Problem:
Our backend service (in Project A) interacts with resources in Project B (e.g., fetching Logging buckets). While resource-specific quotas (e.g., log ingestion) are correctly consumed by Project B, we're hitting 429 Quota Exceeded errors for logging.googleapis.com's Control requests quota in Project A.
Example Error Excerpt: ...Quota exceeded for quota metric 'Control requests' ... for consumer 'project_number:xxx' (where xxx is Project A).
Context: This occurs during "metadata" operations like logging.buckets.list or logging.buckets.get targeting Project B's resources. As we integrate with more Project B's, the aggregate of these calls from Project A is exhausting Project A's Control requests quota.
Questions:
Project B's Quota Consumption: My understanding is that Project B's quota is consumed for operations that directly incur compute, storage, or I/O on its owned resources (e.g., BigQuery jobs.query bytes processed, Cloud Logging entries.write volume). Is this understanding generally correct across GCP services?
Project A's Quota Consumption (The Bottleneck): Why are "control requests" (like list or get operations on Project B's resources, even if read-only) consistently consuming Project A's quota? Is this a standard pattern for all GCP APIs, where the API call itself, regardless of the resource's owner, counts against the caller's project's general API call rate limits ("Control requests")?
Regarding Project B's Quota Consumption, your understanding is correct.
For most GCP services, resource-specific quotas (like storage, compute, or I/O) are consumed by the project that owns the resource being operated on.
Example:
BigQuery: Query bytes processed are billed/quota’d to the dataset’s project.
Cloud Logging: Log ingestion quota is consumed by the project where logs are written.
Resource-specific quotas are charged to the resource owner (Project B in your case).
Regarding project A's Quota Consumption "Control requests":
This is standard GCP API behavior.
API call quotas (like "Control requests") are enforced on the calling project (Project A), regardless of which project owns the resource being accessed even if you’re only reading metadata
This prevents a single project from overwhelming Google’s APIs, regardless of which resources it accesses.
It also allows GCP to track and limit API usage per client project, not per resource.
The project whose credentials are used to make the API call is the one whose API call quota is consumed. The resource owner’s project is only charged for resource-specific quotas (compute, storage, etc.).