The GCP kill switch: an actual spending cap, in ~20 minutes

Google Cloud budgets notify — they don't stop anything. The new spend-cap budgets (Preview) only cover a handful of services, and not the ones in the horror stories: Firestore, Compute, BigQuery. If you want a true hard cap today, you build it yourself with Google's own recipe: budget → Pub/Sub → a Cloud Function that unlinks billing.

The recipe (Google's official pattern)

1. Create a Pub/Sub topic, e.g. budget-killswitch.
2. Create a budget for the project with your cap amount, and connect the topic to it (console → Budgets & alerts → "Connect a Pub/Sub topic").
3. Deploy this Cloud Function, triggered by that topic:

// index.js — disables billing when the budget is exceeded (Node 20)
const {CloudBillingClient} = require("@google-cloud/billing");
const billing = new CloudBillingClient();
const PROJECT_ID = process.env.GCP_PROJECT_ID;
const PROJECT_NAME = `projects/${PROJECT_ID}`;

exports.stopBilling = async (pubsubEvent) => {
  const data = JSON.parse(
    Buffer.from(pubsubEvent.data, "base64").toString()
  );
  if (data.costAmount <= data.budgetAmount) {
    return console.log("Under budget — no action.");
  }
  const [info] = await billing.getProjectBillingInfo({name: PROJECT_NAME});
  if (!info.billingEnabled) {
    return console.log("Billing already disabled.");
  }
  await billing.updateProjectBillingInfo({
    name: PROJECT_NAME,
    projectBillingInfo: {billingAccountName: ""}, // unlink = hard stop
  });
  console.log(`Billing DISABLED for ${PROJECT_ID}`);
};

4. Grant the function's service account roles/billing.projectManager on the project (it needs permission to unlink billing).
5. Test it with a low temporary budget before trusting it with production.

Full walkthrough in Google's docs, and community-maintained versions exist (e.g. Cyclenerd's).

The gap the kill switch can't close

Budget notifications ride the same delayed billing pipeline as everything else — by the time the cap fires, a runaway can already be thousands of dollars in. And a kill switch gives you no why: no baseline, no culprit, no forecast. That's the layer CostCap covers: spend-rate telemetry every ~20 minutes, spike alerts within the hour, leaked-key detection, and budget warnings before the threshold — so in practice the kill switch is the last resort that never has to fire.