A shadow GCP project is any project created outside your organisation resource hierarchy, often on a personal account or a quick team signup, that finance and the platform team cannot see in the consolidated billing account. The fix is the same three step move that works for any cloud: discover every project linked to your domains, consolidate them under one organisation and billing account, then close the path that let them appear. The payoff on GCP is specific: Committed Use Discounts and sustained use discounts only reach projects inside the billing account, so a shadow project pays full on demand rates for capacity your commitments would otherwise cover.
The cost is larger than the visible bill. Fragmented projects earn no shared discount, carry no budget or labels, accumulate idle resources, and split the spend that gives you leverage at an enterprise agreement renewal.
Why do shadow GCP projects cost more than they look?
Four costs stack up. First, lost discounts: a project outside the billing account earns no sustained use discount, draws on no Committed Use Discount, and sits outside any enterprise agreement, so it pays on demand for everything. Second, unwatched waste: no budget, no labels, and no anomaly alert means idle Compute Engine instances, orphaned persistent disks, and forgotten BigQuery datasets pile up with nobody watching. Third, fragmented leverage: renewal leverage comes from a consolidated forecast, and spend scattered across projects finance cannot enumerate weakens that number. Fourth, security and compliance exposure: a project outside your hierarchy is outside your policies, logging, and audit scope.
This is a cost problem that often surfaces a governance problem. The same fragmentation that loses discounts also hides risk. We treat the cross cloud version in governing shadow cloud accounts.
How do I discover every GCP project?
Discovery reconciles two views. From finance, pull expense reports, corporate card statements, and any invoice carrying a Google Cloud charge; personal card reimbursements are a common tell. From the provider, enumerate every project and billing account linked to your corporate domains and Cloud Identity, then compare against the projects already inside your organisation resource hierarchy. The gap between what finance pays for and what the platform team manages is your shadow estate.
A Fortune 500 retailer believed it ran a handful of GCP projects under one billing account. Reconciling card statements against Cloud Identity surfaced dozens of additional projects created by individual teams on separate billing accounts over several years. Migrating them into the organisation hierarchy and the central billing account brought the spend under existing Committed Use Discount coverage and removed a long list of idle disks and datasets nobody had owned. Figures are verified against billing data and anonymised.
How do I consolidate and then close the door?
Consolidation migrates each shadow project into your organisation resource hierarchy, under folders that match your structure, and links it to the central billing account. That single move puts the spend under one bill, so it earns sustained use discounts and draws on Committed Use Discounts; applies your guardrails, so labels, budgets, and anomaly alerts reach projects that had none; and restores a single forecast, rebuilding the consolidated number that drives renewal leverage.
Closing the door is governance. Provide a sanctioned, fast path to request a new project so teams have no reason to go around you, apply organisation policy constraints that block project creation outside the managed hierarchy, and reconcile finance records against managed projects monthly so any new shadow project surfaces in weeks rather than years. The aim is to make the sanctioned path the path of least resistance, so speed and governance point the same way. Multi project visibility is the standing control, covered in multi project cost reporting.
The shadow project playbook at a glance
| Step | Action | What it recovers |
|---|---|---|
| Discover | Reconcile finance records against Cloud Identity | The true size of the estate |
| Consolidate | Migrate into the organisation and central billing account | CUD and sustained use discount coverage |
| Govern | Organisation policy plus a fast sanctioned path | A shadow estate that stops growing back |
The cadence that keeps the estate clean is a regular spend review across every project, which we describe in the GCP spend review cadence and the broader GCP cost optimization guide.
Frequently asked questions
What is a shadow GCP project?
Why do shadow GCP projects cost more?
How do I find shadow GCP projects?
Find the GCP spend you cannot see
We discover, consolidate, and govern your full GCP estate, recovering Committed Use Discount and sustained use discount coverage and closing risk across AWS, Azure, GCP, and OCI. Our guarantee: we reduce your cloud spend or we reimburse our service fee.
Put a defensible number on your cloud spend.
No provider in the room, no published price list. Tell us your footprint and we will scope the savings against your billing data — we reduce your cloud spend or we reimburse our service fee.
The Cloud Spend Navigator: what changed in cloud pricing, commitments, and FinOps — no vendor spin.