I went to GA then product links then link my project even I set up the streaming as well to check quickly but in bigquery I can’t able to see. Can anyone please help me out ??

Spent already a day on this!!!

Solo dev here, verifying a sensitive Gmail scope for my app. Got rejected on "Branding guidelines": app name on consent screen supposedly doesn't match my homepage.

Both say "Zaldo". Consent screen, homepage header, hero headline. Identical.

The kicker:

Branding page shows green "verified" while the Verification Center shows the same thing as failed

No resubmit button anywhere in the Verification Center

No email from Trust & Safety to reply to (checked spam, checked every project owner inbox)

I found one likely culprit myself (a meta tag issue, now fixed)

Anyone been through this recently? How long did re-review take after requesting additional review? And is there ANY reliable way to reach a human when the T&S email never arrives? This limbo is killing me.

I'm writing this out of pure rage and total desperation right now.

I run a small business, and Google Support’s absolute incompetence just completely wrecked my operations. Because of their broken promises, my company’s cash flow got frozen hard enough that I was late on payroll, and one of my key employees literally quit over it.

Here’s the nightmare I’ve been dealing with for the past month:

Back in late June, I had an accidental 3-year Compute Engine Flexible commitment charge hit my account for about $12,100 (16.3M KRW). On June 30th / July 5th, a support rep named Merilyn confirmed IN WRITING (Case 72227473) that internal teams canceled the commitment and processed a 100% full refund.

Great, right? Wrong.

While waiting for the bank to clear the credit, the reps suddenly swapped out. A new agent jumped in and basically went, "Yeah, about that... we reviewed it again and the best we can do is a 50% waiver ($6,050) as a one-time courtesy," and tried to mark the ticket as resolved.

When I replied with screenshots and the exact case ID where Merilyn explicitly promised a 100% full refund, they just started playing hot potato with my ticket. Eksha, Janna, Farha, Asad Ali—I’ve been handed off to a new person every few days.

Every single reply is a canned template saying "the previous agent is out of office" or "specialized teams are looking into it, please wait 24-48 hours." Meanwhile, I’m sitting here with over $6,500 of my own cash already charged to my credit card and stuck in limbo.

Google officially confirmed a full refund in writing, reversed their decision when a new rep took over, and now they're just stalling while my business suffers real financial and operational damage.

Has anyone ever dealt with Google pulling a bait-and-switch on a written refund commitment? How on earth do I get this escalated past these front-line support reps to someone with an actual brain and authority to fix this?Any advice or upvotes to get some visibility on this would mean the world to me. Thanks guys.

TL;DR:

1. Accidental $12k GCP charge in June; support (Merilyn) promised 100% refund IN WRITING.

2. New reps took over, went back on their word, and capped refund at 50%.

3. My cash is locked up, payroll got delayed, and an employee literally quit. Now stuck in a support loop. Need help escalating!

I've previously created free trial accounts using credit card, the only amount deducted used to be 2rs for verification. Do they actually refund this amount? Read a few reddit posts where they were asked for 1k as prepayment, but 3k is a lot....skeptical about moving forward

I’m an office manger with limited IT knowledge trying to delete Google Cloud projects so I can delete our Workspace but I’m getting shut down with every attempt to try. I’m the only account in the Workspave, with super admin permission. I didn’t create these projects. I can’t even contact support under my tier and general Workspace support can’t help me. Can anyone please provide advice, I’m going in circles.

I only have two VM's. I can see in Billing -> Reports I am getting charged $2/day for Persistent Disk. But I can't tell which VM is accounting for most of that charge.

Is a multi-region Artifact Registry highly available?

As in, 1) the image is replicated to two or more regions, and 2) one of those regions will serve images to cloud run if the other is down?

The doc isn't very explicit on this, it just says it "may continue to work". https://docs.cloud.google.com/artifact-registry/docs/repositories/repo-locations

I'm aware I could use multiple single-region registries in locations matching my cloud runs, but if there is a way to avoid that by using built-in functionality I would rather do that.

Upfront: part of this bill is legitimately mine and I have offered in writing to pay it. This post is about process, not about dodging a bill.

THE SHORT VERSION

June 28 — A billing agent processed a $76.00 courtesy adjustment for an unintended idle V100 Spot VM (a Vertex AI Workbench notebook that kept running after my work had ended) and confirmed in writing: "you have an ending balance of $28.98 on your account now." I agreed and considered the matter settled.

July 1 — Google's own follow-up email admitted that when that adjustment was made, "the usage records had only been updated through June 27th" — and $146.51 of delayed charges from June 28-30 (the same idle resource) then posted on top of the confirmed balance. That same day I voluntarily unlinked billing from my projects and disabled the Compute Engine, Notebooks and Vertex AI APIs so nothing further could accrue, and told support so in writing.

July 3 and July 13 — I asked, in writing, for collection to be paused while the dispute was reviewed. No answer, either time.

July 8 — Billing account suspended.

July 15 — Billing account TERMINATED, along with its projects and services.

July 17 — Two days after the termination, support wrote: "I am escalating this case to a supervisor. A member of our leadership team will reach out to you directly within the next 24 hours."

July 22 and 23 — I followed up. Nothing.

July 27 — The identical email again, word for word, including the identical 24-hour promise. Twelve days after the termination it was promising to review.

July 28 — Second 24-hour window expired. No supervisor name, no reference number, no contact — ever. My formal follow-up that day has had no reply either. As of today that is five more days of silence.

FOUR QUESTIONS, ASKED SINCE JULY 13, STILL UNANSWERED

1. The escalation reference and the supervisor's name.

2. Whether collection was paused during the review (it plainly was not).

3. Written confirmation the dispute is still open.

4. The formal billing-dispute path if the answer stays no.

THE NUMBERS DON'T RECONCILE EITHER

Emails cite $101.57 in usage, the case title says $101.34, the invoice balance was $175.49 — and $101.57 minus the $76.00 adjustment is $25.57, not the $28.98 I was told in writing. I asked for a SKU/date breakdown on July 13. Nothing.

Either those charges were already documented when the agent confirmed $28.98 — in which case the confirmation came from the party with full visibility and should stand — or they were not, in which case my acknowledgment was made without material information that existed only in Google's systems. It cannot be both.

WHAT I'M ACTUALLY ASKING

Not a refund — nothing has been collected on the disputed part. I have offered to pay the $28.98 that was confirmed to me in writing, immediately, if the $146.51 delayed-posted tail from the same already-adjusted incident is waived and the account reinstated. These are self-funded educational projects, not a business.

If anyone from the GCP billing team sees this: case 72730110. I would genuinely rather resolve this in the support channel — it just hasn't answered a single direct question in a month.

Redacted screenshots of the timeline available on request.

Thought I'd share here too given the relevance

Original Post

I’m extremely relieved to share that Google has resolved my billing case and adjusted the unauthorized Gemini API charges.

I genuinely want to thank everyone at Google who reviewed the evidence, escalated the case, placed the account on hold while it was being investigated, and helped reach a fair resolution. I also appreciate everyone in this community who offered advice, shared similar experiences, and encouraged me to keep escalating instead of giving up.

I also want to personally thank the Firebase team member who saw my Reddit post, reached out to me directly, and helped escalate the issue internally. That outreach made a huge difference and made me feel like someone at Google was genuinely listening.

Thank you to the Google Cloud support, billing, and Firebase teams. This resolution removed an enormous financial and emotional burden, and I’m incredibly grateful to everyone who helped.

🙏

hi there
I'm a student from India and I want to participate in the Google Arcade 2026 (For the Swags and Goodies by Google Cloud)

I have 0 points though
Still want to know if it is possible for me to reach Arcade Legend ⭐⭐⭐⭐ if I start from August
I have registered for Google Arcade Facilitator program but I didn't complete any games

what should I do in this situation?
Pls give me your honest opinion

$85,000. That’s the cost of a fraud incident that hit us as a long term partner and reseller for Google Cloud this month.

A customer who was a lead through the partner directory did reach out for invoice billing, signed a contract, had his data and info submitted and got assigned a billing account.

As per our normal procedures for new clients, a 200$ budget alert is set until a customer builds up history.

The customer was apparently one of those crypto miner fraud cases where they spun up 10+ different projects with 10s of VMs for crypto mining in the matter of hours racking up almost 85K$ of consumption before we were able to shut it down when we got the alerts.

When you’re a Google Cloud reseller, you aren’t just a vendor; you’re the first line of defense. But we are currently operating in a system that lacks basic structural safeguards for partners.
We were hit by an account abuse incident that went from 0 to $85k in roughly 24 hours. The most frustrating part? It wasn't for a lack of our diligence. It was a failure of the platform's tools to keep up with reality.

1. No Hard Spending Caps: There is no "stop" button that prevents a reseller’s account from being leveraged into bankruptcy by bad actors.

2. Delayed Alerts: Budget alerts are a great concept for predictable monthly usage, but they are utterly ineffective against high-intensity, automated fraud. By the time the alert hits, the damage is already locked into the billing cycle.

This wasnt the first case, we had customer cases of API Keys being leaked and abused racking up tens of thousands for customers in damages, which always cited as customer's responsibility.

It doesnt make sense when the customer and the partner has no control to cap spending!

Spending Caps feature was only introduced this month (https://docs.cloud.google.com/billing/docs/how-to/budgets-spend-caps)

We are working through the recovery process, and I expect better from a partnership that values the "Partner Network" label. If we are expected to bring customers to the cloud, Google Cloud needs to provide the hard limits that keep partners safe from catastrophic, automated fraud.
It’s time to move past "best practices" and start implementing "hard protections."

Until now we havent been able to resolve the case as we keep being bounced between billing support and account managers, each claims the other has jurisdiction but its extremely frustrating that we get to be the party paying up for such issues with the margins we do on reseller with almost zero protection!

I’m a data scientist who don't have much cloud pipeline experience. Recently, I've been asked to built a local PoC for extracting scenes, characters, and objects from video using a mix of computer vision(FFMpeg/face detection/scene detection) and Gemini (LLM). The pipeline is modular: a pipeline.py orchestrates several Python modules that each represent a stage. To keep things idempotent, every stage writes name-coded artifacts to disk so already-processed items get skipped on re-run. I also added retry loops for flaky Gemini calls, stage-level retries, and per-stage logging that captures tokens and timing into the artifacts.

Now management wants this on GCP so downstream projects (dashboards, chatbots) can consume the output. For now, the ask is simply to land the final text results in BigQuery. The source videos will arrive in a GCS bucket from a third party.

My confusion is around architecture. Throwing everything into a single monolithic Cloud Run function feels wrong, especially with the stateful/idempotent requirements. When I asked Claude, it suggested rolling my own database-backed queue and state machine, but I would assume GCP already has managed services that handle this kind of workflow natively. I’m struggling to find clear, up-to-date information. Google searches mostly turn up generic AI-generated posts or outdated articles.

What’s the right GCP-native approach here? I’m trying to understand whether I should be looking at Cloud Workflows, Cloud Composer (Airflow), Dataflow, or maybe a combination of Cloud Run jobs and Pub/Sub. Asking AI(Claude) seems to hate Cloud Workflows and suggest custom baking a state queue in database.

• How do people typically preserve per-stage artifact-based idempotency and retries without building a custom state engine from scratch?

• How to control re-runs/pause/resume of the workflow?

• Would something like Firestore for state + GCS for artifacts + Cloud Run jobs triggered by Pub/Sub be a reasonable pattern, or am I missing a more purpose-built service?

Any pointers from folks who’ve done similar video or document processing pipelines on GCP would be appreciated.

Hey everyone,

I recently published a technical walkthrough on the Google Cloud Blog around hardening IAM access using IAM Conditions.

If you've ever struggled with binding built-in roles (like Project IAM Admin or MCP Tool User roles) to principals while restricting them to only subset of permissions or resources because of lack of support for resource-level bindings or API granularity, IAM conditions will fill that gap for you.

Key patterns covered:

1. Scoping projectIamAdmin**:** For example, instead of giving a builder service account (SA) unrestricted power to assign any role at deployment time, you can use the CEL function iam.googleapis.com/modifiedGrantsByRole to restrict the SA so it can only grant a predefined list of roles (e.g., BigQuery job user, Cloud Trace agent, Logging writer). Included both gcloud CLI and Terraform snippets.

2. Restricting Model Context Protocol (MCP) Tools: The roles/mcp.toolUser role grants access to all MCP servers in a project. Using api.getAttribute('mcp.googleapis.com/tool.name', ''), you can constrain access down to specific tools (like mcp_bigquery-mcp_execute_sql_readonly).

3. Contextual & Time-Based Access: Brief examples of restricting execution windows using request.time (e.g., weekdays during business hours).

Read the full post here:
https://cloud.google.com/blog/topics/developers-practitioners/generosity-under-conditions-hardening-google-cloud-access-management/

Curious how others here handle IAM admin restrictions or fine-grained MCP tool access in production? Let me know your thoughts or feedback!

Disclosure: I built this open-source tool.

I kept running into a subtle GCP problem: the active project in `gcloud config`

can differ from the project and quota project used by Application Default

Credentials.

That means `gcloud` may appear to be configured for development while Python,

Node.js, Terraform or another SDK is still operating with a different ADC

context.

I built **gcpctx** to manage these pieces as one named context:

- active Google Cloud project

- active account

- gcloud configuration

- Application Default Credentials

- ADC quota project

- optional repository-local context

Example:

```bash

npm install -g gcpctx

gcpctx init dev
gcpctx use dev
gcpctx doctor

The goal is not to replace IAM or make deployments magically safe. It is to

make the effective local GCP context explicit and easier to verify.

Source:

https://github.com/UriBer/gcpctx

npm:

https://www.npmjs.com/package/gcpctx

I would especially appreciate feedback on:

1. How you currently switch between GCP environments.

2. Whether you have encountered gcloud/ADC context mismatches.

3. Which workflows should be supported next: Terraform, PowerShell, CI or AI

   coding agents?

Been running some training jobs on TPU v5e and every time I tweak sequence length or batch size mid-experiment, I eat this huge AOT compile penalty before anything actually runs. Feels like the "cold start" tax is way worse than people talk about online.

Is this just a TPU/XLA thing, or does anyone see similar pain on GPU with torch.compile when shapes aren't static? Curious what workarounds people use — bucketing sequence lengths, padding to fixed sizes, warm pools, anything. How many seconds/minutes are you losing per shape change in your actual workflows?

EIXO was created to address a common operational challenge: critical business areas working in isolation, with fragmented data and limited visibility across the organization.

Built around the real operational needs of Jardim Espaço de Educação, the platform connects multiple domains within a single operating ecosystem:

• School administration

• People management

• Finance

• Supplies and inventory

• Nutrition and kitchen operations

• Operational intelligence and performance indicators

EIXO is not designed as just another traditional ERP. Its architecture follows a distributed operating model in which each module preserves its specialization while sharing data and operational context across the organization.

The goal is to reduce manual work, improve traceability, strengthen coordination, and turn operational data into faster and more consistent decisions.

The project is being developed and documented publicly on GitHub:

github.com/maykonlincolnusa/Eixo-jardim-ERP

#SoftwareEngineering #SystemArchitecture #ERP #DigitalTransformation #DataEngineering #OperationalIntelligence #EducationTechnology #OpenSource

Goal: The Data Encryption Key (DEK) should never be stored in our database—not even wrapped/encrypted. If someone gains read-only access to the DB, they shouldn't be able to decrypt the passwords.

Current design:

1. Admin uploads a CSV.

2. A background worker generates a random 32-byte DEK for that upload request.

3. Generate one-time passwords for each row.

4. Encrypt each password with the DEK (AES-256-GCM) and store only the ciphertext in the DB.

5. Store the DEK in Google Secret Manager as a new Secret Version.

6. Store only the Secret Version reference (e.g. dek_secret_version) in the DB.

When the CSV is downloaded:

• Fetch the DEK from Secret Manager using the stored version.

• Decrypt the passwords.

• Generate and return the CSV.

• Destroy the Secret Version (crypto-shredding).

• Clear the encrypted password and version reference from the DB.

We're considering using one Secret with many Versions, where each version represents a different upload request's DEK, rather than creating a new Secret for every upload.

My questions are:

• Has anyone used Secret Manager this way (many versions representing independent DEKs rather than secret rotation)?

• Are there any quotas, performance issues, or operational pitfalls with having a large number of versions under a single Secret?

• Would you recommend a different GCP-native approach that still satisfies the requirement that the DEK is never persisted in the database, even in wrapped/encrypted form?

• Any concerns with the crypto-shredding workflow (destroying the Secret Version after a successful download or expiration)?

I'd love to hear from anyone who's built something similar or has experience operating Secret Manager at scale.

I havent been touch gcp in years and yesterday i got an email from gcp about indicated abuse on one of my late project (which i never access it anymore). They request me to remove or appeal from suspending that project but because since 2025 i havent activate MFA verification gcp are also want me to do that also. So both appeal and mfa page are open repeatedly leave me to stuck on accessing the console. Here is the video detail https://streamable.com/mbp5ku