> For the complete documentation index, see [llms.txt](https://help.pump.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.pump.co/gcp/getting-started-with-gcp.md).

# Getting Started with GCP

Pump connects to your GCP account in two stages: an OAuth consent for project discovery, and an optional Cloud Shell script that grants per-project access for commitment management. Pump acts as a GCP solutions provider, meaning your billing account becomes a sub-account under Pump.

### Prerequisites

| Requirement  | Details                                                                        |
| ------------ | ------------------------------------------------------------------------------ |
| GCP account  | Active account with at least one project and a billing account                 |
| Permissions  | Owner or Billing Administrator on the billing account you want to connect      |
| Pump account | Sign up at [app.pump.co](https://app.pump.co/) and complete email verification |

### How the connection works

Pump's GCP connection has two layers:

1. **OAuth consent** grants Pump read-only access to list your GCP projects. This is how Pump discovers your environment.
2. **Service account IAM grant** (optional) gives Pump per-project access to BigQuery and Compute Engine for commitment management and cost analysis.

Pump never stores your Google credentials. OAuth tokens are used for project discovery only. Per-project access is granted to a Pump-managed service account through standard GCP IAM.

### Step 1: Run a savings estimate (optional)

Before connecting programmatically, you can generate a savings estimate using a CSV upload.

1. Log in to Pump and select **GCP** as your cloud provider.
2. Select **Estimate savings from CSV**.
3. In the Google Cloud Console, navigate to **Billing → Reports** and export your billing history as a CSV.
4. Upload the CSV to Pump.
5. Pump generates your savings estimate within minutes.

After reviewing the estimate, you can proceed to connect your account.

### Step 2: Google OAuth consent

This step grants Pump read-only access to discover your GCP projects.

1. In the Pump onboarding wizard, click **Connect GCP**.
2. Google's OAuth consent screen opens. Pump requests the following scopes:

| Scope                            | What it does                        |
| -------------------------------- | ----------------------------------- |
| `openid`                         | Verifies your identity              |
| `userinfo.email`                 | Reads your email address            |
| `userinfo.profile`               | Reads your profile name             |
| `cloudplatformprojects.readonly` | Lists your GCP projects (read-only) |

1. Review the permissions and click **Allow**.
2. Pump lists your GCP projects. No billing data is accessed at this stage.

### Step 3: Per-project IAM setup (optional, recommended)

This step grants Pump access to a specific project for commitment management and cost analysis. It runs a Pump-provided script in Google Cloud Shell.

1. In the Pump wizard, select the project you want to connect.
2. Pump opens Google Cloud Shell with a pre-loaded script (`pump-autopilot.sh`).
3. Review the script. It does the following:
   * Enables the BigQuery API and Compute Engine API on your project
   * Grants Pump's service account three IAM roles on that specific project:

| IAM role                               | Purpose                                                  |
| -------------------------------------- | -------------------------------------------------------- |
| `roles/bigquery.resourceAdmin`         | Access to BigQuery billing export data for cost analysis |
| `roles/compute.viewer`                 | Read-only access to Compute Engine resource metadata     |
| `roles/compute.futureReservationAdmin` | Ability to manage Committed Use Discounts (CUDs)         |

1. Run the script. When it completes, it sends a webhook notification back to Pump to confirm the setup.

This step is **skippable**. If you skip it, Pump can still provide cost visibility through the billing export, but commitment management features will not be available for that project.

#### Running the script for multiple projects

If you have multiple GCP projects, repeat Step 3 for each project you want Pump to manage. Each project requires its own IAM grant.

### Step 4: Authorize Pump as your billing partner

This step transitions your GCP billing relationship so that Pump acts as your solutions provider.

1. In the Pump wizard, review the billing partner agreement.
2. Accept the Terms of Service and Privacy Policy.
3. Your GCP billing account is linked as a sub-account under Pump's solutions provider account.
4. Complete your company details and payment method.

After this step, Pump manages your billing. You receive a single invoice from Pump instead of paying Google directly.

#### How GCP solutions provider billing works

Pump participates in Google's Cloud solutions provider program. When you authorize Pump as your billing partner:

* Your GCP billing account becomes a sub-account under Pump.
* Your existing projects, resources, and configurations are not affected.
* You receive one invoice from Pump that covers your GCP usage.

### What Pump accesses

#### Data Pump reads

| Data source             | What Pump pulls                                             | How it's used                                      |
| ----------------------- | ----------------------------------------------------------- | -------------------------------------------------- |
| Cloud Resource Manager  | Project listing, project metadata                           | Environment discovery                              |
| Cloud Billing API       | Billing account details, project-to-billing-account mapping | Billing management                                 |
| BigQuery Billing Export | Standard and detailed billing schemas (line-item costs)     | Cost visibility, savings calculations, forecasting |
| Compute Engine Metadata | Instance types, sizes (via `roles/compute.viewer`)          | Right-sizing analysis                              |

#### Data Pump never accesses

Pump does not access your application data, Cloud Storage bucket contents, source code, IAM policies, secrets, or Cloud Logging data. Pump does not use Cloud Asset Inventory, Terraform, Deployment Manager, or Workload Identity Federation.

The only write actions Pump performs are purchasing Committed Use Discounts when enabled, and only for projects where you have granted the `roles/compute.futureReservationAdmin` role.

### Historical data backfill

Pump's routine data refresh uses a 7-day lookback window. For initial onboarding, broader historical data is available through the BigQuery billing export, which contains your full billing history as configured in your GCP project.

The BigQuery billing-export dataset ID is registered by the Pump team during onboarding. This step is not currently self-serve.

### Troubleshooting

#### OAuth consent failed or was denied

If you accidentally denied the OAuth request, return to the Pump wizard and click **Connect GCP** again. Pump will re-initiate the OAuth flow.

#### Cloud Shell script did not complete

If the `pump-autopilot.sh` script fails, check that:

* The BigQuery API and Compute Engine API are enabled on your project.
* Your user account has sufficient permissions to grant IAM roles (typically `roles/resourcemanager.projectIamAdmin`).
* Your project is not restricted by an organization policy that blocks external service account grants.

If the script completed but Pump does not show the project as connected, the webhook notification may have failed. Contact Pump support at [support.pump.co](https://support.pump.co/).

#### Billing account cannot be linked

If your billing account is already managed by another solutions provider, it cannot be linked to Pump simultaneously. Contact Pump support to discuss migration options.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.pump.co/gcp/getting-started-with-gcp.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.