`gcloud auth application-default unset-quota-project`

February 28, 2024

gcloud auth application-default includes a sub-command gcloud auth application-default set-quota-project

Unlike the similar gcloud config set and gcloud config unset pair, there’s no unset-quota-project.

However, it’s straightforward to undo set-quota-project because it’s primary side-effect is to update ${HOME}/.config/gcloud/application_default_credentials.json]

gcloud auth application-default set-quota-project ${PROJECT} \
--log-http

Request:

uri: https://cloudresourcemanager.googleapis.com/v1/projects/{PROJECT}:testIamPermissions?alt=json
method: POST
== headers start ==
b'accept': b'application/json'
b'authorization': --- Token Redacted ---
b'content-type': b'application/json'
b'x-goog-user-project': b'{PROJECT}'
== headers end ==
== body start ==
{"permissions": ["serviceusage.services.use"]}
== body end ==

Response:

status: 200
-- headers start --
-- headers end --
-- body start --
{
  "permissions": [
    "serviceusage.services.use"
  ]
}
-- body end --

Credentials saved to file: [${HOME}/.config/gcloud/application_default_credentials.json]

These credentials will be used by any library that requests Application Default Credentials (ADC).

Quota project “{PROJECT}” was added to ADC which can be used by Google client libraries for billing and quota. Note that some services may still bill the project owning the resource.

If we ${HOME}/.config/gcloud/application_default_credentials.json:

{
  "account": "...",
  "client_id": "...",
  "client_secret": "...",
  "quota_project_id": "{PROJECT}",     // <-- Added by the command
  "refresh_token": "...",
  "universe_domain": "googleapis.com"
}

And so to unset the property, we can remove it from the credentials:

jq 'del(.quota_project_id)' \
${HOME}/.config/gcloud/application_default_credentials.json

Gcloud
Gcp