Source boundary
Google Cloud
Confirm source eligibility in your workspace before creating access.
- Financial source
- Detailed Cloud Billing export
- Reviewed
- 2026-09-17
- Cost bases
- net, billed, amortized, list, contracted, credits, tax
- Useful dimensions
- billing account, project, service, SKU, resource, labels, credits, Vertex AI model and reported usage when supplied
Known limits
- Detailed resource fields vary by service and export configuration.
- Recent billing dates can receive corrections and credits.
- The provider-specific Vertex AI section and optional monitoring remain flag-disabled pending external validation.
Prepare the connection
Eligibility
An active Detailed Cloud Billing export, a dedicated query project, co-located temporary staging resources, and an eligible PruneFox workspace are required.
Use Workload Identity Federation for the detailed billing export. JSON keys are an advanced compatibility option and are stored encrypted.
Authentication choices
- Workload Identity Federation — recommendedPruneFox stores only safe federation configuration references; provider tokens are not persisted.
- Service-account JSON keyPruneFox stores the credential encrypted in the isolated credential broker and never returns it to the browser.
Connection details
| Field | Why it is needed | Example format |
|---|---|---|
| Billing account ID | The billing account represented by this detailed cost export. | 01A2B3-4C5D6E-7F8A9B |
| Billing export project | Project containing the Detailed Cloud Billing export dataset. | northstar-billing |
| Billing export dataset | Dataset ID only. PruneFox discovers one compatible detailed-export table server-side. | billing_export |
| Dataset location | BigQuery location, such as US, EU, or us-central1. | US |
| Dedicated query project | A dedicated project where bounded PruneFox query jobs are billed. | northstar-prunefox-query |
| Staging dataset | Dedicated same-location dataset with a 24-hour default table expiration. | prunefox_staging |
| GCS staging bucket | Dedicated private bucket for short-lived compressed exports. | northstar-prunefox-billing-stage |
| Bucket location | Must exactly match the normalized billing dataset location. | US |
| Monthly query-byte cap | Hard monthly scan budget; PruneFox pauses instead of widening it. | 1000000000 |
| Per-run query-byte cap | Every materialization is capped at or below this value. | 100000000 |
| Monthly staged-byte cap | Maximum compressed data PruneFox may stage during a month. | 500000000 |
Permission boundary
| Resource | Read or bounded staging permissions | Purpose |
|---|---|---|
| Exact billing export table | bigquery.tables.get, bigquery.tables.getData | Discover and read the authoritative billing source; no source write or delete permission is accepted. |
| Dedicated query project | bigquery.jobs.create | Run allowlisted, dry-run-first billing queries with customer-approved byte caps. |
| Dedicated temporary staging dataset | bigquery.tables.create, bigquery.tables.updateData, bigquery.tables.delete, bigquery.tables.export | Materialize a deterministic temporary result, export it, and remove the temporary table after checkpointing. This does not permit deleting the dataset. |
| Dedicated temporary staging bucket | storage.buckets.get, storage.objects.create, storage.objects.get, storage.objects.list, storage.objects.delete | Verify location, write and checksum temporary export objects, resume safely, and delete them after ingestion. This does not permit deleting the bucket. |
Connection sequence
- Enable the Detailed Cloud Billing export and wait until completed rows exist.
- Create a dedicated query project and a co-located staging dataset with a 24-hour default table expiration.
- Create a private co-located staging bucket with a lifecycle no longer than three days and public access prevention enabled.
- Grant the federated identity exact read access to the discovered source table and only the listed temporary staging permissions.
- Enter the billing/export locations and explicit per-run, monthly query, and monthly staged-byte caps.
- Let PruneFox discover exactly one detailed export, verify IAM and locations, and run a bounded dry run.
- Review the dry-run byte estimate and approve ingestion before the first materialization.
Validation and first sync
Validation fails closed for no export, multiple compatible exports, billing-account mismatch, unexpected permissions, location mismatch, schema drift, or a dry run above the approved cap.
The first sync queries an approved date/export-time window, materializes one expiring table, exports checksummed compressed objects, copies immutable tenant-keyed raw partitions, reconciles exact rows and currency totals, and only then publishes.
Freshness: Billing export rows arrive throughout the day and can receive corrections. PruneFox displays the last published complete-through date and keeps it visible when a later attempt fails.
Remove access
Revoke the PruneFox connection, remove the WIF binding, then remove temporary staging access after confirming no job is active.
Troubleshooting
Check the detailed-export type, billing account, exact dataset, location, effective resource permissions, lifecycle policy, and byte caps without sending table names or billing rows to support.
Verify the first completed period
Compare one bounded completed period with the provider billing source. Match currency and cost basis, inspect credits and adjustments, and confirm that missing dimensions remain unavailable rather than zero.
Troubleshoot safely
Use the visible connection state, provider name, affected date range, and expected outcome. Never send credentials, raw billing exports, payment data, or customer records through support.