Cloud Next Generation Firewall uses quotas and system limits to maintain fair resource
allocation, prevent service overloads, and help you manage resource use.

Quotas and system limits are similar but differ in the following ways:

- *Quotas* have default values, but you can typically request adjustments.
- *System limits* are fixed values that can't be changed.

Google Cloud uses quotas to help maintain fairness and reduce
spikes in resource use and availability. A quota restricts how much of a
Google Cloud resource your Google Cloud project can use. Quotas
apply to a range of resource types, including hardware, software, and network
components. For example, quotas can restrict the number of API calls to a
service, the number of load balancers used concurrently by your project, or the
number of projects that you can create. Quotas protect the community of
Google Cloud users by preventing the overloading of services. Quotas also
help you to manage your own Google Cloud resources.

The Cloud Quotas system does the following:

- Monitors your consumption of Google Cloud products and services
- Restricts your consumption of those resources
- Provides a way to [request changes to the quota value](https://docs.cloud.google.com/docs/quotas/help/request_increase) and [automate quota adjustments](https://docs.cloud.google.com/docs/quotas/quota-adjuster.md.txt)

In most cases, when you attempt to consume more of a resource than its quota
allows, the system blocks access to the resource, and the task that
you're trying to perform fails.

Quotas generally apply at the Google Cloud project
level. Your use of a resource in one project doesn't affect
your available quota in another project. Within a Google Cloud project, quotas
are shared across all applications and IP addresses.


For more information, see the
[Cloud Quotas overview](https://docs.cloud.google.com/docs/quotas/overview.md.txt).


There are also *system limits* on Cloud NGFW resources.
System limits can't be changed.

## Quotas

This section lists the quotas that apply to Cloud Next Generation Firewall.

To monitor per-project quotas that use Cloud Monitoring, set up monitoring
for the metric `serviceruntime.googleapis.com/quota/allocation/usage` on the
`Consumer Quota` resource type. Set additional label filters (`service`,
`quota_metric`) to get to the quota type. For information about monitoring quota
metrics, see [Chart and monitor quota metrics](https://docs.cloud.google.com/monitoring/alerts/using-quota-metrics.md.txt).
Each quota has a limit and a usage value.

Unless noted otherwise, to change a quota, see
[Request a quota adjustment](https://docs.cloud.google.com/docs/quotas/view-manage.md.txt#requesting_higher_quota).

### Per project

The following table highlights Cloud NGFW quotas that are per
project:

| Quota | Description |
|---|---|
| [Virtual Private Cloud (VPC) firewall rules](https://console.cloud.google.com/iam-admin/quotas?service=compute.googleapis.com&metric=compute.googleapis.com/firewalls) | The number of [VPC firewall rules](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt) that you can create in a project, regardless of the VPC network to which each firewall rule applies. |
| [Global network firewall policies](https://console.cloud.google.com/iam-admin/quotas?service=compute.googleapis.com&metric=compute.googleapis.com/network_firewall_policies) | The number of [Global network firewall policies](https://docs.cloud.google.com/firewall/docs/network-firewall-policies.md.txt) in a project, regardless of how many VPC networks are associated with each policy. |
| [Regional network firewall policies](https://console.cloud.google.com/iam-admin/quotas?service=compute.googleapis.com&metric=compute.googleapis.com/regional_network_firewall_policies) | The number of [Regional network firewall policies](https://docs.cloud.google.com/firewall/docs/regional-firewall-policies.md.txt) in each region of a project, regardless of how many VPC networks are associated with each policy. |
| [Global address groups per project](https://console.cloud.google.com/iam-admin/quotas?service=networksecurity.googleapis.com&metric=networksecurity.googleapis.com/global-project-addressgroups) | The number of global, project-scoped address groups that you can define in a project. |
| [Regional address groups per project per region](https://console.cloud.google.com/iam-admin/quotas?service=networksecurity.googleapis.com&metric=networksecurity.googleapis.com/regional-project-addressgroups) | The number of regional, project-scoped address groups that you can define in each region of a project. |

### Per organization

The following table highlights Cloud NGFW quotas that are per
organization. To change an organization-level quota, [file a Support
case](https://cloud.google.com/support-hub).

| Quota | Description |
|---|---|
| [Unassociated Hierarchical firewall policies in an organization](https://console.cloud.google.com/iam-admin/quotas?service=compute.googleapis.com&metric=compute.googleapis.com/unassociated_hierarchical_firewall_policies_in_organization) | The number of [Hierarchical firewall policies](https://docs.cloud.google.com/firewall/docs/firewall-policies.md.txt) in an organization that are not associated with any folder or organization resource. There is no limit on the number of Hierarchical firewall policies in an organization that are associated with a resource. |
| [Global address groups per organization](https://console.cloud.google.com/iam-admin/quotas?service=networksecurity.googleapis.com&metric=networksecurity.googleapis.com/global-organization-addressgroups) | The number of global, organization-scoped address groups that you can define in an organization. |
| [Regional address groups per organization per region](https://console.cloud.google.com/iam-admin/quotas?service=networksecurity.googleapis.com&metric=networksecurity.googleapis.com/regional-organization-addressgroups) | The number of regional, organization-scoped address groups that you can define in each region in an organization. |

### Per network

The following quotas apply to VPC networks:

| Quota | Description |
|---|---|
| [Regional network firewall policy associations per region per VPC network](https://console.cloud.google.com/iam-admin/quotas?metric=compute.googleapis.com/regional_network_firewall_policy_associations_per_region_per_vpc_network) | The maximum number of regional network firewall policies that you can associate with a region of a VPC network. |
| [Firewall rule attributes per region per VPC network](https://console.cloud.google.com/iam-admin/quotas?metric=compute.googleapis.com/firewall_rule_attributes_per_region_per_vpc_network) | The maximum number of rule attributes from rules of all associated regional network firewall policies in a VPC network's region. For details about computation of rule attributes, see [Computation of rule attribute count](https://docs.cloud.google.com/firewall/docs/quotas.md.txt#rule-attribute-count-computation). |
| [Firewall rule FQDNs per region per VPC network](https://console.cloud.google.com/iam-admin/quotas?metric=compute.googleapis.com/firewall_rule_fqdns_per_region_per_vpc_network) | The maximum number of FQDNs from rules in all associated regional network firewall policies in a VPC network's region. |

### Per firewall policy

The following table highlights Cloud NGFW quotas that are per
firewall policy resource:

| Quota | Description |
|---|---|
| **Hierarchical firewall policies** ||
| [Rule attributes per hierarchical firewall policy](https://console.cloud.google.com/iam-admin/quotas?service=compute.googleapis.com&metric=compute.googleapis.com/rule_attributes_per_hierarchical_firewall_policy) | This quota is the sum of rule attributes from all rules in a hierarchical firewall policy. For more information, see [Rule attribute count for a firewall policy](https://docs.cloud.google.com/firewall/docs/quotas.md.txt#per-firewall-policy-rule-attr-count) and [Computation of rule attribute count](https://docs.cloud.google.com/firewall/docs/quotas.md.txt#rule-attribute-count-computation). |
| [Domain names (FQDNs) per hierarchical firewall policy](https://console.cloud.google.com/iam-admin/quotas?service=compute.googleapis.com&metric=compute.googleapis.com/fqdns_per_hierarchical_firewall_policy) | The number of domain names that you can include in all rules of a hierarchical firewall policy. This quota is the sum of all source domain names from all ingress rules in the policy plus the sum of all destination domain names from all egress rules in the policy. |
| **Global network firewall policies** ||
| [Rule attributes per global network firewall policy](https://console.cloud.google.com/iam-admin/quotas?service=compute.googleapis.com&metric=compute.googleapis.com/rule_attributes_per_global_network_firewall_policy) | The sum of rule attributes from all rules in a global network firewall policy. For more information, see [Rule attribute count for a firewall policy](https://docs.cloud.google.com/firewall/docs/quotas.md.txt#per-firewall-policy-rule-attr-count) and [Computation of rule attribute count](https://docs.cloud.google.com/firewall/docs/quotas.md.txt#rule-attribute-count-computation). |
| [Domain names (FQDNs) per global network firewall policy](https://console.cloud.google.com/iam-admin/quotas?service=compute.googleapis.com&metric=compute.googleapis.com/fqdns_per_global_network_firewall_policy) | The number of domain names that you can include in all rules of a global network firewall policy. This quota is the sum of all source domain names from all ingress rules in the policy plus the sum of all destination domain names from all egress rules in the policy. |
| **Regional network firewall policies** ||
| [Rule attributes per regional network firewall policy](https://console.cloud.google.com/iam-admin/quotas?service=compute.googleapis.com&metric=compute.googleapis.com/rule_attributes_per_regional_network_firewall_policy) | The sum of rule attributes from all rules in a regional network firewall policy. For more information, see [Rule attribute count for a firewall policy](https://docs.cloud.google.com/firewall/docs/quotas.md.txt#per-firewall-policy-rule-attr-count) and [Computation of rule attribute count](https://docs.cloud.google.com/firewall/docs/quotas.md.txt#rule-attribute-count-computation). |
| [Domain names (FQDNs) per regional network firewall policy](https://console.cloud.google.com/iam-admin/quotas?service=compute.googleapis.com&metric=compute.googleapis.com/fqdns_per_regional_network_firewall_policy) | The number of domain names (FQDNs) that you can include in all rules of a regional network firewall policy: This quota is the sum of all source domain names from all ingress rules in the policy plus the sum of all destination domain names from all egress rules in the policy. |

#### Rule attribute count for a firewall policy

Each firewall policy supports a maximum total number of attributes from all
rules in the policy. To determine the rule attribute count for a given firewall
policy, describe the policy. For directions, see the following:

- [Describe a hierarchical firewall
  policy](https://docs.cloud.google.com/firewall/docs/manage-hierarchical-firewall-policies#describe-policy)
- [Describe a global network firewall
  policy](https://docs.cloud.google.com/firewall/docs/manage-global-firewall-policies#describe-network-firewall-policy)
- [Describe a regional network firewall
  policy](https://docs.cloud.google.com/firewall/docs/manage-regional-firewall-policies#describe-network-firewall-policy)

For details about computation of rule attributes, see [Computation of rule
attribute count](https://docs.cloud.google.com/firewall/docs/quotas#rule-attribute-count-computation).

## Limits

Limits *cannot* be increased unless specifically noted.

### Per organization

The following limits apply to organizations:

| Item | limit | Notes |
|---|---|---|
| Maximum secure tag keys per organization | 1,000 | The maximum number of secure tag keys that have a parent organization. For more information, see [Tag limits](https://docs.cloud.google.com/resource-manager/docs/limits.md.txt#tag-limits). |
| Maximum secure tag values used by all tag keys whose `purpose` is `GCE_FIREWALL` and `purpose-data` is an organization | 16384 | This limit is enforced against all tag values used by tag keys created in the organization matching the purpose data, including tag keys whose parent is either the organization or a project therein. |
| URL filtering security profiles per organization | 40 | The maximum number of URL filtering security profiles that you can create per organization. |
| Threat prevention security profiles per organization | 40 | The maximum number of security profiles of type threat prevention that you can create per organization. |
| Security profile groups with threat prevention per organization | 40 | The maximum number of security profile groups that use a threat prevention security profile that you can create per organization. |
| Security profile groups with URL filtering per organization | 40 | The maximum number of security profile groups that use a URL filtering security profile that you can create per organization. |
| Advanced malware sandbox security profiles per organization | 40 | The maximum number of `WILDFIRE_ANALYSIS` security profiles that you can create per organization. |
| Firewall endpoints per zone per organization | 50 | The maximum number of firewall endpoints that you can create per zone per organization. |

### Per project

The following limits apply to project:

| Item | limit | Notes |
|---|---|---|
| Maximum secure tag keys per project | 1,000 | The maximum number of secure tag keys that have a parent project. For more information, see [Tag limits](https://docs.cloud.google.com/resource-manager/docs/limits.md.txt#tag-limits). |
| URL filtering security profiles per project | 40 | The maximum number of URL filtering security profiles that you can create per project. |
| Threat prevention security profiles per project | 40 | The maximum number of security profiles of type threat prevention that you can create per project. |
| Security profile groups with threat prevention per project | 35 | The maximum number of security profile groups that use a threat prevention security profile that you can create per project. |
| Security profile groups with URL filtering per project | 35 | The maximum number of security profile groups that use a URL filtering security profile that you can create per project. |
| Firewall endpoints per zone per project | 50 | The maximum number of firewall endpoints that you can create per zone per project. |

### Per network

The following limits apply to VPC networks:

| Item | Limit | Notes |
|---|---|---|
| Maximum global network firewall policies per network | 1 | The maximum number of global network firewall policies that you can associate with a VPC network. |
| Maximum number of domain names (FQDNs) per network | 1,000 | The maximum *total* number of domain names that can be used in firewall rules that come from hierarchical firewall policies, global network firewall policies, and regional network firewall policies associated with a VPC network. |
| Maximum secure tag values used by all tag keys whose `purpose` is `GCE_FIREWALL` and `purpose-data` is a VPC network | 16383 | This limit is enforced against all tag values used by tag keys whose `purpose-data` matches the specified VPC network, including tag keys whose parent is either the organization or a project. |
| Firewall endpoints per zone per network | 1 | The maximum number of firewall endpoints that you can assign per zone per network. |

### Per firewall rule

The following limits apply to firewall rules:

| Item | Limit | Notes |
|---|---|---|
| Maximum number of source secure tags per ingress firewall policy rule | 256 | Applicable only to ingress firewall policy rule---the maximum number of secure tags that you can use as source tags in the firewall rule. This limit cannot be increased. |
| Maximum number of target secure tags per firewall policy rule | 256 | Applicable only to firewall policy rule---the maximum number of secure tags that you can use as target tags in the firewall rule. This limit cannot be increased. |
| Maximum number of source network tags per ingress VPC firewall rule | 30 | Applicable only to ingress VPC firewall rules---the maximum number of network tags that you can use as source tags in the firewall rule. This limit cannot be increased. |
| Maximum number of target network tags per VPC firewall rule | 70 | Applicable only to VPC firewall rules---the maximum number of network tags that you can use as target tags in the firewall rule. This limit cannot be increased. |
| Maximum number of source service accounts per ingress VPC firewall rule | 10 | Applicable only to ingress VPC firewall rules---the maximum number of service accounts that you can use as sources in the firewall rule. This limit cannot be increased. |
| Maximum number of target service accounts per firewall rule | 10 | The maximum number of service accounts that you can use as targets in a VPC firewall rule or rule in a firewall policy. This limit cannot be increased. |
| Maximum number of source IP address ranges per firewall rule | 5,000 | The maximum number of source IP address ranges that you can specify in a VPC firewall rule or rule in a firewall policy. IP address ranges are either IPv4 only or IPv6 only. This limit cannot be increased. |
| Maximum number of destination IP address ranges per firewall rule | 5,000 | The maximum number of destination IP address ranges that you can specify in a VPC firewall rule or rule in a firewall policy. IP address ranges are either IPv4 only or IPv6 only. This limit cannot be increased. |
| Maximum number of source address groups per ingress firewall rule in a firewall policy | 10 | The maximum number of source address groups that you can specify in an ingress firewall rule in a firewall policy. This limit cannot be increased. |
| Maximum number of destination address groups per firewall rule in a firewall policy | 10 | The maximum number of destination address groups that you can specify in an egress firewall rule in a firewall policy. This limit cannot be increased. |
| Maximum number of domain names (FQDNs) per firewall rule in a firewall policy | 100 | The number of domain names (FQDNs) that you can include in a rule of a firewall policy. This limit cannot be increased. |

### Per address group

The following limits apply to address groups used by Cloud NGFW.

| Item | Limit | Notes |
|---|---|---|
| Maximum number of IP addresses per address group | 1,000 | Applies individually to each address group used by Cloud NGFW. The address group can be a global, project-scoped address group; global, organization-scoped address group; regional project-scoped address group; or regional, organization-scoped address group. |

### Per firewall endpoint

The following limits apply to firewall endpoints:

| Item | Limit | Notes |
|---|---|---|
| Maximum firewall endpoint associations per organization-level firewall endpoint | 50 | The maximum number of firewall endpoint associations associated with a single organization-level firewall endpoint. |
| Maximum firewall endpoint associations per project-level firewall endpoint | 50 | The maximum number of firewall endpoint associations associated with a single project-level firewall endpoint. |
| Maximum per-connection throughput with Transport Layer Security (TLS) | 250 Mbps | The maximum per-connection throughput with TLS inspection. |
| Maximum per-connection throughput without TLS | 1.25 Gbps | The maximum per-connection throughput without TLS inspection. |
| Maximum traffic with TLS | 2 Gbps | The maximum traffic firewall endpoints can process with TLS inspection. |
| Maximum traffic without TLS | 10 Gbps | The maximum traffic firewall endpoints can process without TLS inspection. |

### Per security profile

The following limits apply to security profiles:

| Item | Limit | Notes |
|---|---|---|
| Number of Advanced malware sandbox submission rules per security profile | 100 | The maximum number of submission rules that you can add to an Advanced malware sandbox security profile. |
| Number of Advanced malware sandbox inline cloud analysis rules per security profile | 100 | The maximum number of inline cloud analysis rules that you can add to an Advanced malware sandbox security profile. |
| Number of domains per security profile | 500 | The maximum number of domains that you can add to a domain filtering security profile. |
| Number of matcher strings per security profile | 2500 | The maximum number of matcher strings that you can add to a URL filtering security profile. |
| Number of threat overrides per security profile | 100 | The maximum number of threat overrides you can add in a threat prevention security profile. |

### Per secure tag

The following limits apply to secure tags:

| Item | Limit | Notes |
|---|---|---|
| Maximum secure tag values per tag key | 1,000 | The maximum number of secure tag values that you can add per tag key. For more information, see [Tag limits](https://docs.cloud.google.com/resource-manager/docs/limits.md.txt#tag-limits). |

### Per VM network interface

The following limits apply to virtual machine (VM) network interfaces:

| Item | Limit | Notes |
|---|---|---|
| Maximum secure tag values attached to a VM network interface | 10 | The maximum number of secure tag values that can be attached to each VM network interface. For more information about the specifications for firewall secure tags, see [Specifications](https://docs.cloud.google.com/firewall/docs/tags-firewalls-overview.md.txt#specifications). For network limits, see [Per network limits](https://docs.cloud.google.com/firewall/docs/quotas.md.txt#per-network-limits). |

## Computation of rule attribute count

Cloud NGFW includes only the following firewall rule attributes in
the rule attribute count for firewall policy rules and VPC firewall rules.

| Rule attributes or parameters | Rule type | Rule attribute count |
|---|---|---|
| [IP protocol name](https://docs.cloud.google.com/firewall/docs/firewall-policies-rule-details.md.txt#protocols_and_ports) | VPC firewall rules and firewall policy rules | 1 attribute count for each protocol |
| [Destination port](https://docs.cloud.google.com/firewall/docs/firewall-policies-rule-details.md.txt#protocols_and_ports) | VPC firewall rules and firewall policy rules | 1 attribute count for each port or port range |
| [Source](https://docs.cloud.google.com/firewall/docs/firewall-policies-rule-details.md.txt#sources) or [destination](https://docs.cloud.google.com/firewall/docs/firewall-policies-rule-details.md.txt#destinations) IP ranges | VPC firewall rules and firewall policy rules | 1 attribute count for each IP range |
| Source [secure tags](https://docs.cloud.google.com/firewall/docs/tags-firewalls-overview.md.txt) | Ingress firewall policy rules | 1 attribute count for each tag |
| Source [network tags](https://docs.cloud.google.com/firewall/docs/tags-firewalls-overview.md.txt#:~:text=network%20firewall%20policy.-,Network%20tags,-are%20character%20strings) | Ingress VPC firewall rules | 1 attribute count for each tag |
| Source [service accounts](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#serviceaccounts) | Ingress VPC firewall rules | 1 attribute count for each service account |
| Source or destination [Google Threat Intelligence](https://docs.cloud.google.com/firewall/docs/threat-intelligence-overview.md.txt) lists | Firewall policy rules | 1 attribute count for each Google Threat Intelligence list |
| Source or destination [country or region codes](https://docs.cloud.google.com/firewall/docs/geolocation-objects-overview.md.txt) | Firewall policy rules | 1 attribute count for each country code or region code |
| Source or destination [FQDN objects](https://docs.cloud.google.com/firewall/docs/fqdn-objects-overview.md.txt) | Firewall policy rules | 64 attribute counts for each FQDN object |
| Source or destination [address groups](https://docs.cloud.google.com/firewall/docs/address-groups-firewall-policies.md.txt) | Firewall policy rules | Sum of capacities of each address group |
| Source or destination [network contexts](https://docs.cloud.google.com/firewall/docs/understand-network-contexts.md.txt) | Firewall policy rules | 1 attribute count for each specified network context. For the VPC networks context, the rule attribute count is the total number of source VPC networks that you specify. |

The following table lists example rules and the attribute count for each example
rule.

| Example firewall rule | Rule attribute count | Explanation |
|---|---|---|
| Ingress allow firewall rule with source IP address range `10.100.0.1/32`, `tcp` protocol, and `5000-6000` port range. | 3 | One source range; one protocol, one port range. |
| Ingress deny firewall rule with source IP address ranges `10.0.0.0/8, 192.168.0.0/16`, destination IP address range `100.64.0.7/32`, `tcp` and `udp` protocols, port ranges `53-53` and `5353-5353`. | 11 | There are four protocol and port combinations: `tcp:53-53`, `tcp:5353-5353`, `udp:53-53`, and `udp:5353-5353`. Each protocol and port combination uses two attributes. One attribute each for the two source IP address ranges, one attribute for the destination IP address range, and eight attributes for the protocol and port combinations produces an attribute count of 11. |
| Egress deny firewall rule with source IP address range `100.64.0.7/32`, destination IP address range `10.100.0.1/32, 10.100.1.1/32`, `tcp:80`, `tcp:443`, and `udp:4000-5000`. | 9 | Protocol and port combinations expand to three: `tcp:80-80`, `tcp:443-443`, and `udp:4000-5000`. Each protocol and port combination uses two attributes. One attribute for the source range, one attribute each for the two destination IP address ranges, and six attributes for the protocol and port combinations produces an attribute count of 9. |
| Ingress allow firewall rule with two target secure tags, `VPC_NETWORKS` source network context and three specified VPC networks, source IP address range `10.100.0.1/32`, source FQDN `example.com`, `tcp` protocol, and `5000-6000` port range. | 70 | Three attributes for the `VPC_NETWORKS` source network context with specified VPC networks, one attribute for the source range, 64 attributes for the source FQDN object, and one attribute each for the protocol and port range produces an attribute count of 70. Note that the two target secure tags are not counted. |

## Manage quotas

Cloud Next Generation Firewall (Cloud NGFW) enforces quotas on resource usage for various reasons.
For example, quotas protect the community of Google Cloud users by
preventing unforeseen spikes in usage. Quotas also help users who are exploring
Google Cloud with the
[free tier](https://docs.cloud.google.com/free/docs/gcp-free-tier)
to stay within their trial.

All projects start with the same quotas, which you can change by
[requesting additional quota](https://docs.cloud.google.com/firewall/docs/quotas.md.txt#requesting-additional-quota). Some quotas might increase
automatically based on your use of a product.

### Permissions

To view quotas or request quota increases, Identity and Access Management (IAM) principals need one of the
following roles.

| Task | Required role |
|---|---|
| Check quotas for a project | One of the following: - Project [Owner](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/owner`) - Project [Editor](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/editor`) - [Quota Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/servicemanagement.md.txt) (`roles/servicemanagement.quotaViewer`) |
| Modify quotas, request additional quota | One of the following: - Project [Owner](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/owner`) - Project [Editor](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/editor`) - [Quota Administrator](https://docs.cloud.google.com/iam/docs/roles-permissions/servicemanagement.md.txt) (`roles/servicemanagement.quotaAdmin`) - A custom role with the `serviceusage.quotas.update` permission |

### Check your quota

### Console

1. In the Google Cloud console, go to the **Quotas** page.

   [Go to Quotas](https://console.cloud.google.com/iam-admin/quotas)
2. To search for the quota that you want to update, use the **Filter table**. If you don't know the name of the quota, use the links on this page instead.

### gcloud

Using the Google Cloud CLI, run the following command to
check your quotas. Replace `PROJECT_ID` with your own project ID.

```
    gcloud compute project-info describe --project PROJECT_ID
```

To check your used quota in a region, run the following command:

```
    gcloud compute regions describe example-region
    
```

### Errors when exceeding your quota

If you exceed a quota with a `gcloud` command,
`gcloud` outputs a `quota exceeded` error
message and returns with the exit code `1`.

If you exceed a quota with an API request, Google Cloud returns the
following HTTP status code: `413 Request Entity Too Large`.

### Request additional quota

To adjust most quotas, use the Google Cloud console.
For more information, see
[Request a quota adjustment](https://docs.cloud.google.com/docs/quotas/help/request_increase).

### Resource availability

Each quota represents a maximum number for a particular type of resource that you can create,
if that resource is available. It's important to note that quotas *don't*
guarantee resource availability. Even if you have available quota, you can't create
a new resource if it is not available.

For example, you might have sufficient quota to create a new regional, external IP address
in a given region. However, that is not possible if there are no
available external IP addresses in that region. Zonal resource
availability can also affect your ability to create a new resource.

Situations where resources are unavailable in an entire region are rare. However, resources
within a zone can be depleted from time to time, typically without impact to the service level
agreement (SLA) for the type of resource. For more information, review the relevant SLA for the
resource.

## Related information

- [VPC resource quotas](https://docs.cloud.google.com/vpc/docs/quota.md.txt)
- [Compute Engine resource quotas](https://docs.cloud.google.com/compute/quotas)