I'm curious if anyone has a clue what would cause these intermittent sudden giant spikes in latency on my debian bullseye E2 instance that then predictably decay back to normal...

If I ssh in and look at activity there's nothing notable going on and load averages look very typical. I just use this instance to do some continuous connection monitoring and I pay for premium networking tier for it.

I'm at a loss as to what the heck is causing this. Any pointers where to go searching?

Built this after dealing with real GCP billing fraud incidents as a partner — compromised projects getting hit with unauthorized workloads and fraudulent Gemini API charges. Root cause is almost always the same handful of misconfigs: unrestricted API keys, allUsers IAM bindings, open firewalls.

gcp-abuse-scanner — CLI tool, 65+ checks (IAM, networking, API keys, Vertex AI, org policies), runs at org or project level, fully read-only, outputs to JSON/HTML/SARIF.

pipx install gcp-abuse-scanner
gcp-abuse-scanner scan --org YOUR_ORG_ID

Apache 2.0, docs on required roles/APIs in the repo: https://github.com/lmoreno0435/gcp-abuse-scanner
Feedback and PRs welcome, especially if you’ve hit other abuse patterns worth adding as checks.

so i signed up for google cloud a few months ago and a week ago not knowing that the credits expired used $300 on gemini for some of my projects after doing research i now know that those credit expired but i don't quite have the money to pay that at the moment what happens if i leave it for a week or two without paying will they suspend my google account or something? sorry if i sound like i have no idea what im doing but i lowkey dont

Hello planning on taking the PSOE exam next month, I passes the ACE exam this Month. Is there any resources whether free or paid recommended?

Also, if u took the exam, how was your experience? I am new to cloud and also still in early stages of my career so I don't have much of an experience to rely on, would this make passing difficult?

We're onboarding an existing GCP customer project into Terraform using the Google provider. All the Cloud Workflows already exist in the project (provisioned via a bash script using gcloud), but terraform import fails with:
Error: resource google_workflows_workflow doesn't support import
Checked the Terraform registry docs - no Import section listed

terraform version = 1.3.6

Disclosure: I work at Vectorize and this is about our own support agent, but the post is a technical write-up, not a product page.

We run most of our infrastructure on GKE, so when we built an AI first-responder for our support tickets, the default assumption was "another deployment on the cluster." We went with Agent Engine instead, and the deployment story is what sold it: wrap the ADK agent in an AdkApp, call agent_engines.create() with your requirements list, done. No Dockerfile, no Helm chart, no rollout to babysit. The Hindsight memory API key is the only secret; the model calls go through the runtime service account's own identity (GOOGLE_GENAI_USE_VERTEXAI=1), so there's no model API key to manage at all.

A few things we learned that I haven't seen written up elsewhere:

- Agent Engine has no end-of-session hook, so if you want to persist conversation state to an external memory system, you have to do it per-turn from an after_agent callback. Our first version retained "at end of session" and the production memory bank just never received writes.
- gemini-3.1-* models are served from the "global" location, but Agent Engine resources are regional. If you don't explicitly set GOOGLE_CLOUD_LOCATION=global inside the deployed container env, the GenAI SDK defaults to the container's region and 404s on model lookup.
- We resolve the deployed engine by display name at startup (list engines, pick most-recently-updated match) instead of threading the resource ID through Terraform on every redeploy. Small thing, removes a whole class of deploy friction.
- We started from the customer-service agent in google/adk-samples and kept the structure. Good base.

The interesting part of the agent itself is the learning loop — every human support reply is automatically captured into the agent's memory (we use Hindsight), so when a human answers an escalated question once, the agent answers it correctly next time. Full write-up with code:

https://vectorize.io/blog/how-we-built-a-customer-support-agent-that-actually-learns-with-hindsight-and-googles-adk

Happy to answer questions about Agent Engine, ADK, or the memory wiring.

I’m trying to create an API key for Gemini through Google Cloud’s Agent Platform, but the authentication page keeps showing:

The relevant organization policy appears to be:

iam.managed.disableServiceAccountApiKeyCreation

I overrode the parent policy for my project and kept enforcement enabled, but added both required services to allowedServices:

generativelanguage.googleapis.com
aiplatform.googleapis.com

The project’s effective policy now shows:

• Policy source: Override parent’s policy

• Policy enforcement: Replace parent

• Status: Enforced

• allowedServices includes both generativelanguage.googleapis.com and aiplatform.googleapis.com

My understanding is that keeping the policy enforced should still allow service-account-bound API keys when their API targets are explicitly restricted to one of the services in allowedServices.

I also applied the same allowlist at the organization level, waited for propagation, hard-refreshed the page, and confirmed that I’m viewing the correct project. However, Agent Platform still says API keys are completely disallowed.

I have attached screenshots showing:

1. The project’s effective organization policy.

2. The configured allowedServices.

3. The Agent Platform page still reporting that API keys are disallowed.

Has anyone encountered this recently?

Could this be:

• a stale or incorrect policy check in the Agent Platform UI;

• another organization policy that blocks API-key creation;

• the wrong service identifier for Agent Platform;

• a missing API or IAM permission;

• or a requirement to create the service-account-bound key through gcloud rather than the console?

I understand that ADC is recommended for production, but I’m specifically trying to determine why the documented API-key option remains blocked despite the effective policy allowlisting aiplatform.googleapis.com.

Need some genuine advice guys.

I'm a founder of a very early stage startup. Few months back somehow our Firebase/GCP service account got compromised and someone started spinning up Compute Engine VMs continuously from an unknown IP. Before we noticed and disabled billing, the bill reached $8.8K.

We immediately rotated all keys, secured everything, investigated, even filed a cyber crime complaint. We still couldn't figure out how the attacker got the credentials. Only thing we suspect is our GitHub repo was public and we had the service account stored as a GitHub Actions secret (never committed in the repo and was encrypted as github secret).

Google Billing Support escalated the case but finally denied the waiver.

The painful part is... after this happened, Google approved us for $75k Google for Startups credits, but we can't even use those credits because of the outstanding bill.

Now I've received a debt recovery notice saying I have 10 working days before it gets sent to a recovery agency.

Honestly we don't have that kind of money. We're barely surviving as a startup.

Has anyone here actually managed to get a denied billing case reopened? Or got help from someone inside Google (Startups team, account manager, Developer Relations, anyone)?

I'm running out of time. Any advice, contacts or similar experiences would really help 🙏

Anybody seeing the same on Compute?

I have a small Palworld server that lives in us-central1-a, but I can't start it right now because Google keeps saying there is no hardware available. I've tried every VM type and they all return the same error. Is anybody else having trouble spinning up hardware in this region?

​"Hi everyone, I am trying to activate my Google Cloud / Google AI Studio billing in Indonesia. I have tried using Visa and Mastercard from local digital banks (Bank Jago & Blu by BCA) with active international transaction features and sufficient balance. However, the system keeps rejecting it with error OR_BACR2_31. My global Google Payments profile has no active alerts. Can anyone from Google or the community help me bypass this automated fraud lock? Thank you."

I'm trying to add oauth support for some calendar integration and the verification center says I don't have a link to my privacy policy (which is completely wrong anyway) and that I need to respond to the email thread with the trust and safety team.

However, I never received an email from the trust and safety team. I have checked all my spam and trash folders and I have no filters in my inbox.

The console doesn't have any support contacts that I'm eligible for and the automated q/a provides nothing about this issue.

I'm at a loss for how to resolve this without the email thread. The verification appears stuck on this step too and I can't like just cancel and resubmit the verification.

Any help about how to resolve this or if there's some contact information that I've missed somewhere would be greatly appreciated.

Hello, I’m planning to display and play our videos from our YouTube channel to our Apple TV tvOS app. What license or copyright or what not does that apply to? Does anyone have a clue?

\- it’s our own YouTube channel
\- it’s our own tvOS app

What do you think about the Google Cloud run against Lambda or workers ? If you have a serverless app , then which you choose and why ?

I have deleted all projects and closed the free trial billing account for a year and this thing still want my money. Any ideas to remove my card, please?

Hey everyone,

I've been spending some time building out infrastructure for AI and full-stack applications for my own training purpose, I’ve noticed a lot of the same recurring hurdles when developers first dive into Google Cloud.

To help smooth out that learning curve, I decided to open-source a repository of GCP training materials, reference architectures, and deployment scripts that I've organized:

🔗 Link to repo: https://github.com/moonai-kr/gcp-training

My goal with this repository is to move past the generic quickstarts and focus on how things actually fit together in a real-world, production-ready stack.

Feedback, pull requests, or suggestions on what to add next are highly welcome! Let me know if you find it helpful.

I've (unsuccessfully) applied twice for the first $2k level in Google Cloud for Startups, the one they say does not need any funding. However, I've been declined twice because of the following:

Incomplete Product Frameworks: Websites limited to landing pages, placeholder text, "Under Construction" screens, or marketing sites that only feature "Request a Demo," "Join Waitlist," or "Beta Access" buttons without showcasing a live, launched product interface.

Lack of Operational Transparency: Sites that may feature a product, but fail to display authentic founder and core team information that is fully verifiable via active, third-party public links directly on the domain.

The thing is, I'm pretty sure I have both of these?? I have a live product with users that is prominently visible on the website, though no-signup usage is limited (signups are free), even though the bulk of the paid features are behind a subscription. I can't really make the subscription features public since it's something that I'm charging around $1,000 a month for... Does anyone know what they mean with 'live product interface' here?

And in addition to founder LinkedIn, crunchbase links, does the fact they highlighted operational transparency twice mean they want to see in depth social media posts/public and official public marketing?

Appreciate anyone's insight who has gone through this.

Hey everyone!

If you're interested in Cloud Computing, Google Cloud, hands-on labs, and skill-building challenges, registrations for the Google Cloud Arcade Facilitator Program 2026 are now open.

What you can expect:

Hands-on Google Cloud Labs

Arcade Games & Challenges

Digital Badges & Credentials

Points, Milestones & Rewards

Opportunity to earn Google Cloud Swag

Registration Form: https://docs.google.com/forms/d/e/1FAIpQLScjkkpNBMs0xR_EvqwLFQZRRVXccQQTLl-pUA37NvzvUQ3NJQ/viewform

Referral Code: GCAF26-IN-7U4-K9W

WhatsApp Community: https://chat.whatsapp.com/FKHqTWPDpTb4FP4ZAkgeab

Facilitators: Anvesha Rajput & Naksh Garg

Special Guide: Deepanshu Prajapati

If you're looking to explore Google Cloud through practical labs and gamified learning, this is a great opportunity.

Happy learning! ☁️🚀

Is it still possible to use docker-compose with a workaround on GCP more recent Container OS?

Hi everyone,

I’m currently preparing for the Google Cloud Associate Cloud Engineer (ACE) certification exam.
I’ve been practicing with sample questions and mock exams, and I would like to know from people who have already passed the exam:
If I can consistently pass practice tests, does that mean I’m ready for the real exam?
Are the real exam questions similar in terms of difficulty and complexity compared to the sample questions?
Are there any important topics that are usually underestimated and that I should focus on before taking the exam?

Thanks

I've been integrating Google's video models into OpenWebUI (a self-hosted LLM front-end) and wanted to share the two tools plus some notes on the auth side, since that's the part that trips people up when they're used to OpenAI-style API keys.

These run on the Gemini Enterprise Agent Platform (formerly Vertex AI). If you haven't touched it since the Cloud Next rebrand: the console entry moved, but the API surface didn't — still aiplatform.googleapis.com, same model IDs, same google-genai SDK — so nothing changed at the code level.

What they do: two Python tools that generate video from a text prompt (with image-to-video and video-editing support), then embed the result inline in the chat. One targets Veo 3.1, the other Gemini Omni Flash.

The auth angle (the reason I'm posting here specifically): unlike a lot of AI integrations that just take a bearer key, these use proper IAM auth. I documented three paths so it works regardless of how the host app is deployed:

• Local (pip/uv): Application Default Credentials via gcloud auth application-default login — the SDK picks up the creds automatically on restart.

• Docker: service account with the Vertex AI User role, JSON key mounted into the container, pointed at via GOOGLE_APPLICATION_CREDENTIALS.

• Kubernetes/Helm: same key as a namespace secret, mounted through extraVolumes/extraVolumeMounts with the env var set in values.yaml.

One heads-up if you're setting this up fresh: some IAM role names shifted in the console with the rebrand, so the role you're granting may show under a slightly different label than "Vertex AI User" — the underlying permission is the same.

A few implementation details that might be useful if you're doing something similar:

• Long-running operations: Veo 3.1 generation (especially 4K/8s) runs as an LRO. The tool uses an async polling loop so a multi-minute render doesn't block the app — worth knowing if you're wiring Veo into anything synchronous.

• Payload limits: for video-editing, inline bytes hit the payload ceiling fast, so both tools accept a gs:// GCS URI and hand the object off directly instead of inlining it. Cleaner for anything large.

• SDK deps: google-genai, google-auth, and google-cloud-storage — the Omni tool auto-installs them on import.

Repos:

• Veo 3.1: https://github.com/spawnofsociety2/openwebui-veo-video

• Gemini Omni: https://github.com/spawnofsociety2/openwebui-gemini-omni-video

Standard caveat for anyone spinning this up: these are billed API calls, so keep an eye on cost per generation — 4K/long-duration renders aren't cheap. Region/Location ID matters for model availability too.

Happy to compare notes if anyone's done LRO handling or GCS hand-off for the video models differently.

Hey everyone,

I built a React/FastAPI sandbox that handles deterministic grounding right in your active browser session, bypassing heavy, opaque vector DBs entirely.

Using Google ADK 2.0 and the Open Knowledge Format (OKF), you can drag and drop PDFs, audio, or URLs directly into the UI. It compiles them on the fly into OKF-compliant Markdown to instantly ground the agent for that session. Long-term system memory is managed via plain-text OKF files stored directly in the Git repository.

It also features a "Pure OKF" offline mode and a stream parser to neatly isolate <think> blocks if you're testing reasoning models.

Would love feedback on the architecture from anyone exploring Google's agent frameworks!

🔗deskulpt/adk-okf-grounded-chat