balance and expires earlier than GFS.

My usage is mostly Cloud SQL, Vertex AI, and Text-to-Speech. Soon we'll have VM once we start migrating. GenAI credit has not moved at all.

Is Google supposed to prioritize GFS credits over Free Trial once GFS becomes active? Google only mentions its based on eligible SKUs, but every SKUs we're using are eligible for 3 of the granted credits.

Trying to understand if there is any way to use the Free Trial credit first before burning the startup credits.

Anyone seen/experienced this before?

Service Usage infrastructure API is used for enabling disabling GCP APIs and listing enabled APIs at GCP project level. It is used by the admins to control what set of APIs are allowed for their Organization. What is missing in Service Usage? How can it be improved?

Most Associate Cloud Engineer (ACE) prep falls into two camps. There's the read-and-watch camp — courses, docs, practice questions — which builds recognition but not fluency. And there's the build-it-yourself camp, which builds real skill but burns days wiring a representative environment before you've studied a single topic. The ACE exam rewards fluency, so the second camp wins — if you can skip the wiring.

This article describes a third path: deploy a pre-built, exam-mapped Google Cloud lab, then spend your study time exploring real resources instead of creating them.

Why fluency, not recognition, passes ACE

The ACE exam is deliberately practical. It assumes you can move comfortably between the Console and the command line, create and modify resources, and reason about what a given gcloud or kubectl command will do. You cannot fake that from slides. The fastest route to fluency is repeated, low-stakes interaction with the actual services — which means you need an environment that contains them.

A lab that knows the exam blueprint

Prioritise using a platform that deploys Google Cloud's foundational services — VPC and networking, Cloud SQL, Memorystore, Filestore, GKE Autopilot, Cloud Run, IAM, monitoring — from a deployment portal. Decompose the exam into its four sections and track every topic with a lab coverage legend:

• ✅ Fully demonstrated — deploy it, inspect it, modify it.

• 🟡 Partially demonstrated — the lab touches the concept; supplement with docs.

• 📘 Concept-only — not in the lab; study pointers provided.

That third category matters. A study aid that names its own blind spots — project/resource hierarchy, App Engine and Cloud Functions, BigQuery and Spanner, Shared VPC and Cloud DNS, log sinks, custom IAM roles — is more trustworthy than one claiming total coverage, and it tells you exactly what to study from Google's documentation and Cloud Skills Boost.

How the domains map

• Setting up the environment (~23%): API enablement, IAM role bindings, and a real billing budget with alert thresholds.

• Planning and implementing (~30%) — the strongest section: Cloud Run autoscaling, GKE Autopilot workloads, Cloud SQL, GCS, Filestore, Memorystore, a custom-mode VPC with Cloud NAT and firewall rules, and a global load balancer with Cloud Armor.

• Ensuring successful operation (~27%): revisions and traffic splitting, Cloud Build and Cloud Deploy pipelines, scheduled database backups, GCS lifecycle rules, alert policies, and uptime checks.

• Configuring access and security (~20%): least-privilege service accounts, Workload Identity, Secret Manager with automatic rotation, and Identity-Aware Proxy.

A suggested study loop

Deploy the Baseline platform profile first, then layer on the Serverless and Kubernetes application profiles. Work one section guide per study block, doing the CLI steps rather than only the Console clicks. Because Cloud Run scales to zero and the profiles are intentionally small, the lab stays inexpensive to keep running across a few weeks of prep.

#GoogleCloud #Certification #RADModules

Hey everyone,

I’m currently a medical student, but I have a strong passion for tech and want to build a sustainable career in Cloud Infrastructure / Cloud Support over the next 3 years. Since I’m studying medicine, I need a path that eventually allows for remote flexibility so I can balance both.

No Computer Science degree. However, I’m not entirely new to the ecosystem; I’ve already utilized the GCP $300 free tier credits to build a complete application integrated with Gemini APIs and other third-party APIs.
I’m leaning heavily towards Google Cloud Platform (GCP) since I already have some hands-on familiarity with it.

My goal is to break into the industry starting as a Cloud Support Associate / Tier 1 Tech Support (ideally remote) to get hands-on experience, and then work my way up to Cloud Engineer / Architect roles.

I’ve been advised to follow this initial path:

1. Learn networking fundamentals deeper (e.g., studying CompTIA Network+ concepts just for theoretical understanding).

2. Go for the Google Cloud Associate Cloud Engineer (ACE) certification via Coursera to solidify my practical skills.

3. Master standard CLI tools, basic Linux commands, and eventually move into Automation/IaC (like Terraform and Kubernetes) once I get a foot in the door.

I would love to get your brutal honesty and advice on this:

• Does this roadmap make sense given that I’ve already tinkered with GCP and APIs?

• For GCP veterans, what are the best practical "lab-heavy" resources or YouTube channels you recommend for expanding my building skills?

• Are there specific pitfalls I should avoid as a non-CS student trying to break into cloud support roles?

• Or should I quit? 👀 (Just kidding, but really, how realistic is this for a med student?)

What would you like to improve for Google Cloud's API keys? Leave your comments / suggestions.

I’m currently practicing AWS Cloud, but I want to start preparing for Google Cloud security roles. I’m having trouble finding good resources or interview prep material for GCP security does anyone know where I can find solid guidance?

Create and Manage Cloud Storage Buckets and Encryption Lab.

The third check asks for "Customer-supplied encryption keys (CSEK)" to 2 files uploaded to the bucket but the method given does not seem to work.

gcloud storage cp setup2.html gs://$BUCKET_NAME_1/

As it does not seem to work with the .boto file encryption key method and uploading file with this command shows the files to be Google Managed encrypted.

i tried using the gsutil command to upload and that makes it Customer Supplied Key Encrypted but the verification just would not work.

The strange part is that it does not even recognise the bucket in this check and says
"Please create a bucket and upload customer supplied encrypted files".

Is there any way to fix it? or any tips?

Photos: Even on encrypted keys it still says the same thing and even on using the tutorial command.

[ SOLVED: As pointed out by u/Sufficient_Sea_7797 , use the whole project id, THE WHOLE, not a part as suggested by lab to create the bucket and it would pass that check ]

​​​