Quotas and limits

This document lists the quotas and limits that apply to Virtual Private Cloud (VPC) networking.

Google Cloud uses quotas to help ensure fairness and reduce spikes in resource use and availability. A quota restricts how much of a Google Cloud resource your Google Cloud project can use. Quotas apply to a range of resource types, including hardware, software, and network components. For example, quotas can restrict the number of API calls to a service, the number of load balancers used concurrently by your project, or the number of projects that you can create. Quotas protect the community of Google Cloud users by preventing the overloading of services. Quotas also help you to manage your own Google Cloud resources.

The Cloud Quotas system does the following:

Monitors your consumption of Google Cloud products and services
Restricts your consumption of those resources
Provides a way to request changes to the quota value and automate quota adjustments

In most cases, when you attempt to consume more of a resource than its quota allows, the system blocks access to the resource, and the task that you're trying to perform fails.

Quotas generally apply at the Google Cloud project level. Your use of a resource in one project doesn't affect your available quota in another project. Within a Google Cloud project, quotas are shared across all applications and IP addresses.

For more information, see the Cloud Quotas overview.

There are also system limits on VPC resources. System limits can't be changed.

Quotas

To change a quota, see requesting additional quota.

Per project

This table highlights important global quotas for VPC resources in each project. For other quotas, see the Quotas page in the Google Cloud console.

To monitor per-project quotas using Cloud Monitoring, set up monitoring for the metric serviceruntime.googleapis.com/quota/allocation/usage on the Consumer Quota resource type. Set additional label filters (service, quota_metric) to get to the quota type. For information about monitoring quota metrics, including finding limit names and metric names, see Use quota metrics. Each quota has a limit and a usage value.

Quota	Description
Network bandwidth
GCE VM to internet egress bandwidth Mbps	Total egress bandwidth from Google Cloud VMs in one region to destinations outside of a VPC network (using the default internet gateway). This quota's usage is charged to the project that contains the Compute Engine VMs that emit the packets. Excludes traffic sent to Google APIs and services by using Private Google Access. Excludes traffic sent to Google APIs and services from VMs with external IP addresses.
Inter-region network egress bandwidth (Mbps) from Compute instances	Total egress bandwidth from Google Cloud VMs in one region to destinations that are routable within a VPC network (using next hops that are not the default internet gateway). This quota's usage is charged to the project that contains the Compute Engine VMs that emit the packets.
Shared VPC
Shared VPC service projects per host project	Number of Shared VPC service projects that can be attached to a Shared VPC host project. In addition to this quota, see Shared VPC project limits.
General
Networks	Includes the `default` network, which you can remove.
Policy-based routes	The number of policy-based routes that you can create in your project.
Routers	The number of Cloud Routers that you can create within your project, in any network and region. Networks also have a limit on the number of Cloud Routers in any given region. For details, see Cloud Router quotas and limits.
Packet Mirrorings	The number of Packet Mirroring policies that you can create in your project, in any network and region.
Load balancer and protocol forwarding rules See Forwarding rules in the load balancing quotas documentation.
Internal IP addresses
Internal IP addresses	The number of static regional internal IPv4 addresses that you can reserve in each region in your project.
Regional static internal IPv6 address ranges	The number of static regional internal IPv6 address ranges that you can reserve in each region in your project.
Static global internal IPv4 addresses	The number of static global internal IPv4 address ranges that you can reserve in your project, such as allocated IPv4 address ranges for private services access and IPv4 addresses reserved for Private Service Connect endpoints that are used to access global Google APIs. For IP address ranges, each range is a contiguous internal IP address range.
Internal ranges	The number of internal range resources that you can reserve in your project.
External IP addresses
Static IP addresses	The number of static regional external IPv4 addresses that you can reserve in each region in your project.
Regional static external IPv6 address ranges	The number of static regional external IPv6 address ranges that you can reserve in each region in your project.
Static IP addresses global	The number of static global external IP addresses that you can reserve in your project.
In-use IP addresses	The number of static and ephemeral regional external IP addresses that you can use in your project simultaneously.
In-use IP addresses global	The number of static and ephemeral global external IP addresses that you can use in your project simultaneously.
Address move requests per minute	The system limit for the global number of address move requests that you can make per minute.
Address move requests per minute per region	The system limit for the number of address move requests that you can make per minute per region.
Bring your own IP (BYOIP)
Static BYOIP IP addresses	The number of bring your own IP regional external IP addresses that you can reserve in each region in your project. Limit name: `STATIC-BYOIP-ADDRESSES-per-project-region` Metric: compute.googleapis.com/regional_static_byoip_addresses
Static BYOIP IP addresses global	The number of bring your own IP global external IP addresses that you can create in your project. Limit name: `STATIC-BYOIP-ADDRESSES-per-project` Metric: compute.googleapis.com/global_static_byoip_addresses
Public advertised prefixes	The number of public advertised prefixes (PAPs) that you can create in your project. Limit name: `PUBLIC-ADVERTISED-PREFIXES-per-project` Metric: compute.googleapis.com/public_advertised_prefixes
Public V2 advertised prefixes create requests per minute	The number of create requests for regional public advertised prefixes that you can make per minute. This quota applies to both v1 and v2 public advertised prefixes. Limit name: `PublicAdvertisedPrefixV2CreateRequestsPerMinutePerProject` Metric: compute.googleapis.com/regional_v2_public_advertised_prefixes_create_requests
Public V2 advertised prefixes delete requests per minute	The number of delete requests for regional public advertised prefixes that you can make per minute. This quota applies to both v1 and v2 public advertised prefixes. Limit name: `PublicAdvertisedPrefixV2DeleteRequestsPerMinutePerProject` Metric: compute.googleapis.com/regional_v2_public_advertised_prefixes_delete_requests
Public V2 advertised prefixes announce requests per minute	The number of announce requests that you can make per minute for regional public advertised prefixes. Limit name: `PublicAdvertisedPrefixV2AnnounceRequestsPerMinutePerProject` Metric: compute.googleapis.com/regional_v2_public_advertised_prefixes_announce_requests
Regional public delegated prefixes	The number of regional public delegated prefixes (PDPs) that you can create in each region. Limit name: `PUBLIC-DELEGATED-PREFIXES-per-project-region` Metric: compute.googleapis.com/regional_public_delegated_prefixes
Global public delegated prefixes	The number of global public delegated prefixes that you can create. Limit name: `PUBLIC-DELEGATED-PREFIXES-per-project` Metric: compute.googleapis.com/global_public_delegated_prefixes
Regional public delegated prefixes create requests per minute per region	The number of create requests for regional public delegated prefixes that you can make per minute per region. Limit name: `PublicDelegatedPrefixCreateRequestsPerMinPerProjectPerRegion` Metric: compute.googleapis.com/regional_public_delegated_prefixes_create_requests_per_region
Regional public delegated prefixes delete requests per minute per region	The number of delete requests for regional public delegated prefixes that you can make per minute per region. Limit name: `PublicDelegatedPrefixDeleteRequestsPerMinPerProjectPerRegion` Metric: compute.googleapis.com/regional_public_delegated_prefixes_create_requests_per_region
Regional public delegated prefixes announce requests per minute per region	The number of announce requests that you can make per minute per region for regional public delegated prefixes. This quota does not apply to withdraw requests. Limit name: `PublicDelegatedPrefixAnnounceRequestsPerMinPerProjectPerRegion` Metric: compute.googleapis.com/regional_public_delegated_prefixes_announce_requests_per_region
Public delegated prefix with variable prefix length	The number of regional IPv6 public delegated prefixes that you can create, per project per region. Limit name: `VARIABLE-IPV6-PUBLIC-DELEGATED-PREFIXES-per-project-region` Metric: compute.googleapis.com/regional_variable_prefix_length_public_delegated_prefixes
Private Service Connect
PSC internal LB forwarding rules	The maximum number of Private Service Connect endpoints (forwarding rules) that a service consumer can create to connect to producer services. This quota is per region, per project. Quota name: `PSC-INTERNAL-LB-FORWARDING-RULES-per-project-region`
Number of Regional Endpoints per project per region	The maximum number of Private Service Connect endpoints that a service consumer can create to connect to regional endpoints. This quota is per region, per project. Quota name: `RegionalPerProjectRegionalEndpoints`
Service attachments	The maximum number of Private Service Connect service attachments that a service producer can create. This quota is per region, per project. Quota name: `SERVICE-ATTACHMENTS-per-project-region`
Network attachments	The maximum number of network attachments that a Private Service Connect consumer can create. This quota is per region, per project. Quota name: `NETWORK-ATTACHMENTS-per-project-region`
Service Connection Policies per project per region	The maximum number of service connection policies that a service consumer can create. This quota is per region, per project. Quota name: `RegionalPerProjectServiceConnectionPolicies`
Service Connection Maps per project per region	The maximum number of service connection maps that a service producer can create. This quota is per region, per project. Quota name: `RegionalPerProjectServiceConnectionMaps`
Composite Health
Regional health aggregation policies	The maximum number of health aggregation policies that you can create in each region of your project. Quota name: `REGIONAL-HEALTH-AGGREGATION-POLICIES-per-project-region`
Regional health sources	The maximum number of health sources that you can create in each region of your project. Quota name: `REGIONAL-HEALTH-SOURCES-per-project-region`
Regional composite health checks	The maximum number of composite health checks that you can create in each region of your project. Quota name: `REGIONAL-COMPOSITE-HEALTH-CHECKS-per-project-region`

Per network

This table highlights important network quotas. For other quotas, see the Quotas page in the Google Cloud console.

Information on monitoring the available metrics using Cloud Monitoring is available at Use quota metrics. Each quota has a limit and a usage value.

A per-network quota usually has a corresponding per-peering group quota applicable when VPC Network Peering is used. Per-peering group quotas have the concept of an effective limit.

Quota	Description
Instances & alias IP ranges
Instances per VPC network	The total number of VM network interfaces (NICs) in the VPC network. Quota name: `INSTANCES_PER_NETWORK_GLOBAL` Available metrics: compute.googleapis.com/quota/instances_per_vpc_network/limit compute.googleapis.com/quota/instances_per_vpc_network/usage compute.googleapis.com/quota/instances_per_vpc_network/exceeded
IP aliases per VPC network	The total number of alias IP ranges used by VM network interfaces (NICs) in the VPC network. This quota counts the number of alias IP ranges without regard to each range's size (subnet mask). In addition to this quota, there is a limit on the number of alias IP ranges per network interface. Quota name: `ALIASES_PER_NETWORK_GLOBAL` Available metrics: compute.googleapis.com/quota/ip_aliases_per_vpc_network/limit compute.googleapis.com/quota/ip_aliases_per_vpc_network/usage compute.googleapis.com/quota/ip_aliases_per_vpc_network/exceeded
Subnet IP address ranges
Subnetwork ranges per VPC network	The total number of subnet IP address ranges used by subnets in the VPC network. Includes primary IPv4 address ranges, secondary IPv4 address ranges, and IPv6 address ranges. Quota name: `SUBNET_RANGES_PER_NETWORK` Available metrics: compute.googleapis.com/quota/subnet_ranges_per_vpc_network/limit compute.googleapis.com/quota/subnet_ranges_per_vpc_network/usage compute.googleapis.com/quota/subnet_ranges_per_vpc_network/exceeded
Subnetwork ranges per peering group	From the perspective of a VPC network, the total number of subnet IP address ranges used by subnets local to the VPC network and in its directly connected peers. Includes primary IPv4 address ranges, secondary IPv4 address ranges, and IPv6 address ranges. Quota name: `SUBNET_RANGES_PEERING_GROUP` Available metrics: compute.googleapis.com/quota/subnet_ranges_per_peering_group/limit compute.googleapis.com/quota/subnet_ranges_per_peering_group/usage
VPC Network Peering
Peerings per VPC network	From the perspective of a VPC network, the total number of other VPC networks it can connect to by using VPC Network Peering. Quota name: `PEERINGS_PER_NETWORK` Available metrics: compute.googleapis.com/quota/peerings_per_network/limit compute.googleapis.com/quota/peerings_per_network/usage compute.googleapis.com/quota/peerings_per_network/exceeded
Static and dynamic routes
Static routes per network	From the perspective of all regions of a VPC network, the total number of static routes local to the VPC network. This quota applies to the aggregate of IPv4 and IPv6 static routes. Quota name: `STATIC_ROUTES_PER_NETWORK` Available metrics: compute.googleapis.com/quota/static_routes_per_vpc_network/limit compute.googleapis.com/quota/static_routes_per_vpc_network/usage compute.googleapis.com/quota/static_routes_per_vpc_network/exceeded
Static routes per peering group	From the perspective of all regions of a VPC network, the total number of static routes local to the VPC network and in its directly connected peers. This quota applies to the aggregate of IPv4 and IPv6 static routes. Quota name: `STATIC_ROUTES_PER_PEERING_GROUP` Available metrics: compute.googleapis.com/quota/static_routes_per_peering_group/limit compute.googleapis.com/quota/static_routes_per_peering_group/usage
Dynamic routes per region per peering group	From the perspective of each region in a VPC network, the total number of dynamic routes local to the VPC network and in its directly connected peers. This quota applies to the aggregate of IPv4 and IPv6 dynamic routes. Quota name: `DYNAMIC_ROUTES_PER_REGION_PER_PEERING_GROUP` Available metrics: compute.googleapis.com/quota/dynamic_routes_per_region_per_peering_group/limit compute.googleapis.com/quota/dynamic_routes_per_region_per_peering_group/usage If the number of dynamic routes exceeds this limit, Google Cloud adjusts how it imports dynamic routes according to the following rules: Google Cloud only drops peering dynamic routes. Google Cloud uses an internal algorithm when dropping peering dynamic routes; you can't predict which peering dynamic routes are dropped. Subject to Cloud Router limits, Google Cloud never drops local dynamic routes (those routes learned by Cloud Router that are local to the VPC network itself). If a peering connection causes this limit to be exceeded, Google Cloud still lets you create the peering connection without a warning.
Load balancer and protocol forwarding rules See Forwarding rules in the load balancing quotas documentation.