Something happened with Google Cloud API (and I owe roughly 30k)

[squirrel]

Hi guys. Just a warning about Google Cloud API, I use it for Google Maps integration on websites mainly. I was having an issue with integration and left a key insecure. Unknowingly, over a few weeks my account accrued almost R30 000 in usage, although I have never gone over the free limit ($200). Keep yo keys secure and set limits on your accounts!

 

[Barbarian Conan]

Ouch!

Luckily for me I only have the free credits on Azure, and it disables your services when you go over.
Just running a cosmos DB and an app service with pretty much no traffic easily goes over R2k per month.

 

[xrapidx]

Their website is not the most user friendly, and constantly changing - every couple of months I hit it to change something its different.

 

[Rickster]

Hi guys. Just a warning about Google Cloud API, I use it for Google Maps integration on websites mainly. I was having an issue with integration and left a key insecure. Unknowingly, over a few weeks my account accrued almost R30 000 in usage, although I have never gone over the free limit ($200). Keep yo keys secure and set limits on your accounts!

What happens if you cant/dont pay it?

 

[SYNERGY]

Thanks for the reminder...

 

[RandomGeek]

@squirrel exactly how did the key leak out if you dont mind me asking? Its a crappy situation for sure

 

[Fulcrum29]

You can limit the APIs, but it is best practice to only allow authenticated domains.

 

[Bryn]

You can limit the APIs, but it is best practice to only allow authenticated domains.

That was my immediate thought. Who uses Google APIs without restricting the domain? Insane.

 

[|tera|]

I just closed my billing account on G Cloud.
I definitely don't want a surprise like this.

 

[lawries72]

I had the same thing happen to me this month. Seems a bit too coincidental to me.

 

[|tera|]

I had the same thing happen to me this month. Seems a bit too coincidental to me.

How much did they take you for?

 

[Thor]

You can limit the APIs, but it is best practice to only allow authenticated domains.

This. Never use any cloud service without explicitly restricting the source IP/Domain

 

[Fulcrum29]

This. Never use any cloud service without explicitly restricting the source IP/Domain

IIRC, Google still supports the legacy keys and those are open to be abused. Why people haven't changed is beyond me, and then you have to ask what else is outdated.