Cloud Guardian

Infrastructure cost protection for GCP and AWS

Cloud costs under control.

Find cloud waste, review proposed fixes, and follow the cost evidence. One workflow for your infrastructure and Terraform changes.

Start a free cloud scan See how it works
A layered cloud contour surrounding connected infrastructure, the Cloud Guardian protected topology illustration.

Works with your stack

  • Google Cloud
  • Amazon Web Services
  • Terraform
  • GitHub

A clear path from finding to evidence

Four steps. One reviewable workflow.

  1. Scan

    Connect GCP or AWS and build a view of your services, resources, and configuration.

  2. Detect

    Identify idle services, over-provisioning, stale images, and cost anomalies with configurable checks.

  3. Fix

    Review the proposed change and estimated opportunity. Apply through a Terraform pull request or supported API action.

  4. Verify

    Re-scan to check the configuration change, then follow cost evidence across subsequent billing windows.

Resource types scanned
15
Cloud providers
2
Built-in cost checks
81
Free during beta
$0

Reviewable infrastructure changes

Connect each finding to a proposed fix and the evidence behind it.

Find the waste that matters

Inspect idle services, over-provisioned instances, unused functions, and stale registry images across GCP and AWS.

Keep changes reviewable

Review proposed Terraform diffs in GitHub pull requests. Your team inspects and approves each infrastructure change before applying it.

Follow the result

Confirm configuration changes, then follow cost and utilization data over subsequent scans. Keep estimated opportunities distinct from measured outcomes.

Developer tools

Your tools. The same cloud context.

The same infrastructure context and review workflow, available alongside your code.

Install the CLI

curl -fsSL https://cloudguard.dev/install.sh | bash
View all install options

MCP integration

Connect an AI assistant to query infrastructure, inspect cost evidence, and investigate a specific project in context.

Read the MCP guide

Quality gates

Track test coverage, lint violations, and code complexity across TypeScript, Go, and Python with cloudguard quality scan.

Explore quality scanning
Inspect an example scan
Example scan outputIllustrative data
$ cloudguard scan --org example-org

  GCP   Cloud Run          14 services scanned
        Compute Engine      8 instances scanned
        Cloud SQL           3 databases scanned
  AWS   Lambda             23 functions scanned
        EC2                 6 instances scanned
        RDS                 4 databases scanned

  DETECT  api-gateway: cpu_idle=false, min=2
  DETECT  dev-worker: stopped EC2 with attached EBS
  FIX     4 remediation plans ready for review
          Estimated opportunity: USD 312.80 / month
  VERIFY  Configuration re-scan complete
          Billing comparison pending

Compare cloud costs

See how your server costs compare across 7 cloud providers. Adjust specs to find your cheapest option.

4
183264
8 GB
1GB16GB128GB256GB
100GB
25GB200GB1TB2TB

Estimated monthly price in USD. Compare instance specifications and provider billing before choosing a plan.

HetznerHetzner
cx32
$9.20/mo
2
VultrVultr
vc2-4c-8gb
$40.00/mo
3
DigitalOceanDigitalOcean
s-4vcpu-8gb
$48.00/mo
4
LinodeLinode
g6-standard-4
$48.00/mo
5
AWSAWS
t4g.xlarge
$106.11/mo
6
Google CloudGoogle Cloud
e2-standard-4
$114.84/mo
7
Microsoft AzureAzure
F4s v2
$136.57/mo

Choosing Hetzner over Azure has an estimated price difference of $1,528.46/yr

Full Calculator

Frequently asked questions

What cloud services does Cloud Guardian monitor?

Cloud Guardian monitors 15 resource types across GCP and AWS. On GCP: Cloud Run, Compute Engine, Cloud SQL, Cloud Storage, Cloud Functions, GKE, BigQuery, Secret Manager, Artifact Registry, Cloud Logging. On AWS: Lambda, EC2, RDS, ECS, S3. It detects idle services, over-provisioning, excessive storage, stale images, and cost anomalies using native cloud metrics.

How does automated remediation work?

When Cloud Guardian detects a violation — like a Cloud Run service with cpu_idle=false — it generates a proposed fix. Depending on the configured workflow, it can create a GitHub pull request with Terraform changes for review or apply a supported API action. A later scan checks whether the configuration changed; cost verification is a separate evidence step.

Is Cloud Guardian free?

Yes, Cloud Guardian is free to get started. Connect your GCP or AWS account, run your first scan, and start seeing optimization recommendations immediately. There are no upfront costs or commitments required.

How are infrastructure fixes applied?

Cloud Guardian supports two modes: direct API execution for immediate fixes (like scaling down idle services) and PR-based remediation for Terraform-managed infrastructure. PR mode generates precise Terraform diffs — for example, setting cpu_idle = true or min_instance_count = 0 — that your team can review before merging.

How does cost verification work?

After a remediation is applied, Cloud Guardian re-scans the affected project to check that the configuration change took effect. It then compares cost estimates or comparable billing evidence, when available, across subsequent observation windows. The interface keeps estimated opportunity, configuration confirmation, and measured cost reduction distinct. Cost verification remains pending until suitable evidence is available; a completed fix does not guarantee a lower invoice.

What IAM permissions does Cloud Guardian need?

For GCP, Cloud Guardian requires read-only access via roles/viewer, roles/run.viewer, and roles/secretmanager.viewer through a dedicated service account. For AWS, it uses IAM credentials with read-only access to the services being scanned. For automated remediation, additional write permissions are needed on the specific services being optimized.

Know where your cloud spend goes.

Connect a provider, run your first scan, and review your infrastructure with the evidence in front of you.

Get started free