Connect Google Cloud

CloudQuell reads your Google Cloud spend from your Detailed usage cost export in BigQuery — the same invoice-grade data Google bills you from. The connection is keyless: you grant a CloudQuell service-account email two read-only BigQuery roles, and access works through Google’s Workload Identity Federation. No key, secret, or password ever changes hands, so there is nothing to store, rotate, or leak — revoking the IAM grants revokes CloudQuell.

Once connected, GCP spend flows into the same ledger, dashboards, reports, budgets, and allocation views as your other providers. Projects appear as their own sub-accounts — the GCP analog of AWS linked accounts — and resource + project labels arrive as tags for allocation rules and tag coverage.

Does connecting cost anything?

Enabling the BigQuery billing export generally adds no Google charge beyond BigQuery storage for the export table, which grows over time (Google applies a 2-year TTL). It’s usually small, but it’s the one to watch if your spend volume is high. CloudQuell doesn’t charge you to connect, and it only reads your data — nothing is written back to your account. Any Google Cloud charges that apply are set by Google, can change, and are yours; treat this as general guidance, not a guarantee, and check Google’s current pricing.

Note

The Google Cloud integration is generally available to every organization on every plan, including Free (Free’s limit of 3 connected integrations applies). Click Connect on the Google Cloud tile in Integrations to start. Reporting, budgets, allocation, alert rules, anomaly detection, and committed-use-discount coverage on the Commitments page all include GCP spend. Savings recommendations are AWS-only for now, and there are no CUD expiry alerts for GCP yet.

Prerequisites

• A CloudQuell admin — creating integrations requires the super_admin or admin role. See roles.
• A Google Cloud administrator who can edit Billing export settings and grant IAM roles on the export project and dataset.

How far back does history go?

Unlike AWS (12 months on day one), Google only backfills the current and previous month when a billing export is first enabled, and a new export takes 24–48 hours to populate. Your CloudQuell history starts where your export starts and grows forward from there — if you’ve been exporting billing to BigQuery for a year, you get that year.

The three steps

1. Enable the Detailed usage cost export

If you already export billing data to BigQuery, skip to step 2.

1. In the Google Cloud console, open Billing → Billing export. You’ll see three BigQuery export types — FOCUS usage cost (preview), Standard usage cost, and Detailed usage cost. CloudQuell reads the Detailed export (FOCUS support is on our roadmap; note Google applies a 2-year TTL to FOCUS export data).
2. Under Detailed usage cost, click Enable detailed export.
3. Pick the project to host the export — the picker only lists projects linked to an active billing account. If the project has no datasets yet, create one right from the Dataset dropdown: any dataset name works (letters, numbers, underscores), but Data location must be the US or EU multi-region — billing exports don’t support single regions like us-central1.
4. Select the dataset and Save. The Detailed usage cost section should now show Enabled, with your project and dataset names listed.
5. Note the project id and dataset name; you’ll enter them in step 3.

2. Grant the CloudQuell service account read access

In CloudQuell, open Integrations → Google Cloud → Connect. The wizard shows the service-account email to grant (also available from your admin — it’s the same one for your whole organization). Grant it these two required roles:

Role	Where	Why
BigQuery Job User (roles/bigquery.jobUser)	The export project (IAM & Admin → IAM → Grant access)	Lets CloudQuell run the daily export queries.
BigQuery Data Viewer (roles/bigquery.dataViewer)	The export dataset (BigQuery → dataset → Sharing → Permissions)	Lets CloudQuell read the billing export tables — and nothing else.

Both roles are read-only, scoped to the export, and grant no access to any other dataset or resource in your project.

Optionally, also grant one more read-only role:

Role	Where	Why
Recommender Viewer (roles/recommender.viewer)	The export project (IAM & Admin → IAM → Grant access)	Lets CloudQuell read Google’s own cost-saving recommendations for that project: committed use discount purchases, idle VMs, disks, IP addresses and images, oversized VMs, and idle or oversized Cloud SQL instances.

Recommender Viewer can only read recommendations. It can’t apply or dismiss them, and it doesn’t grant access to your resources or data. Billing data syncs the same with or without it, and you can add it at any time: CloudQuell picks it up on the next daily sync. The wizard tells you if it can’t find the role on your export project.

Google may warn that the principal is outside your organization when you add it — that’s expected (the service account lives in CloudQuell’s GCP project); confirm through the warning. The grants take effect within a minute or two.

3. Enter the export coordinates and verify

Back in the wizard, enter:

• Billing account id — format XXXXXX-XXXXXX-XXXXXX, shown at Billing → Settings.
• Export project id — the project hosting the dataset.
• Dataset name — the BigQuery dataset the export writes into.

Click Verify & Connect. CloudQuell runs a BigQuery dry-run against your export table — it scans no data and costs nothing — to confirm the export exists and the grants work, then starts pulling your history. Costs typically appear within minutes.

If you enabled the export moments ago, the wizard completes with “Setup complete — Google is preparing your export” instead: your access is verified, and Google just hasn’t written the export’s first table yet (up to 24–48 hours for new exports). No action needed — CloudQuell starts syncing automatically as soon as the data appears.

What syncs, and when

• Daily sync — every day CloudQuell re-pulls the current and previous invoice months, absorbing Google’s 24–48 hour restatement window. The newest days firm up as Google finalizes them.
• Query costs — the daily pull runs as a partition-pruned, aggregated BigQuery query in your project. For typical accounts this stays comfortably inside BigQuery’s free monthly query tier.
• Committed Use Discounts — CUD-covered usage lands with its commitment identity, so commitment coverage and effective-coverage metrics include GCP. (CUD expiry dates aren’t part of Google’s export, so expiring-commitment alerts don’t cover GCP yet.)
• Labels as tags — resource labels and project labels merge into CloudQuell tags (resource labels win on conflicts) for allocation and tag coverage.

AI spend in the AI Spend view

Generative AI usage on your billing export — Gemini, Claude and other Model Garden models, Imagen, Veo, embeddings, grounding, and provisioned throughput, from both Vertex AI and the Gemini API billed to a Google Cloud project, plus Claude bought through Google Cloud Marketplace — also appears under Dashboards → AI Spend as Gemini / Vertex, beside your direct Anthropic and OpenAI usage. There is nothing extra to connect: the button appears on its own once your GCP bill carries that spend.

• It’s read from this integration’s billing export, so it is counted once, inside your Google Cloud spend. The All AI total is an analytical figure and is never added to cloud totals.
• Break it down by model, model developer, token type, serving scope (global / regional), service tier, project, region, and day.
• Gemini 1.x and PaLM-era usage is billed by characters, so it shows dollars but no token counts.
• Fine-tuning a model (Gemini tuning, Model Garden fine-tuning) counts as that model’s spend, without token counts.
• Vertex AI training, prediction node-hours, notebooks (Colab), Vector Search, and similar aren’t AI-model spend; they stay in your Google Cloud spend only.
• The figures follow this integration’s cost settings, and you attribute them to teams with the same allocation and label rules as the rest of Google Cloud. See the dashboard tour.

Disconnecting

Delete the integration from Integrations — CloudQuell removes the stored export coordinates and all ingested GCP cost data. Because the connection is keyless there is no credential to clean up on your side; optionally remove the two IAM grants in Google Cloud to revoke access permanently.

Related

• Supported providers
• Managing integrations
• Allocation rules