Getting Started with GCP

Pump connects to your GCP account in two stages: an OAuth consent for project discovery, and an optional Cloud Shell script that grants per-project access for commitment management. Pump acts as a GCP solutions provider, meaning your billing account becomes a sub-account under Pump.

Prerequisites

Requirement	Details
GCP account	Active account with at least one project and a billing account
Permissions	Owner or Billing Administrator on the billing account you want to connect
Pump account	Sign up at app.pump.co and complete email verification

How the connection works

Pump's GCP connection has two layers:

1. OAuth consent grants Pump read-only access to list your GCP projects. This is how Pump discovers your environment.

2. Service account IAM grant (optional) gives Pump per-project access to BigQuery and Compute Engine for commitment management and cost analysis.

Pump never stores your Google credentials. OAuth tokens are used for project discovery only. Per-project access is granted to a Pump-managed service account through standard GCP IAM.

Step 1: Run a savings estimate (optional)

Before connecting programmatically, you can generate a savings estimate using a CSV upload.

1. Log in to Pump and select GCP as your cloud provider.

2. Select Estimate savings from CSV.

3. In the Google Cloud Console, navigate to Billing → Reports and export your billing history as a CSV.

4. Upload the CSV to Pump.

5. Pump generates your savings estimate within minutes.

After reviewing the estimate, you can proceed to connect your account.

Step 2: Google OAuth consent

This step grants Pump read-only access to discover your GCP projects.

1. In the Pump onboarding wizard, click Connect GCP.

2. Google's OAuth consent screen opens. Pump requests the following scopes:

Scope	What it does
openid	Verifies your identity
userinfo.email	Reads your email address
userinfo.profile	Reads your profile name
cloudplatformprojects.readonly	Lists your GCP projects (read-only)

1. Review the permissions and click Allow.

2. Pump lists your GCP projects. No billing data is accessed at this stage.

Step 3: Per-project IAM setup (optional, recommended)

This step grants Pump access to a specific project for commitment management and cost analysis. It runs a Pump-provided script in Google Cloud Shell.

1. In the Pump wizard, select the project you want to connect.

2. Pump opens Google Cloud Shell with a pre-loaded script (pump-autopilot.sh).

3. Review the script. It does the following:

   • Enables the BigQuery API and Compute Engine API on your project

   • Grants Pump's service account three IAM roles on that specific project:

IAM role	Purpose
roles/bigquery.resourceAdmin	Access to BigQuery billing export data for cost analysis
roles/compute.viewer	Read-only access to Compute Engine resource metadata
roles/compute.futureReservationAdmin	Ability to manage Committed Use Discounts (CUDs)

1. Run the script. When it completes, it sends a webhook notification back to Pump to confirm the setup.

This step is skippable. If you skip it, Pump can still provide cost visibility through the billing export, but commitment management features will not be available for that project.

Running the script for multiple projects

If you have multiple GCP projects, repeat Step 3 for each project you want Pump to manage. Each project requires its own IAM grant.

Step 4: Authorize Pump as your billing partner

This step transitions your GCP billing relationship so that Pump acts as your solutions provider.

1. In the Pump wizard, review the billing partner agreement.

2. Accept the Terms of Service and Privacy Policy.

3. Your GCP billing account is linked as a sub-account under Pump's solutions provider account.

4. Complete your company details and payment method.

After this step, Pump manages your billing. You receive a single invoice from Pump instead of paying Google directly.

How GCP solutions provider billing works

Pump participates in Google's Cloud solutions provider program. When you authorize Pump as your billing partner:

• Your GCP billing account becomes a sub-account under Pump.

• Your existing projects, resources, and configurations are not affected.

• You receive one invoice from Pump that covers your GCP usage.

What Pump accesses

Data Pump reads

Data source	What Pump pulls	How it's used
Cloud Resource Manager	Project listing, project metadata	Environment discovery
Cloud Billing API	Billing account details, project-to-billing-account mapping	Billing management
BigQuery Billing Export	Standard and detailed billing schemas (line-item costs)	Cost visibility, savings calculations, forecasting
Compute Engine Metadata	Instance types, sizes (via roles/compute.viewer)	Right-sizing analysis

Data Pump never accesses

Pump does not access your application data, Cloud Storage bucket contents, source code, IAM policies, secrets, or Cloud Logging data. Pump does not use Cloud Asset Inventory, Terraform, Deployment Manager, or Workload Identity Federation.

The only write actions Pump performs are purchasing Committed Use Discounts when enabled, and only for projects where you have granted the roles/compute.futureReservationAdmin role.

Historical data backfill

Pump's routine data refresh uses a 7-day lookback window. For initial onboarding, broader historical data is available through the BigQuery billing export, which contains your full billing history as configured in your GCP project.

The BigQuery billing-export dataset ID is registered by the Pump team during onboarding. This step is not currently self-serve.

Troubleshooting

OAuth consent failed or was denied

If you accidentally denied the OAuth request, return to the Pump wizard and click Connect GCP again. Pump will re-initiate the OAuth flow.

Cloud Shell script did not complete

If the pump-autopilot.sh script fails, check that:

• The BigQuery API and Compute Engine API are enabled on your project.

• Your user account has sufficient permissions to grant IAM roles (typically roles/resourcemanager.projectIamAdmin).

• Your project is not restricted by an organization policy that blocks external service account grants.

If the script completed but Pump does not show the project as connected, the webhook notification may have failed. Contact Pump support at support.pump.co.

Billing account cannot be linked

If your billing account is already managed by another solutions provider, it cannot be linked to Pump simultaneously. Contact Pump support to discuss migration options.