Best gardening steps

Hello simo,

We're reaching out with an important update regarding enhancing the security of sensitive actions in your Google Cloud environment. This update strengthens protection against unauthorized access to your critical Google Cloud resources.

We have provided additional information below to guide you through this change.

What you need to know

Key changes

Starting in July 2025, to further protect your critical Google Cloud resources, you will need to re-enter your password or complete multi-factor authentication (MFA) for certain sensitive actions. These actions include billing assignment changes and IAM policy changes at the Organization, Folder, or Project level.

This additional authentication step ensures that only authorized users can make critical changes to billing and access control settings.

Re-authentication limitations

This re-authentication will initially apply to Google Cloud Console users with Google Cloud Identity. It will not apply to programmatic user account access or external identities federated through Workforce Identity pools and SSO.

Actions that require re-authentication

Specifically, you will be prompted to re-authenticate when performing the following actions (which correspond to these API calls):

• resourcemanager.organizations.setIamPolicy
• resourcemanager.folders.setIamPolicy
• resourcemanager.projects.setIamPolicy
• billing.accounts.setIamPolicy
• billing.accounts.move
• billing.accounts.removeFromOrganization
• billing.resourceAssociations.create
• billing.resourceAssociations.delete
• resourcemanager.projects.deleteBillingAssignment
• resourcemanager.projects.createBillingAssignment
• resourcemanager.tagValueBindings.delete

Note: Service accounts are not affected by these new re-authentication requirements.

What you need to do

No action is required from you. This enhanced security will be automatically applied starting July 2025.

We're here to help

You can find more details about Reauthentication for Sensitive Actions in our User Guide. If you have any questions or require assistance, please contact reauth-for-sensitive-actions@google.com.

Thank you for your understanding and cooperation as we work to improve security in Google Cloud.

Thanks for choosing Google Cloud.

Hello simo,

We're writing to inform you that starting May 12, 2025, you will be required to use multi-factor authentication (MFA), also known as 2-Step Verification (2SV), to access Google Cloud console, gcloud CLI, and Firebase console. You're receiving this notice because you have access to projects on Google Cloud.

We understand this change may require some configuration adjustments and have provided additional information below to assist you.

What you need to know

In November 2024, we announced that Google Cloud will be mandating MFA, also known as 2-Step Verification (2SV), for all users. This helps protect your account by requiring both a password and an additional form of verification, such as a phone, security key, or Google Authenticator code, when signing in.

Starting May 12, 2025, 2SV will be mandatory to access Google Cloud console, gcloud CLI, and Firebase console.

What you need to do

To ensure continued access to Google Cloud console, gcloud CLI, and Firebase console, you are required to turn on 2-Step Verification for your account from security.google.com.

Exclusions

• Apps and workloads that are hosted on Google Cloud, including those that use Google APIs

• Other services, like Google Photos, YouTube, and Google Workspace (including Gmail, Google Sheets, and Google Slides) are not impacted by this requirement

We're here to help

For more information please refer to the multi-factor authentication requirement documentation If you have questions or need assistance, please contact Google Cloud Customer Care.

Thanks for choosing Google Cloud.