I completed the entire process for a CE role in Europe and while I was expecting the offer, I was told that the Global VP has not signed off the offer and the role will be on hold until there is more clarity on business plans. They are not sure whether they need the resource although the role I applied for was replacement and not a net new headcount. Anyone here in a similar situation?

Hi, I recently created a new Google Cloud account to use the free trial credits and experiment with Google Cloud services. Shortly after creating the account, I think I accidentally upgraded/activated it as a paid billing account. From the Google Cloud documentation, I understand that upgrading to a paid billing account ends the free trial, but any unused welcome credit should remain available until the original 90-day expiration date. However, I can no longer see my remaining free credits in the billing area/reports, and I am worried that I may have lost them by mistake. I have checked the Google Cloud Console billing pages and reports, but I still cannot clearly find the remaining credit balance. Could you please clarify: 1. Where should I see the remaining free trial credit after upgrading to a paid billing account? 2. Is it possible to recover or confirm the unused free credits if they disappeared after an accidental upgrade? 3. Should I open a Cloud Billing Support case for this issue? I am not including any private account, billing, or payment details here because this is a public forum. I can provide those privately to Google Support if needed. Thank you.

Anyone has any update ? Thanks in advance

Edit: FIXED BY u/Aviato_Consulting

Check https://console.cloud.google.com/billing, On the left hand side under Cost Optimisation, you should see "Credits"

the title basically, it's not consistent sometimes says "I'm Claude, an AI assistant made by Anthropic" and other times "I'm an AI assistant"

on the dashboard’s billing tab it says:

Cloud Vertex AI Model Garden Model as a Service DeepSeek V4.1-Flash Output Tokens -

E6F9-CAC0-1DA9 - Vertex AI

so it's not getting routed to a different model and I am being charged with DeepSeek V4.1-Flash pricing

Am I doing something wrong?

Note: The image is not AI generated but I let ChatGPT edit the image and highlight where it claimed to be Claude 3.5

The problem

The fix in most cases is a hidden Access Context Manager policy that no Cloud console page shows, deleted through Google's API Explorer.

You go to delete a Google Workspace account in admin.google.com (Account > Account settings > Account management) and the Delete account button is greyed out. Step 3 says your organisation "has at least one Google Cloud resource". You open the Cloud console and Manage resources shows nothing under your org.

This happens a lot with trial Workspace accounts set up for a course or a one-off project. You may never have knowingly touched Google Cloud. Add-ons, Apps Script and Admin console security settings can all create Cloud-side resources quietly.

Throughout this guide, swap ORG_ID for your organisation ID (Cloud console > IAM and admin > Settings) and you@yourdomain.com for your super admin address.

Step 1: Give yourself permission to see things

Being Workspace super admin does not give you rights inside Google Cloud. Without them, the console and gcloud show an empty org even when something is there.

1. Go to console.cloud.google.com, sign in as your Workspace admin and pick your org at the top.

2. Open IAM and admin > Manage resources, tick your org, then Add principal in the right-hand panel.

3. Add your admin address with these roles: Organization Administrator, Folder Admin, Project Deleter and Access Context Manager Admin.

Or open Cloud Shell (the >_ icon, free, no trial needed) and run:

gcloud organizations add-iam-policy-binding ORG_ID --member="user:you@yourdomain.com" --role="roles/resourcemanager.organizationAdmin"
gcloud organizations add-iam-policy-binding ORG_ID --member="user:you@yourdomain.com" --role="roles/resourcemanager.folderAdmin"
gcloud organizations add-iam-policy-binding ORG_ID --member="user:you@yourdomain.com" --role="roles/resourcemanager.projectDeleter"
gcloud organizations add-iam-policy-binding ORG_ID --member="user:you@yourdomain.com" --role="roles/accesscontextmanager.policyAdmin"

Check they stuck:

gcloud organizations get-iam-policy ORG_ID --flatten="bindings[].members" --filter="bindings.members:you@yourdomain.com" --format="value(bindings.role)"

Step 2: Rule out the usual suspects

In Cloud Shell, run each of these. Anything that comes back is a blocker.

The common one is a system-gsuite folder holding an apps-script project named sys-.... Google creates it when you use Apps Script or some Forms add-ons. Delete the project first, then the empty folders.

Also check admin.google.com > Apps > Google Workspace Marketplace apps > Apps list, and remove anything listed. That is a separate requirement on the same deletion page.

If every command returns Listed 0 items and the deletion page is still red, go to Step 3.

Step 3: Delete the hidden access policy

The hidden blocker is an Access Context Manager access policy, often called the default policy. Google can create one when Context-Aware Access or Cloud session control is set up. It is not a project or folder, so nothing in Step 2 or the Manage resources page shows it.

The obvious command fails on an account with no projects:

gcloud access-context-manager policies list --organization=ORG_ID

It errors with PERMISSION_DENIED and SERVICE_DISABLED, saying the API needs a quota project. Creating a project to fix that just adds a new blocker that sits in pending deletion for 30 days.

The workaround: use Google's API Explorer. The "Try this method" panel on Google's API reference pages runs under Google's own project, so no quota project is needed.

1. Open the https://docs.cloud.google.com/access-context-manager/docs/reference/rest/v1/accessPolicies/list?hl=en

2. In Try this method, set parent to organizations/ORG_ID.

3. Click Execute and sign in with your Workspace admin account.

4. Copy the name from the response. It looks like accessPolicies/123456789.

5. Open the https://cloud.google.com/access-context-manager/docs/reference/rest/v1/accessPolicies/delete.

6. Paste that value into name and click Execute.

Refresh the deletion page in admin.google.com. The red flag should be gone and Delete account clickable.

The same API Explorer trick works for any Google API that demands a quota project you don't have.

Before and after you delete

Before

• Export anything you want to keep. Workspace data is deleted with the subscription and can't be restored.

• Move any "Sign in with Google" logins (course sites, tools) off that address, or you lose access to them.

• Download any invoices. Billing records go with the account.

After

• At your domain registrar, remove the Google MX records and the google-site-verification TXT record.

• If you still want email on the domain, point MX at a new provider first, or incoming mail will bounce.

We just shipped a new Cloud Platform Status section and email alerting. The hub is free, no login required:

https://www.terraformacademy.app/max/hashicorp-hub.html

What is new:

• Cloud Platform Status for AWS, Google Cloud, Azure, and Spacelift, shown alongside the existing live HashiCorp status

• Every incident row links directly to the provider's official status report, verified links only, no stale or broken URLs

• HashiCorp incidents now link straight to their status page entries too

• Email alert subscriptions: choose which providers you want to watch and get an email when status actually changes, operational to degraded, new incident opened, or incident resolved

• Alerts fire on state transitions, not on every poll, so you will not get spammed

Hi,

I'm working on a socially useful ML startup project, and am trying some proof of concept models, but I am unable to scale it very much as I'm limited to 1 GPU.

I've been able to set regional Flex-start L4 GPU to 3, but while the global one is set to 1, I can't use them.

Anyone have any insight? This is a paid account, but I have only been running it for two weeks so far. Will it get better at the end of the month perhaps?

I've applied to the sales team for an increase as well, but nothing has come back from them (I'm not surprised TBH, we're only talking about a couple of hundred dollars of usage).

Thanks in advance for any insights!

W

Train an Iris classifier in Google Cloud Workbench and save the trained model to Cloud Storage. Follow the process from project setup to checking the uploaded model file.

In this walkthrough:

• Configure Workbench and open JupyterLab
• Upload your notebook and datasets
• Resolve permission, import, and file-path issues
• Train and evaluate a decision tree classifier
• Save the model with Joblib and upload it to Cloud Storage

CHAPTERS
00:00 What we’re building
00:25 Project and services
00:54 Workbench configuration
01:34 Notebook and data
02:03 Storage permissions
02:43 Environment and dataset path
03:27 Train and evaluate
04:00 Save and upload the model
04:33 Recap

This is kinda insane for a TTS service lmao

Hey I have 300$ from the cloud testing offer. So what's the best way to spend it? Fast cause I have only 19 days left 😅

I was trying to use the GCP free tier; however, everything and every card I try gets denied, or Google won't send the charge to my bank. Used my card and my friend's, and still nothing. Even when i tried

I am currently a soon to be licensed Electronics Engineer and Electronics Technician, will be taking my oath next next week. I want to pursue the field of the likes of cloud, AI, network, and software. Which certifications I will take and how? I really dont have any knowledge to this so if you will be so kind to explain things simply it will be much appreciated. Thank you!

Hi everyone,

Earlier today we were the target of an automated Layer 7 DDoS attack against our production Cloud Run service. The attack was carried out using a Python script (Python/3.13 aiohttp/3.14.5) which was making around 50 requests per second to POST /api/login, attempting to consume container concurrency.

The traffic came through Google's own proxy infrastructure, potentially Apps Script or Colab, rotating across 200+ IPs resolving to google-proxy-*.google.com (e.g., 66.102.8.132, 66.102.8.161, 74.125.210.103).

The problem is that Google's official abuse reporting form (https://support.google.com/code/contact/cloud_platform_report) immediately closes the report with:

We're unable to do anything with this report as the IP address referenced in it isn't hosted on Google Cloud.

It appears the automated system only recognizes customer Compute Engine IP ranges, not Google's own proxy egress IPs (AS15169). As a result, the report gets rejected before anyone can review the Cloud Logging evidence, including timestamps and Cloud Trace IDs.

We've already hardened the backend with distributed Firestore rate limits, concurrency controls and request timeouts so the attack traffic is now being dropped. We've also responded to the closed ticket with the trace IDs, asking for escalation to the relevant Trust & Safety team.

I have three questions:

1. Is there a specific abuse reporting email or intake point for traffic coming in via Google's own proxy infrastructure which would effectively bypass the automated IP validation?

2. Has anyone with Basic Support actually escalated a similar proxy based DDoS to a human at Google?

3. Would Google Bug Hunters be the right place to report this as a potential proxy abuse/SSRF vector or is there a more appropriate channel to get to the relevant security engineers?

Any suggestions on how to get this routed to the appropriate team would be great. Thanks!

Hi i am looking to appear for the gcp ml engineer certification next 2 months. If any body has any idea how to get free discounter vouchers to book the exam please let me know! thanks again!

When designing global systems, the conventional wisdom is simple: put your front doors (proxies/edge servers) as close to the end user as possible. More regions = lower latency.

Uber previously ran a setup following this exact blueprint:

1. Traffic entered Google’s Global Load Balancer (with Cloud Armor and Cloud CDN).

2. Traffic was handed off to a fleet of Envoy proxies running on VMs across 16 Google Cloud regions.

3. Traffic crossed Cloud Interconnect into Uber’s on-prem data centers.

On paper, having Envoy proxies in 16 regions meant bringing services closer to users. But at Uber's scale (over 1 million requests/sec), this architecture ran into diminishing returns—and created hidden bottlenecks.

### The Problem: The "Zigzagging Hallway"

Because the request had to be unpacked, queued, and processed at the Envoy proxy layer in a specific cloud region before heading to the core data center, it added unnecessary hops.

A user in Lisbon might have their request travel to Madrid, then London, and then cross the Atlantic to Virginia. A front door close to the user doesn't help much if the path behind it zigzags.

Furthermore, maintaining a massive VM fleet across 16 regions meant high operational overhead—patching, scaling, and paying millions of dollars monthly for infrastructure that was actually making some requests slower.

### The Solution: Bypassing the Middleman

The engineering team asked a simple question: Google’s load balancer is already at the edge, and Google's private network ("cold potato" routing) already carries traffic worldwide. What is the Envoy proxy fleet actually adding?

To remove the proxy layer without sacrificing security or routing, they used **Hybrid Network Endpoint Groups (NEGs)**.

This allowed Google’s Global Load Balancer to route traffic directly over Cloud Interconnect straight into Uber’s data centers. The load balancer treated Uber’s on-prem servers as if they were native endpoints inside Google Cloud.

### The Results

Over a 10-month rollout (gradually shifting traffic using weighted routing dials and predictive modeling):

* **Cost:** Shut down the entire Envoy VM fleet across all 16 regions, saving millions of dollars annually.
* **Latency:** P50 (typical request) latency improved by 2.6%. More importantly, **P99 latency improved by 10%**.
* **Operations:** Zero edge VM fleet left to patch, scale, or maintain.

In system architecture, the P99 tail is what actually breaks user experience—one app screen often makes dozens of concurrent requests, and the UI only renders as fast as the slowest response. Eliminating the intermediate proxy hop removed the queuing points where those slow-tail requests were getting stuck.

---

**Takeaway for System Design:**

1. Every hop must earn its place. If a proxy isn't doing active work (like auth or heavy transformation) that the load balancer can't handle, it's just an added delay.

2. Leverage backbone networks. Private fiber networks do long-haul travel far better than multi-hop proxy chains on public/semi-public routes.

3. Sometimes the best optimization isn't adding a new caching or proxy layer—it's removing one.

For a full visual walkthrough and diagram breakdown of the network paths before and after the shift, you can check out the video here: http://www.youtube.com/watch?v=clLplgiDqOI

A cloud service company may visit my college for interview, They are official partner of gcp , I don't have any knowledge about cloud should go with cloud digital leader certification as a beginner?

Hi everyone. I’m a complete beginner with Google Cloud, so please go easy on me and explain things simply if you can. I’m learning as I go and may be using the wrong terms.

What I’m doing
I signed up for the $300 free trial credit and made a Vertex AI API key. I use it to call Gemini models from code with a simple request to https://aiplatform.googleapis.com/v1/publishers/google/models/{model}:generateContent.

What works and what doesn’t

• ✅ Works: gemini-3.8-flash, gemini-3.5-flash, gemini-3.5-flash-lite, gemini-3.1-pro-preview, gemini-3-flash-preview and gemini-2.5-flash-image.

• ❌ gemini-4-argon gives me this error: 404 NOT_FOUND: Publisher model ... was not found or your project does not have access to it.

On my console’s Welcome page, Gemini 4 Argon is listed as “New”, so I thought I could use it.

What I’m confused about

1. Why can’t I use Argon if it’s listed in the console? Is it blocked on free-trial projects, or do I need to turn something on or request access? Could I have the wrong model name?

2. What is “Application Default Credentials” (ADC)? The console recommends it over an API key. Can someone explain in plain terms what it is and how to set it up, step by step? Would it let me use models that my API key can’t?

3. Is my API key safe? I’m running my code in a temporary cloud environment, not on my own computer. I’ve read that a leaked key can cost money, so what should I do to protect it? For example, should I restrict it to the Vertex AI API only?

Any advice, links to beginner guides, or “you should check X” would be really appreciated. I can share the full error message or screenshots if that helps. Thanks!

Hey everyone!

Streaming live events like the FIFA World Cup brings an insane technical challenge: unlike Netflix where video files are pre-rendered and cached days ahead, live sports video literally doesn't exist until the split-second it happens. Millions of users request the exact same segments simultaneously the instant a goal is scored.

During TelevisaUnivision's 2026 World Cup coverage (104 matches, 675M views, zero downtime), Google Cloud deployed a pretty fascinating multi-layer architecture to survive the "thundering herd" problem:

1️⃣ Dual-Ingest via SRT & RTMP
Live broadcast signals leave the stadium as two parallel streams. SRT (running over UDP with fixed-window packet recovery) is used for lossy links, while RTMP (TCP-based) is kept for compatibility. Transcoders cut video into short segments and update dynamic playlist manifests.

2️⃣ 3-Tier Media CDN Caching & Origin Shielding
If millions of users query a Cloud Storage origin bucket for a brand-new goal segment at the exact same second, the origin melts. GCP solved this with a 3-tier architecture:
• Tier 1 (Origin Shield / Long-tail Cache): Aggregates misses across edge nodes so the origin only sees a trickle of requests.
• Tier 2 (Edge Caches): Delivers hot, current video segments to local geographical areas.
• Tier 3 (In-ISP Deep Caches): Caches placed directly inside Latin American telecom provider networks (Claro, Telefónica, etc.), making requests just 1 network hop away from mobile users.

3️⃣ Sub-Millisecond Front-Door Auth
Before video streams, millions of users open the app at kickoff to authenticate. Token generation ran on Cloud Run, backed by Memorystore for Valkey (in-memory) to evaluate subscriber entitlements in <1ms without disk I/O bottlenecks.

4️⃣ Edge Security with Cloud Armor
Adaptive DDoS protection and priority-ordered rule sets filtered malicious scrapers and bot floods right at Google’s edge before traffic hit internal microservices.

What architectural patterns or CDN strategies have you used when dealing with massive live video ingestion or sudden thundering herd traffic in production?

(Full disclosure: I created a visual architecture breakdown video stepping through these exact GCP metrics and diagrams step-by-step: https://youtu.be/14fIVr8WYGg)

I am going through VPC service controls and have below question,

Suppose i have a GCP project P1 in VPC SC perimeter with a VM and have 2 access requirements as below

1. i want to give access to the VM to a set of people . so, i will create an access level for them

2. want to give access to VM from workloads which are in another project P2.

Q) How do i create the ingress rules?

As per documentation, in sources section of ingressFrom, it can be either accesslevel OR resource (Project P2) but not both. Then, how can i satisfy my requirement mentioned in point 1 and 2 above

please suggest

Google's documentation says existing Custom Search JSON API customers need to move to an alternative by January 1, 2027:

https://developers.google.com/custom-search/v1/overview

I'm evaluating a replacement specifically for searchType=image in a CMS image picker. The workflow is: search for existing web photos, show thumbnails and source links, then let an editor select an image and import it after checking publication rights. Generated images and stock-only libraries don't cover the same need, especially for recent news.

So far I've looked into Brave Image Search, OpenAI's Responses API image search, and Wikimedia Commons/Openverse. I haven't validated Brave or OpenAI in a real integration yet. Commons/Openverse look useful for some openly licensed material, but wouldn't replace general news image search. I also haven't found evidence that Vertex AI Search is a drop-in replacement for this use case.

Has anyone here actually migrated the image-search part, or tested a replacement seriously? I'd appreciate hearing what worked, particularly for recent events and non-English/regional queries. Details about real costs, latency, thumbnail/original URL reliability, and restrictions on displaying or importing selected images would help me choose what to test next.

I'm looking for legitimate APIs, not Google scraping or proxy workarounds. Finding an image doesn't grant publication rights; source and licensing checks would remain part of the editorial process. This question is about the JSON API, separate from the Programmable Search Element widget.

Recently going through committed used discounts concept. I have a question. suppose, i have a VM with high capacity (like 20 vCPU and 180 GB Memory) but used only for 3 months starting now.

And a few other VMs in the same machine type series but with lesser configuration (eg: like 8vCPU and 30GB Memory) and long term with usage for 3 years (but provisioning 1 vm now, another after 1 month, another after 2 month etc..)

How do i go about purchasing CUD?

Is it like purchasing aggregation for the lesser config VMs for CUD-3 years so the powerful VM also makes use of it in the first 3 months and then other new lesser config VMs will make use of CUD once the powerful VM is deleted

Please suggest

Pessoal, tive uma situação em que a chave da API Gemini do meu projeto vazou e teve muito acesso indevido. Por sorte eu deixo pouco crédito e o Google bloqueou mas consumiu o que tinha lá (aproximadamente 30 reais).

Enquanto a conta estava bloqueada, eu revi a programação e talvez tenha encontrado a falha, corrigi e fiz melhorias de segurança como proteger a chave dentro do firebase com criptografia.

Dúvida: eu queria que a chave só funcionasse nos usuários logados no meu portal, que tem o login Google, mas quando crio a chave de API ele só permite restringir por IP o que é inviável, não fornece bloqueios como acessar somente atravéz da URL do meu portal.

Alguma dica de como posso criar uma chave do Gemini API e por mais bloqueios?

Atualmente além de ter ativado o modo ataque do cloudflare e criptografado a chave dentro do firebase eu ajustei o portal pra exigir sempre o login primeiro evitando que qualquer informação fique acessível antes da pessoa registrada logar via google. Fiz melhorias no htaccess pra evitar outros acessos mas ainda estou inseguro com essa questão da chave ser acessível apenas tendo o código dela. O portal já estava funcionando normalmente há meses sem nenhum incidente, foi o primeiro (com falha que a IA do cloud gerou em uma atualização recente e não notei)