Cloud Guardian
Documentation menu

Cloud Guardian Documentation

Cloud Guardian is an automated cost optimization platform for Google Cloud Platform. It scans your infrastructure, detects waste, generates Terraform PR fixes, and verifies savings — a closed-loop scan → detect → fix → verify cycle.

What Cloud Guardian Does

  • Scans Cloud Run, Compute Engine, Cloud SQL, Secret Manager, and Artifact Registry
  • Detects cost violations using configurable checks and CEL-based guardian rules
  • Fixes issues via direct GCP API calls or Terraform pull requests
  • Verifies savings by re-scanning after remediation

Quick Links

GuideDescription
Quick StartConnect your first GCP project in 5 minutes
GCP SetupService account creation and IAM roles
ArchitectureSystem design and component overview
API ExplorerInteractive API reference
MCP IntegrationClaude Code integration via MCP tools

Supported Resource Types

ResourceChecksCost Estimation
Cloud Runcpu_idle, min_instances, preview cleanupPer-service with metrics
Compute EngineIdle instances, GPU unused, overprovisionedMachine type pricing
Cloud SQLNo HA, overprovisioned, excessive storageTier + storage pricing
Secret ManagerExcessive versionsPer-version pricing
Artifact RegistryExcessive versions, large repos, stale imagesStorage pricing

How Scanning Works

  1. Build targets — Merge static projects + connected connectors
  2. Resolve credentials — Decrypt stored service account keys via KMS
  3. Parallel scan — Scan up to 5 projects concurrently (configurable)
  4. Evaluate checks — Run built-in checks + CEL guardian rules
  5. Record snapshots — Persist cost data for trend analysis
  6. Generate alerts — Evaluate cost alert rules per org
  7. Auto-remediate — Plan and execute fixes for configured scopes
  8. Verify savings — Re-scan affected resources after remediation