Manage service enablement

Hierarchical service activation lets you manage service enablement that is inherited through the Google Cloud resource hierarchy. For more information, see the overview.

This document shows you how to use the Google Cloud CLI to manage service enablement for projects, folders, and organizations.

Before you begin

To run the commands on this page, set up the gcloud CLI in one of the following development environments:
Cloud Shell
To use an online terminal with the gcloud CLI already set up, activate Cloud Shell:

At the bottom of this page, a Cloud Shell session starts and displays a command-line prompt. It can take a few seconds for the session to initialize.
Local shell
To use a local development environment, follow these steps:
1. Install the gcloud CLI.
2. If you're using an external identity provider (IdP), sign in to the gcloud CLI with your federated identity. For more information, see Sign in to the gcloud CLI with your federated identity.
3. Initialize the gcloud CLI.
Create or select a Google Cloud project. While you can target a folder or organization when using hierarchical service activation, using the gcloud CLI requires a project context for quota and billing. If you don't specify a project ID, the system defaults to the current project.
- Create a Google Cloud project:
```
gcloud projects create PROJECT_ID
```
  Replace PROJECT_ID with a name for the Google Cloud project you are creating.
- Select the Google Cloud project that you created:
```
gcloud config set project PROJECT_ID
```
  Replace PROJECT_ID with your Google Cloud project name.
Update gcloud components:
```
gcloud components update
```
Sign in using your account:
```
gcloud auth login
```
Verify that billing is enabled for your Google Cloud project.
Make sure that you have been granted the appropriate Identity and Access Management (IAM) permissions. For more information, see Access Control with IAM.
If you don't indicate the Google Cloud resource that you want to manage, the commands in this document default to the current project. For example, gcloud beta services list --enabled returns a list of enabled services for the current project.

You can retrieve the current project ID:
```
gcloud config list --format='text(core.project)'
```

List services

You can list the Google APIs and services that are enabled or available for a project, folder, or organization by using the gcloud beta services list command.

Service enablement and availability can be inherited from resource ancestors. A resource's enabled services include services that are enabled on the resource itself and enabled on all resource ancestors.

Project

gcloud beta services list --enabled \
    --project=PROJECT_ID

Replace PROJECT_ID with your Google Cloud project ID. Or, omit the flag to default to the current project.

Folder

gcloud beta services list --enabled \
    --folder=FOLDER_ID

Replace FOLDER_ID with your Google Cloud folder ID.

Organization

gcloud beta services list --enabled \
    --organization=ORGANIZATION_ID

Replace ORGANIZATION_ID with your Google Cloud organization resource ID.

Note the following:

You must specify one of the following flags:
- --available to list services that can be enabled for consumption.
- --enabled to list the services that are enabled for consumption.
You can use other flags to filter and limit the services listed.

Enable services

You can enable one or more services for a project, folder, or organization by using the gcloud beta services enable command.

This command updates the ConsumerPolicy at the target resource. For more information, see Manage consumer policies.

Project

gcloud beta services enable SERVICE \
    --project=PROJECT_ID

Replace the following:

SERVICE: the name of the service you want to enable. To enable multiple services, use space-delimited service names—for example, the following command enables both the API keys and BigQuery services: gcloud beta services enable apikeys.googleapis.com bigquery.googleapis.com.
PROJECT_ID: your Google Cloud project ID. Or, omit the flag to default to the current project.

Folder

gcloud beta services enable SERVICE \
    --folder=FOLDER_ID

Replace the following:

SERVICE: the name of the service you want to enable. To enable multiple services, use space-delimited service names—for example: gcloud beta services enable apikeys.googleapis.com bigquery.googleapis.com.
FOLDER_ID: your Google Cloud folder ID.

Organization

gcloud beta services enable SERVICE \
    --organization=ORGANIZATION_ID

Replace the following:

SERVICE: the name of the service you want to enable. To enable multiple services, use space-delimited service names—for example: gcloud beta services enable apikeys.googleapis.com bigquery.googleapis.com.
ORGANIZATION_ID: your Google Cloud organization resource ID.

Supported flags:

--async to return immediately, without waiting for the operation in progress to complete.
--skip-dependency to skip enabling any service dependencies. Otherwise, all service dependencies are enabled by default.

You can inspect service dependencies. For more information, see List service dependencies.
--validate-only to validate the enablement without actually performing the operation.

Note the following:

If you try to enable a service that is already enabled, you will receive an error stating that the service is already enabled and present in the consumer policy. (If the service is already enabled but its dependencies are not, the command will succeed.)
If you enable a service at the folder or organization level, the organization policy constraint constraints/serviceuser.services might not work as expected. We recommend that you use the Restrict Resource Service Usage constraint instead. For more information, see Restricting resource usage.
Google Cloud creates and manages service accounts for many Google Cloud services. These service accounts are known as service agents. If you encounter a service account not found error, you might need to create a service agent using the gcloud beta services identity create command.

Disable services

You can disable one or more services for a project, folder, or organization by using the gcloud beta services disable command.

This command updates the ConsumerPolicy at the target resource. For more information, see Manage consumer policies.

Project

gcloud beta services disable SERVICE \
    --project=PROJECT_ID

Replace the following:

SERVICE: the name of the service you want to disable. To disable multiple services, use space-delimited service names—for example: gcloud beta services disable apikeys.googleapis.com bigquery.googleapis.com.
PROJECT_ID: your Google Cloud project ID. Or, omit the flag to default to the current project.

Folder

gcloud beta services disable SERVICE \
    --folder=FOLDER_ID

Replace the following:

SERVICE: the name of the service you want to disable. To disable multiple services, use space-delimited service names—for example: gcloud beta services disable apikeys.googleapis.com bigquery.googleapis.com.
FOLDER_ID: your Google Cloud folder ID.

Organization

gcloud beta services disable SERVICE \
    --organization=ORGANIZATION_ID

Replace the following:

SERVICE: the name of the service you want to disable. To disable multiple services, use space-delimited service names—for example: gcloud beta services disable apikeys.googleapis.com bigquery.googleapis.com.
ORGANIZATION_ID: your Google Cloud organization resource ID.

Supported flags:

--async to return immediately, without waiting for the operation in progress to complete.
--bypass-api-usage-check to bypass usage checks. Otherwise, the system returns an error if the service you want to disable was used in the last 30 days or enabled in the last 3 days.
You can specify one of the following flags:
- --bypass-dependency-service-check to bypass the check for dependencies; any enabled services that depend on the service you are disabling remain enabled.
- --disable-dependency-services to proceed with disabling the service and any enabled services that depend on the service you are disabling.
You can inspect service dependencies. For more information, see List service dependencies.
--force to proceed even if there are enabled services that depend on the service, or the service was used in the last 30 days, or enabled in the last 3 days. Any dependent services are also disabled.

The --bypass-api-usage-check, --bypass-dependency-service-check, and --disable-dependency-services flags all take precedence over the --force flag.

Using both the --disable-dependency-services and --bypass-api-usage-check flags is equivalent to using the --force flag. The service and its dependencies are disabled without checking their usage.
--validate-only to validate the disablement without actually performing the operation.

Examples

Enabling a service

Enabling BigQuery service without its dependencies:

gcloud beta services enable bigquery.googleapis.com --skip-dependency

Output:

Operation [operations/ucpat.p39-581601899707-73a57d57-aa46-4d0b-a5ee-57034a42f2b3] complete. Result: {
      "@type":"type.googleapis.com/google.api.serviceusage.with Hierarchical Service Activationbeta.ConsumerPolicy",
      "createTime":"2025-01-31T20:17:37.272343Z",
      "enableRules":[
          {
              "services":[
                  "services/apikeys.googleapis.com",
                  "services/compute.googleapis.com",
                  "services/oslogin.googleapis.com",
                  "services/serviceusage.googleapis.com",
                  "services/bigquery.googleapis.com"
              ]
          }
      ],
      "etag":"W/\"W9nsVJK0V1m7ee7tM7pFDg==\"",
      "name":"projects/PROJECT_ID/consumerPolicies/default",
      "updateTime":"2025-09-11T23:05:22.758394Z"
  }

Enabling BigQuery service with its dependencies:

gcloud beta services enable bigquery.googleapis.com

Output:

Operation [operations/ucpat.p39-581601899707-73192b0f-053c-46ee-911a-7eca6b8fe899] complete. Result: {
      "@type":"type.googleapis.com/google.api.serviceusage.with Hierarchical Service Activationbeta.ConsumerPolicy",
      "createTime":"2025-01-31T20:17:37.272343Z",
      "enableRules":[
          {
              "services":[
                  "services/apikeys.googleapis.com",
                  "services/compute.googleapis.com",
                  "services/oslogin.googleapis.com",
                  "services/serviceusage.googleapis.com",
                  "services/cloudresourcemanager.googleapis.com",
                  "services/dataplex.googleapis.com",
                  "services/bigquery.googleapis.com",
                  "services/bigquerystorage.googleapis.com",
                  "services/bigqueryconnection.googleapis.com",
                  "services/analyticshub.googleapis.com",
                  "services/bigquerymigration.googleapis.com",
                  "services/dataform.googleapis.com",
                  "services/bigquerydatapolicy.googleapis.com",
                  "services/bigquerydatatransfer.googleapis.com",
                  "services/bigqueryreservation.googleapis.com"
              ]
          }
      ],
      "etag":"W/\"FDXMAIdsBW7BrXjL7oP6FA==\"",
      "name":"projects/PROJECT_ID/consumerPolicies/default",
      "updateTime":"2025-09-12T19:44:23.675769Z"
  }

Disabling a service

Attempting to disable BigQuery service with active dependencies:

gcloud beta services disable bigquery.googleapis.com

Error message:

ERROR: (gcloud.beta.services.disable) The services are depended on by the following active service(s) {"bigquery.googleapis.com": ["services/bigquerystorage.googleapis.com"]} . Please remove the active dependent services or provide the --disable-dependency-services flag to disable them, or --bypass-dependency-service-check to ignore this check.

Attempting to disable BigQuery service with recent usage:

gcloud beta services disable bigquery.googleapis.com --disable-dependency-services

Error message:

ERROR: (gcloud.beta.services.disable) The operation "operations/ucpat.p39-581601899707-d35c2e2b-d2a3-47af-a1c0-033ed65df236" resulted in a failure "The services bigquery.googleapis.com,bigquerystorage.googleapis.com have usage in the last 30 days or were enabled in the past 3 days. Please specify force if you want to proceed with the destructive policy change.

Disabling BigQuery service and its dependencies and bypassing the usage check:

gcloud beta services disable bigquery.googleapis.com --disable-dependency-services --bypass-api-usage-check

Output:

Operation [operations/ucpat.p39-581601899707-5c02aa04-7ad7-4eb6-a6a1-dc68653bcdb4] complete. Result: {
    "@type":"type.googleapis.com/google.api.serviceusage.v2beta.ConsumerPolicy",
    "createTime":"2025-01-31T20:17:37.272343Z",
    "enableRules":[
        {
            "services":[
                "services/analyticshub.googleapis.com",
                "services/apikeys.googleapis.com",
                "services/bigqueryconnection.googleapis.com",
                "services/bigquerydatapolicy.googleapis.com",
                "services/bigquerydatatransfer.googleapis.com",
                "services/bigquerymigration.googleapis.com",
                "services/bigqueryreservation.googleapis.com",
                "services/cloudresourcemanager.googleapis.com",
                "services/compute.googleapis.com",
                "services/dataform.googleapis.com",
                "services/dataplex.googleapis.com",
                "services/oslogin.googleapis.com",
                "services/serviceusage.googleapis.com"
            ]
        }
    ],
    "etag":"W/\"TqbPaELDHlZQOj7As1P06g==\"",
    "name":"projects/PROJECT_ID/consumerPolicies/default",
    "updateTime":"2025-09-30T21:39:40.746125Z"
}

What's next

To manage policies, see Manage consumer policies.
To inspect service dependencies, see List service dependencies.

Manage service enablement

Before you begin

Cloud Shell

Local shell

List services

Project

Folder

Organization

Enable services

Project

Folder

Organization

Disable services

Project

Folder

Organization

Examples

Enabling a service

Disabling a service

What's next