Connect GCP

Google Cloud is a private preview. Configure BigQuery billing exports and the Workload Identity Federation (WIF) setup shown for your approved workspace.

Preview limitations

Google Cloud remains a private preview and depends on your configured billing export. Cost ingestion operates through BigQuery billing exports; resource-level parity depends on enabled Google APIs and the exact identity-provider setup shown inside your Costframe workspace.

BigQuery billing export

To analyze Google Cloud costs, Costframe requires query access to a Google Cloud Billing export saved inside BigQuery.

In the Google Cloud Console, navigate to the Billing Console.
Open Billing export → BigQuery export.
Enable exports and configure a dedicated BigQuery dataset inside your chosen administrative project.
Note the full dataset path, dataset name, and billing project ID.

Configure authentication

Workload Identity Federation (preferred)

WIF uses short-lived tokens without a stored service-account key. Google Cloud trusts the Costframe OIDC issuer shown in your dashboard to query the BigQuery billing export dataset on-demand.

Service account keys (fallback)

If WIF is unavailable in your environment, a restricted IAM Service Account with BigQuery User permissions may be configured. This requires explicit confirmation from your security administrators.

Workload identity setup in the console

Configure the workload identity pool and OIDC provider using Google's current instructions. Use the exact issuer and audience values from the Costframe connection screen, and have your administrator review the grants.

Alternative: gcloud CLI setup

Run the following gcloud command sequence inside your active project shell environment. Replace the issuer placeholder with the exact value shown in your Costframe connection screen.

gcloud iam workload-identity-pools create "costframe-pool" \
  --location="global" \
  --display-name="Costframe Pool"

gcloud iam workload-identity-pools providers create-oidc "costframe-provider" \
  --workload-identity-pool="costframe-pool" \
  --location="global" \
  --issuer-uri="<issuer-uri-shown-in-costframe>" \
  --attribute-mapping="google.subject=assertion.sub" \
  --display-name="Costframe OIDC Provider"

Google Cloud setup references

Follow Google's billing export and federation documentation alongside the approved workspace setup. Creating a pool and provider alone does not establish access to the billing dataset. Confirm the required dataset and query access with your administrator before validating the connection.

Revocation

Remove Costframe's access by deleting the Workload Identity Pool trust mapping, disabling the Service Account, or removing BigQuery dataset query roles in your Google Cloud Console.