Google Cloud Platform · 209 checks
Compute Engine to BigQuery, swept in one read-only pass.
GCP waste hides in persistent disks left by deleted VMs, idle Cloud SQL instances, BigQuery slot reservations nobody uses, and service-account keys that never expire.
InfraSweep reads Compute Engine, Cloud SQL, GKE, Cloud Storage, BigQuery, Pub/Sub, Spanner/Bigtable, networking, IAM, and KMS, blending cost right-sizing with CIS-aligned posture checks in a single Viewer-only scan.
CIS
User-managed service account keys that never expire, OS Login disabled, and GKE hardening gaps, mapped to CIS benchmarks.
allUsers
Cloud Storage buckets readable by allUsers and firewall rules open to 0.0.0.0/0, surfaced in the same scan as the savings.
Pure waste
Idle Cloud SQL, unattached persistent disks, and unused BigQuery slot reservations: spend you can reclaim.
What we scan on GCP
66 security checksA representative sample of the 209 GCP checks, grouped by service domain. Cost waste and security risk are surfaced in the same read-only pass.
Compute & GKE
Compute Engine, MIGs, GKE, Vertex AI, Cloud Run.Idle & oversized Compute Engine VMs
Right-size candidates from real monitoring metrics.
Vertex AI notebooks running 24/7
ML notebooks left on around the clock for office-hours work.
GKE right-sizing & posture
Node pools larger than demand; CIS hardening gaps.
Zombie disks on stopped VMs
Stopped instances whose disks keep billing every month.
Data & storage
Cloud SQL, Memorystore, BigQuery, Cloud Storage, Spanner.Idle Cloud SQL & Memorystore
Databases and caches with no meaningful load, billing 24/7.
BigQuery idle slot reservations
Reserved slots sitting unused while you pay for them.
Unattached persistent disks
Disks orphaned by deleted Compute Engine instances.
Cloud Storage lifecycle gaps
Cold data on hot-tier pricing with no transition policy.
Network & governance
Load balancers, static IPs, Cloud NAT, Pub/Sub, monitoring.Unused static IPs & forwarding rules
Reserved network resources pointing at nothing.
Idle backend services & CDN
Load-balancing plumbing with no traffic.
Region price arbitrage & off-hours
Structural levers across the whole project.
Monitoring hygiene
Alert policies, uptime checks, and channels nobody uses.
Security & CIS
IAM, service accounts, KMS, firewalls, buckets.Firewall rules open to 0.0.0.0/0
VPC ingress from every IP on earth.
Public Cloud Storage buckets
Buckets readable by allUsers.
User-managed service account keys
Downloaded SA keys that never expire (CIS).
KMS rotation & OS Login gaps
Keys that never roll; SSH outside centralized IAM.
How you connect
A Viewer service account
Create a service account with roles/viewer and upload its key in the dashboard; the key is encrypted at rest and never shown again.
How the dollars are calculated
Live Compute Engine pricing assembled from the Cloud Billing Catalog API (with a billing API key), curated baseline otherwise.
Every finding is backed by the raw cloud API response it came from, with a confidence score and the pricing source labelled, no black-box numbers.
Scan your GCP estate free
Connect a viewer service account and run a read-only scan. Findings come priced in real dollars with a fix and the evidence for each.
Start scanning free