Forem: Kamil Kujawiński

Monitor Google Cloud Platform Costs on Your iPhone and Apple Watch

Kamil Kujawiński — Mon, 23 Mar 2026 18:51:37 +0000

Keep an eye on your GCP costs right from your wrist. Don't let autoscaling silently run up your bill — stay informed with a quick glance at your iPhone or Apple Watch.

Here's the plan:

Configure GCP billing export to a BigQuery table
Create an n8n workflow that queries BigQuery for cost data
Set up a widget in API Widgets to display the results

Configure GCP Billing Export to BigQuery

1. Enable the BigQuery API in GCP

2. Enable billing export to BigQuery

3. Create a service account for BigQuery access

gcloud iam service-accounts create n8n-bigquery-reader \
  --display-name="n8n BigQuery Reader" \
  --project=YOUR_PROJECT_ID

4. Assign minimal permissions

The service account needs just two roles:

bigquery.jobUser — allows running queries
bigquery.dataViewer — allows reading tables and views (read-only)

# Allow running queries and reading results
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:n8n-bigquery-reader@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/bigquery.jobUser"

# Allow reading data from datasets and tables
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:n8n-bigquery-reader@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/bigquery.dataViewer"

5. Generate a service account key for n8n

gcloud iam service-accounts keys create n8n-bigquery-key.json \
  --iam-account=n8n-bigquery-reader@YOUR_PROJECT_ID.iam.gserviceaccount.com

This generates a n8n-bigquery-key.json file containing the service account credentials. You'll use this file to authenticate the BigQuery node in n8n.

Set Up the n8n Workflow

The workflow exposes a webhook endpoint that API Widgets can call. When triggered, it queries BigQuery for your billing data, groups costs by date and service, and returns the results as JSON.

The workflow consists of five nodes:

Webhook — listens for incoming requests (accepts an optional days query parameter, defaults to 14)
Configure variables — sets the BigQuery table name and the number of days to query
Execute BigQuery — runs a SQL query that aggregates daily costs by service
Format data — transforms the results into a structured JSON response with daily totals and per-service breakdowns
Respond to Webhook — sends the formatted data back to the caller

You can import the workflow into your n8n instance using the JSON file: GCP Billing costs.json. Make sure to update the table_name variable in the "Configure variables" node to match your BigQuery billing export table.

Configure API Widgets

1. Download API Widgets from the App Store.

2. Create a new widget and configure the API endpoint in the Source tab, pointing it to your n8n webhook URL.

3. Set up the visualization in the Design tab.

4. Add a home screen widget and link it to the one you just created.

The widget also works on Apple Watch — view your costs at a glance from your wrist:

Using Cloudflare SSL with Elastic Beanstalk instances

Kamil Kujawiński — Sat, 04 Jan 2025 16:06:04 +0000

Motivation:

To obtain a free SSL certificate (by Let's Encrypt) for your web application without the hassle of renewing it every three months, consider the following approach.

The simplest solution is to use a Load Balancer and attach an SSL certificate from AWS Certificate Manager (ACM) to it. However, relying on a Load Balancer solely for HTTPS may be costly. To address this, I’ve outlined a much more affordable alternative that requires a bit of configuration.

Additionally, in this post, I explain how to configure SSL for an Elastic Beanstalk instance, as I found the existing documentation and available resources to be somewhat outdated.

Keyword of the solution is Cloudflare.

Cloudflare offers a proxy feature that enables you to set up a free SSL certificate while securely proxying traffic to your host.

In Flexible mode, the communication between Cloudflare and AWS is not encrypted. If you prefer end-to-end encryption, you can opt for Full mode instead.

Steps

1. Add your domain to Cloudflare.

In the DNS settings, configure your domain as proxied.
In the SSL/TLS settings, select Full (strict) mode for end-to-end encryption.

2. Generate an Origin Certificate in Cloudflare

Go to the SSL/TLS > Origin Server section in Cloudflare.
Generate a certificate valid for up to 15 years.
Use this certificate to configure SSL in AWS Elastic Beanstalk.

3. Store Certificates in AWS Secrets Manager:

Save the server.crt and server.key files as secrets in AWS Secrets Manager.
Use the following secret names: /app/ssl/server-crt and /app/ssl/server-key

4. Grant IAM Role Access to Secrets:

In AWS IAM add a new policy named ReadSSLSecretKeys for the role aws-elasticbeanstalk-ec2-role with the following permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ssm:GetParameter",
      "Resource": "arn:aws:ssm:region:account_id:parameter/app/ssl/server-crt"
    },
    {
      "Effect": "Allow",
      "Action": "ssm:GetParameter",
      "Resource": "arn:aws:ssm:region:account_id:parameter/app/ssl/server-key"
    }
  ]
}

5. Configure your Elastic Beanstalk deployment to listen on port `443` and use the Origin Certificate generated in Cloudflare (stored in AWS Secrets Manager) do changes in the following files:

.ebextensions/01_https-instance-securitygroup.config

Resources:
  sslSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: {"Fn::GetAtt" : ["AWSEBSecurityGroup", "GroupId"]}
      IpProtocol: tcp
      ToPort: 443
      FromPort: 443
      CidrIp: 0.0.0.0/0

.ebextensions/02_https-instance.config

files:
  /etc/pki/tls/certs/server.crt:
    mode: "000400"
    owner: root
    group: root
    content: |
      -----BEGIN CERTIFICATE-----
      certificate file contents
      -----END CERTIFICATE-----

  /etc/pki/tls/certs/server.key:
    mode: "000400"
    owner: root
    group: root
    content: |
      -----BEGIN RSA PRIVATE KEY-----
      private key contents # See note below.
      -----END RSA PRIVATE KEY-----

container_commands:
  01_fetch_server_crt:
    command: |
      aws ssm get-parameter --name "/app/ssl/server-crt" --with-decryption --query "Parameter.Value" --output text > /etc/pki/tls/certs/server.crt
  02_fetch_server_key:
    command: |
      aws ssm get-parameter --name "/app/ssl/server-key" --with-decryption --query "Parameter.Value" --output text > /etc/pki/tls/certs/server.key

.platform/nginx/conf.d/https.conf

server {
    listen 443 ssl;

    ssl_certificate /etc/pki/tls/certs/server.crt;
    ssl_certificate_key /etc/pki/tls/certs/server.key;

    ssl_session_timeout 5m;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;

    location / {
      proxy_pass http://127.0.0.1:8000;
      proxy_http_version 1.1;

      proxy_set_header Connection "";
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto https;
    }
}