Compute Engine to BigQuery, swept in one read-only pass.

Every check we run on GCP

All 209 checks, generated directly from the scanner so this list matches what actually runs. Search for a service to see whether your stack is covered.

No GCP check matches that. It may be covered on another cloud, or it may be something we do not scan yet. Ask us about it .

• Commitment opt-in

  Committed-use discount purchase (GCP Recommender)

  GCP's committed-use-discount purchase recommendations. Steady-state spend that would be cheaper under a 1- or 3-year commitment. No native nuvozy equivalent.

• Commitment opt-in

  Committed-use discount under-utilized

  Committed-use-discount commitment fees in the billing export that exceed the discount credit actually being applied. You are paying for commitment you are not consuming.

• Commitment opt-in

  Compute spend not covered by a committed-use discount

  Compute Engine spend in the billing export that is running at on-demand / sustained-use rates with little or no committed-use discount applied. Steady workloads are cheaper under a CUD.

• Commitment opt-in

  Sustained-use workloads cheaper under a committed-use discount

  Workloads earning only the automatic sustained-use discount (SUD, max ~30%) in the billing export that run steadily enough to be cheaper under a committed-use discount (CUD, ~37-55%).

• Compute

  Dataproc clusters without preemptible workers

  RUNNING Dataproc clusters whose worker fleet has no preemptible/spot secondary workers. Batch-style workloads can typically shift a large share of workers to spot for 60-91% savings on those VMs.

• Compute

  Empty GKE clusters

  Running GKE Standard clusters with zero nodes. The management fee bills hourly even with no workloads.

• Compute

  Empty sole-tenant nodes

  Sole-tenant node-group hosts with zero scheduled VM instances. An empty dedicated host still bills its full node rate (thousands of dollars per month).

• Compute uses metrics

  Forgotten Cloud Functions

  Active Cloud Functions with zero invocations over the lookback window. Stale deployed code keeps its IAM grants and (with min-instances) can still bill.

• Compute

  GKE node pools on N1 machines

  GKE node pools on legacy N1 machine types. E2 offers the same vCPU/RAM shapes at a lower list price.

• Compute uses metrics

  Idle Cloud Run min-instances

  Cloud Run services with min-instances > 0 but zero requests over the lookback window. Paying the idle-instance rate 24/7 for capacity nothing uses.

• Compute uses metrics

  Idle Cloud Run services

  Cloud Run services with zero requests over the lookback window. Scale-to-zero idle services bill nothing but remain deployed attack surface and IaC drift.

• Compute uses metrics

  Idle Composer environments (no DAG runs)

  RUNNING Cloud Composer environments whose finished-task throughput stays at the built-in liveness-DAG floor over the lookback window - no real DAGs run, yet the environment bills its ~$350+/month floor 24/7.

• Compute uses metrics

  Idle Dataproc clusters (no YARN activity)

  RUNNING Dataproc clusters whose YARN allocated-memory percentage averages under 1% over the lookback window. No jobs are using the cluster, but the worker fleet keeps billing 24/7.

• Compute opt-in

  Idle VM (GCP Recommender)

  Compute Engine instances GCP's Recommender flags as idle.

• Compute

  Long-running non-prod Dataproc clusters

  Dataproc clusters in dev/test/staging (name/label inference) RUNNING for 7+ days. Dataproc is built for ephemeral job-scoped clusters - long-lived non-prod clusters burn compute 24/7.

• Compute

  Non-prod App Engine flex services running 24/7

  App Engine flexible-environment versions serving traffic in dev/test/staging services. Flex instances never scale to zero, so non-prod versions bill vCPU + RAM around the clock.

• Compute

  Non-prod Composer environments running 24/7

  Cloud Composer environments in dev/test/staging (name/label inference). Composer never scales to zero - a small environment is ~$350/month even fully idle.

• Compute

  Non-prod VMs not using Spot

  Running non-prod VMs on the STANDARD provisioning model. Spot VMs are 60-91% cheaper and fine for interruptible dev/test workloads. Advisory - Spot VMs can be preempted at any time.

• Compute

  Non-prod VMs without instance schedules

  Running non-prod VMs with no resource policy attached (instance schedules attach as resource policies). An off-hours stop/start schedule saves ~62% on working-hours-only workloads.

• Compute

  Notebook instances running 24/7

  Vertex AI Workbench / user-managed notebook instances ACTIVE for 7+ days. Dev notebooks (often GPU-attached) bill around the clock but are typically used a few hours a day.

• Compute uses metrics

  Oversized VMs (low CPU)

  Running VMs averaging < 5% CPU (max < 30%) over the lookback window, with a one-step-smaller machine type available.

• Compute uses metrics

  Persistently failing Cloud Functions

  Gen1 Cloud Functions where over half of executions in the lookback ended non-ok (100+ failures). Failed executions still bill, and event retries can multiply the waste.

• Compute

  Stale non-prod Dataflow streaming jobs

  Streaming Dataflow jobs in dev/test/staging (name/label inference) running for 30+ days. Streaming jobs bill workers 24/7 until cancelled.

• Compute

  Stopped VMs with billing disks

  Compute Engine VMs TERMINATED for 14+ days. Stopped VMs are free but their persistent disks keep billing every month.

• Compute

  Unused compute reservations

  Compute Engine reservations with reserved slots nothing consumes. Reserved capacity bills at full on-demand price whether instances run or not.

• Compute opt-in

  VM machine-type rightsizing (GCP Recommender)

  Compute Engine instances GCP's Recommender flags for a smaller machine type, using its ML model (CPU + memory). No native nuvozy equivalent for the memory dimension.

• Compute

  Zero-traffic App Engine versions still serving

  App Engine versions with a 0% traffic split but still SERVING. Manual-scaling versions keep paying for their instances; the rest are stale deploys waiting to be cleaned up.

• Compute

  Zombie Dataflow batch jobs

  Batch Dataflow jobs in RUNNING state for 7+ days. Batch jobs should finish; a week-old runner is almost always stuck and billing workers the whole time.

• Cost

  Cloud Run warm min-instance baseline

  Cloud Run service keeping min-instances > 0 alongside high CPU / memory limits, an always-on warm baseline that bills 24/7 regardless of traffic. Pairs with the metric-driven idle check.

• Cost

  GKE node pool without autoscaling

  Standard-cluster node pool with cluster autoscaler disabled, so idle nodes never scale down and capacity must be sized for peak. Node-pool size is not exposed by the free API, so savings are $0.

• Cost

  Non-prod Redis on STANDARD_HA

  Non-prod-labeled Memorystore Redis instance running the STANDARD_HA tier (with a replica), roughly doubling cost versus the BASIC tier for data that rarely needs HA.

• Cost

  Non-prod Spanner under one full node

  Spanner instance below one full node (1000 processing units) on a non-prod instance, where the minimal 100-PU allocation or the free trial would suffice. Flags over-allocation for review.

• Cost

  Non-prod bucket on dual/multi-region

  Non-prod-labeled bucket on a dual-region or multi-region location, paying premium replicated-storage rates for data that rarely needs cross-region durability. Bucket size is invisible via free APIs.

• Database opt-in

  BigQuery on-demand spend vs flat-rate breakeven

  BigQuery on-demand (per-TB-scanned) analysis spend in the billing export that is high enough to be cheaper under flat-rate / Editions slot commitments.

• Database

  BigQuery reservations with no assignments

  BigQuery slot reservations that have zero assignments. Baseline slots bill 24/7 whether or not any project is assigned - an unassigned reservation is pure spend.

• Database uses metrics

  Costly Pub/Sub backlog retention

  Pub/Sub subscriptions holding more than 1 GiB of unacked backlog (daily-mean backlog_bytes). Retained messages bill at the message-storage rate until they are acked or age out of the retention window.

• Database

  HA Cloud SQL in non-prod

  Non-prod Cloud SQL instances with REGIONAL (HA) availability. The standby replica roughly doubles compute + storage cost - dev/test rarely needs a 99.95% SLA.

• Database uses metrics

  Idle BigQuery BI Engine reservations

  BigQuery BI Engine reservations holding RAM capacity whose used-bytes metric averages under 2% of the reservation over the lookback window. Reserved BI Engine RAM bills per GiB-hour even when no query is accelerated.

• Database uses metrics

  Idle Bigtable clusters

  Bigtable clusters averaging under 15% CPU with 2+ nodes. Halving the node count keeps ample headroom; each node is ~$475/month.

• Database opt-in

  Idle Cloud SQL (GCP Recommender)

  Cloud SQL instances GCP's Recommender flags as idle.

• Database uses metrics

  Idle Cloud SQL instances

  Cloud SQL instances averaging < 1 connection over 14+ days. Idle databases bill 24/7 unless stopped.

• Database uses metrics

  Idle Cloud SQL read replicas

  Read replicas averaging under 1 client connection over the lookback window. A replica bills the same compute as a primary whether or not anything reads from it.

• Database uses metrics

  Idle Memcached instances

  Memorystore Memcached instances whose nodes average under 5% CPU over the lookback window. The provisioned node count bills hourly regardless of cache traffic - a near-idle cache is wasted spend.

• Database uses metrics

  Idle Memorystore Redis

  Memorystore Redis instances averaging < 1 connected client over 14+ days. Provisioned capacity bills hourly regardless.

• Database

  Multi-region Spanner in non-prod

  Non-production Spanner instances (name/label inference) on multi-region configs, which cost 3x+ the regional node price. Regional configs suffice off-prod.

• Database

  Non-prod Cloud SQL running 24/7

  Non-prod Cloud SQL instances RUNNABLE with the ALWAYS activation policy. Dev/test databases used during working hours can be stopped nightly for ~60% savings.

• Database

  Non-prod Memcached running 24/7

  Memorystore Memcached instances in dev/test/staging (name/label inference). Memcached nodes bill per hour whether or not anything reads the cache.

• Database uses metrics

  Overprovisioned Cloud SQL

  Cloud SQL instances with 4+ vCPUs averaging < 20% CPU (max < 50%) over 14+ days. Halving the tier halves the compute bill.

• Database opt-in

  Overprovisioned Cloud SQL (GCP Recommender)

  Cloud SQL instances GCP's Recommender flags as overprovisioned.

• Database uses metrics

  Overprovisioned Cloud SQL storage

  Cloud SQL instances using < 30% of a 100+ GB provisioned data disk (Cloud Monitoring bytes_used). Storage cannot shrink in place - savings apply when the instance is next migrated/recreated.

• Database uses metrics

  Overprovisioned Spanner instances

  Spanner instances averaging under 20% CPU with more than the minimum compute capacity. Halving node count / processing units keeps a 2x headroom margin.

• Governance

  Artifact Registry repos without immutable tags

  Standard Docker repositories with immutable tags disabled. A version tag can be repointed at different bytes after the fact, breaking provenance and reproducible deploys.

• Governance

  Attached disks without snapshot schedules

  In-use persistent disks with no resource policy attached (snapshot schedules attach as resource policies). No automated backups means manual-only recovery.

• Governance

  Backend services with no backends

  Backend services with zero configured backend groups. Traffic routed at them fails - they are dead config, often left behind after a MIG teardown.

• Governance

  Backup buckets without retention policy

  Buckets whose name suggests backups or archives but that have no retention policy - one bad script or compromised credential can delete the backups instantly.

• Governance

  BigQuery dataset without labels

  BigQuery dataset carrying no labels, blocking cost attribution and ownership tracking. Off by default - governance summary.

• Governance

  BigQuery slot commitments expiring soon

  BigQuery capacity commitments whose end date is within 60 days. Expiry without a renewal plan silently flips slot spend to on-demand or drops reserved capacity - decide before it lapses.

• Governance

  Bucket soft-delete disabled

  Cloud Storage bucket with soft-delete retention set to zero, so there is no recovery window for accidentally deleted or overwritten objects. Off by default - intentional on some buckets.

• Governance

  Bucket without retention policy

  Cloud Storage bucket with no retention policy (object lock) configured. Audit / compliance data buckets benefit from a retention policy for tamper-evidence. Off by default - noisy.

• Governance

  Buckets without access logging

  Buckets without usage logging configured. Data Access audit logs can substitute - absence of both leaves object reads unaudited. Noisy by design - off by default.

• Governance

  Buckets without versioning

  Buckets without object versioning. Deleted or overwritten objects are unrecoverable. Noisy by design - off by default.

• Governance

  Cloud Function without labels

  Cloud Function with no labels for cost attribution or ownership. Off by default - governance summary.

• Governance

  Cloud Run service without labels

  Cloud Run service with no labels for cost attribution or ownership. Off by default - governance summary.

• Governance

  Cloud SQL backups disabled

  Primary Cloud SQL instances with automated backups disabled. No backups means no point-in-time recovery and no restore path.

• Governance

  Cloud SQL instances without deletion protection

  Runnable Cloud SQL primary instances with deletion protection disabled. A single errant delete call destroys the instance and its automated backups.

• Governance

  Cloud SQL on old engine versions

  Cloud SQL instances on community-EOL major versions (MySQL 5.x, PostgreSQL <= 13, SQL Server 2017). Extended support adds per-vCPU surcharges and upgrades only get harder.

• Governance

  Committed-use discounts expiring soon

  Active Compute Engine committed-use discounts that end within 60 days without auto-renew. Expiry silently reprices covered usage at on-demand rates.

• Governance

  Composer environments on Airflow 1.x

  Cloud Composer environments whose image runs Airflow 1.x. Airflow 1 and Composer 1 are past end of support - no security patches, and provider packages no longer ship 1.x builds.

• Governance opt-in

  Data Access audit gap (audit-verified)

  Data-holding services in active use that emit no Data Access audit logs. Reads of user data go unrecorded (audit blind spots).

• Governance

  Data Access audit logs not configured

  Project IAM policy has no auditConfigs - Data Access audit logs (who read what) are off for every service (CIS 2.1).

• Governance

  Dataproc clusters without autoscaling

  RUNNING Dataproc clusters with no autoscaling policy. Fixed-size clusters are sized for peak and waste capacity between jobs.

• Governance

  Default network present

  The auto-created 'default' network still exists. It ships with permissive same-network firewall rules and subnets in every region (CIS 3.1).

• Governance

  Disabled firewall rules

  VPC firewall rules in the DISABLED state. Disabled rules do nothing but make the effective policy harder to read - and one accidental re-enable away from surprises.

• Governance

  Empty managed instance groups

  Managed instance groups with target size 0 that are 30+ days old. Empty MIGs cost nothing but signal abandoned infrastructure (and their load-balancer plumbing often still bills).

• Governance

  Essential Contacts not configured

  The project has no Essential Contacts. Google routes security incidents, abuse/suspension warnings, and billing notices to these contacts - without them, critical notices can land in a departed owner's inbox.

• Governance

  Failing Cloud Scheduler jobs

  Enabled Cloud Scheduler jobs whose most recent attempt returned a non-OK status. Broken crons silently stop doing whatever they were built for (backups, cleanups, report runs).

• Governance uses metrics

  Failing uptime checks

  Uptime checks whose pass fraction over the last 7 days is below 50%. Either the endpoint is down and nobody reacted, or the check is stale and trains everyone to ignore alerts.

• Governance

  Filestore instances without backups

  READY Filestore instances with no backups at all. NFS shares tend to accumulate one-of-a-kind data; a deleted instance is unrecoverable without a backup.

• Governance

  Firewall rules targeting no instances

  Enabled firewall rules whose target tags are carried by zero instances. The rule does nothing today, but starts applying the moment someone reuses the tag.

• Governance

  Firewall rules without logging

  Enabled VPC firewall rules without Firewall Rules Logging. Without it there is no record of what each rule admits or blocks. Noisy by design - off by default.

• Governance

  GKE cluster without release channel

  Clusters not enrolled in a release channel run static versions with manual upgrade burden and a higher chance of falling out of support.

• Governance

  GKE clusters without a maintenance window

  Running GKE clusters with no maintenance window configured. Control-plane and node upgrades can then land at any hour, including peak traffic.

• Governance

  GKE cost allocation off

  Standard GKE clusters without cost allocation enabled - namespace/label-level cost breakdown never reaches the billing export, making chargeback impossible.

• Governance

  GKE logging/monitoring off

  Standard GKE clusters with Cloud Logging or Cloud Monitoring components disabled - no system logs or metrics reach Google Cloud Observability (CIS GKE 5.7.1).

• Governance

  GKE node auto-upgrade disabled

  Node pools with auto-upgrade disabled. Nodes drift behind the control plane and miss security patches.

• Governance

  GKE node pool without auto-repair

  Node pool with node auto-repair disabled, leaving unhealthy nodes in service until manually remediated (GKE hardening guidance).

• Governance

  Gen1 Cloud Functions (migrate to gen2)

  Active 1st-gen Cloud Functions. Gen2 runs on Cloud Run with concurrency > 1, bigger instances, traffic splitting, and usually a lower bill for the same traffic.

• Governance

  Idle Cloud Tasks queues

  RUNNING Cloud Tasks queues with zero queued tasks and zero executions in the last minute. Queues are free, but dead queues hide which integrations are actually live.

• Governance uses metrics

  Idle Pub/Sub topics

  Pub/Sub topics with zero publish operations over the lookback window. Free by themselves, but dead pipelines hide real problems and keep IAM grants alive.

• Governance

  KMS key without labels

  Cloud KMS crypto key with no labels for ownership or rotation tracking. Off by default - governance summary.

• Governance

  KMS keys pending destruction

  Crypto keys whose primary version is in DESTROY_SCHEDULED state. After the scheduled date, everything encrypted under the version becomes permanently unrecoverable.

• Governance

  Label coverage report

  Aggregate report of how many instances, disks, buckets, Cloud SQL instances, and functions carry zero labels. Unlabeled resources break cost attribution and ownership tracking.

• Governance

  Legacy networks

  Legacy-mode networks (single global IPv4 range, no subnets). They cannot use subnet-level controls, flow logs, or private Google access (CIS 3.2).

• Governance

  Long log retention in non-prod

  Log buckets retaining logs for more than 30 days in a project whose ID looks non-prod. Retention beyond 30 days bills $0.01/GiB-month - usually pointless for dev logs. (_Required is fixed at 400 days and skipped.)

• Governance

  Non-prod BQ datasets without default expiration

  BigQuery datasets that look non-prod (name/label inference) with no default table expiration. Scratch and test tables accumulate storage cost forever.

• Governance

  Non-prod secret without expiry

  Non-prod-labeled secret with no expire_time or ttl set, so ephemeral test secrets accumulate indefinitely. Off by default.

• Governance

  Non-prod secrets with automatic replication

  Secrets that look non-production but use automatic replication (every Google Cloud region). Dev credentials rarely need global residency, and each replica location bills separately.

• Governance

  Orphaned health checks

  Health checks not referenced by any backend service or MIG auto-healing policy. Free, but they are leftover plumbing that obscures the live config.

• Governance opt-in

  Per-SKU week-over-week cost spike

  SKUs whose cost in the most recent ISO week jumped sharply versus the prior week in the billing export. Early warning for runaway spend (new resource, traffic surge, misconfiguration).

• Governance

  Prod VM on preemptible/spot provisioning

  Production-labeled VM running on the preemptible/spot provisioning model. Spot VMs can be reclaimed with 30s notice and do not auto-restart, risking unplanned termination of prod workloads.

• Governance

  Prod instances without deletion protection

  Running instances that look production (name/label inference) with deletion protection disabled - one fat-fingered delete away from an outage.

• Governance

  Project has no alert policies

  The project defines zero Cloud Monitoring alert policies - no outage, cost spike, or quota exhaustion will page anyone.

• Governance uses metrics

  Pub/Sub subscriptions with dead consumers

  Subscriptions whose oldest unacked message is older than 7 days (daily mean). The consumer is gone; the backlog bills retention storage until it expires.

• Governance

  Redis instance without labels

  Memorystore Redis instance with no labels for cost attribution or ownership. Off by default - governance summary.

• Governance

  Routes with dead next-hop instances

  Custom routes whose next-hop instance is TERMINATED or no longer exists. Traffic matching the route blackholes (or never leaves the default path), and the breakage is invisible until something needs it.

• Governance

  Secret with disabled-version sprawl

  Secret retaining several disabled-but-not-destroyed versions. Active (enabled or disabled) versions still incur active-version billing - destroy versions you no longer need.

• Governance

  Secrets with many enabled versions

  Secrets with 10 or more ENABLED versions. Every enabled version bills per replica location and remains accessible - old credentials should be disabled or destroyed after rotation.

• Governance

  Spanner instance without labels

  Spanner instance with no labels for cost attribution or ownership. Off by default - governance summary.

• Governance

  Spanner instances without backups

  READY Spanner instances that contain databases but have zero backups. Spanner is durable against zone loss, not against bad deploys or fat-fingered deletes.

• Governance

  Stale Pub/Sub snapshots

  Pub/Sub snapshots already past, or within 24 hours of, their hard 7-day expiry. Snapshots are short-lived replay tools - one nearing expiry was either forgotten or is about to fail a planned seek.

• Governance

  Subnets without Private Google Access

  VPC subnets with Private Google Access disabled. Internal-only VMs there need external IPs or Cloud NAT just to call Google APIs - more exposure and more NAT cost than necessary.

• Governance

  Subnets without VPC Flow Logs

  Subnetworks without VPC Flow Logs enabled. Flow logs are the primary network forensics source (CIS 3.8). Noisy by design - off by default.

• Governance

  Subscriptions on deleted topics

  Pub/Sub subscriptions whose topic was deleted. They can never receive another message. Pure leftovers, possibly still retaining backlog storage.

• Governance

  Unused instance templates

  Global instance templates that no managed instance group references. Templates are free but stale ones hide which configurations are actually live.

• Governance

  Unverified notification channels

  Enabled Cloud Monitoring notification channels whose verification is still pending. Alerts routed to an unverified channel are silently dropped.

• Governance opt-in

  Usage-priced API spend audit

  Spend on usage-priced ML / API services (Vision, Speech, Translate, Maps, Document AI, etc.) in the billing export. These have no provisioned resource to inspect, so the spend is otherwise invisible.

• Governance

  _Default log sink without exclusions

  The _Default logging sink has no exclusion filters - every log line every service emits is ingested and billed at $0.50/GiB past the free tier. Noisy debug/health-check logs usually dominate.

• Network

  Backend buckets without Cloud CDN

  Backend buckets (Cloud Storage fronted by an HTTP(S) load balancer) with Cloud CDN disabled. Enabling CDN caches static content at the edge, cutting origin egress and latency.

• Network

  Backend services with zero healthy instances

  Backend services that have configured backends but report zero healthy instances (capped getHealth probe). Traffic routed at them returns 502s - the service is mis-configured or its fleet is down.

• Network

  Cloud NAT with no instances

  Cloud NAT gateways in regions where their VPC has no instances. NAT bills per attached VM so the idle cost is near zero - these are teardown leftovers worth deleting (static NAT IPs do bill).

• Network

  Empty DNS zones

  Managed Cloud DNS zones containing only the automatic NS/SOA records. Each one bills $0.20/month and squats on the domain delegation.

• Network uses metrics

  HTTPS load balancers with no traffic

  External HTTP(S) forwarding rules with fewer than 100 requests over the entire lookback window (Cloud Monitoring request_count). The forwarding rule keeps billing hourly either way.

• Network opt-in

  Idle static IP (GCP Recommender)

  Reserved static IPs GCP's Recommender flags as idle.

• Network

  Orphaned LB forwarding rules

  Forwarding rules with no target or backend service. They cannot serve traffic but still bill the per-rule hourly charge.

• Network opt-in

  Top network-egress SKUs by cost

  Highest-cost network-egress SKUs (inter-region and internet egress) in the billing export. Often invisible and architecture-driven spend that no per-resource detector surfaces.

• Network

  Unused static IPs

  Reserved external static IPs not in use. GCP bills idle static IPs by the hour - small per-IP, big in aggregate.

• Network

  VPN gateways without tunnels

  VPN gateways (HA or classic) with zero tunnels attached. The gateway itself bills per tunnel so this costs nothing - it is a teardown leftover and config-drift signal.

• Network

  VPN tunnels down

  Cloud VPN tunnels in a non-ESTABLISHED state. A tunnel bills ~$0.05/hour whether or not it passes traffic - a dead tunnel is pure waste plus a likely connectivity incident.

• Security

  App Engine versions on EOL runtimes

  Serving App Engine versions built on end-of-life runtimes (python27, go111, java8, php55, ...). No security patches, and deploys to these runtimes are already blocked.

• Security

  Artifact Registry repo without CMEK

  Artifact Registry repository with no customer-managed encryption key configured. Off by default - many repositories accept Google-managed encryption.

• Security

  BigQuery dataset without default CMEK

  BigQuery dataset with no default customer-managed encryption key, so new tables fall back to Google-managed encryption. Off by default - many datasets accept Google-managed keys.

• Security

  Buckets without CMEK

  Buckets without a default customer-managed encryption key. Google-managed encryption still applies - informational inventory for CMEK-mandated environments.

• Security

  Buckets without PAP enforced

  Buckets whose public access prevention is not 'enforced'. A single mis-set IAM binding could expose them.

• Security

  Buckets without uniform access

  Buckets with uniform bucket-level access disabled. Per-object ACLs make access auditing unreliable.

• Security

  Cloud SQL with public IP

  Cloud SQL instances with a public IPv4 address. Critical when the authorized networks include 0.0.0.0/0.

• Security

  Cloud SQL without enforced SSL

  Cloud SQL instances that accept unencrypted connections. Highest risk when combined with a public IP.

• Security

  DNSSEC disabled on public zones

  Public Cloud DNS zones without DNSSEC. Unsigned zones are spoofable via cache poisoning; enabling DNSSEC is free.

• Security opt-in

  Dead firewall rule (audit-verified)

  Firewall rules with firewall logging enabled that logged zero hits in the audit window. Dead allow rules adding attack surface for no purpose.

• Security

  Default service account still enabled

  The default compute / App Engine service account is present and not disabled. It is broadly privileged by default and is a common privilege-escalation path (GCP hardening guidance).

• Security

  Disabled service accounts with active keys

  Disabled service accounts that still carry enabled user-managed keys. The key material is still out there; re-enabling the account silently rearms every copy of it.

• Security

  External backends without Cloud Armor

  External HTTP(S) backend services with live backends and no Cloud Armor security policy attached - no WAF rules, no rate-limiting, no geo/IP controls in front of the workload.

• Security

  External backends without IAP

  External HTTP(S) backend services without Identity-Aware Proxy. Often intentional (public websites), but internal tools exposed this way rely entirely on app-level auth.

• Security

  Firewalls open to the world

  VPC firewall rules allowing 0.0.0.0/0 ingress to SSH/RDP or to all ports/protocols.

• Security

  GKE Binary Authorization off

  Standard GKE clusters without Binary Authorization - any container image, signed or not, can be deployed.

• Security

  GKE NetworkPolicy disabled

  Standard clusters without NetworkPolicy enforcement (and not on Dataplane V2, which enforces natively). Pods can talk to every other pod unrestricted.

• Security

  GKE Workload Identity disabled

  Standard clusters without Workload Identity. Pods fall back to the node service account - every workload shares its permissions.

• Security

  GKE cluster not on Dataplane V2

  Cluster using the legacy datapath instead of GKE Dataplane V2 (eBPF / Cilium), limiting network-policy enforcement and flow-level observability. Off by default - migration is involved.

• Security

  GKE control plane open to the internet

  Clusters whose control-plane endpoint is public with no master authorized networks - the API server accepts connections from any IP.

• Security

  GKE intranode visibility off

  Standard GKE clusters without intranode visibility - pod-to-pod traffic on the same node bypasses VPC flow logs and firewall logging.

• Security

  GKE legacy ABAC enabled

  Clusters with legacy ABAC enabled. ABAC grants coarse, non-auditable permissions that bypass RBAC entirely.

• Security

  GKE master authorized networks disabled

  Cluster control-plane endpoint with master authorized networks disabled, so the Kubernetes API server accepts connections from any source IP (subject to authn). CIS GKE benchmark.

• Security

  GKE secrets not CMEK-encrypted

  Standard GKE clusters without application-layer secrets encryption - Kubernetes secrets in etcd rely on default at-rest encryption only (CIS GKE 5.3.1).

• Security

  IP forwarding enabled

  Instances with canIpForward=true. Unless the VM is a NAT/router appliance, packet forwarding enables spoofing and traffic interception (CIS 4.6).

• Security

  KMS key with SOFTWARE protection level

  Cloud KMS crypto key using the SOFTWARE protection level rather than HSM. Sensitive workloads benefit from HSM-backed keys. Off by default - SOFTWARE is acceptable for many use cases.

• Security

  KMS keys without rotation

  Enabled symmetric KMS keys with no automatic rotation period. CIS GCP recommends rotation at most every 90 days.

• Security

  OS Login disabled

  Project metadata without enable-oslogin=TRUE, plus instances that override OS Login off. Without OS Login, SSH keys in metadata bypass IAM lifecycle (CIS 4.4).

• Security

  Old service-account keys

  User-managed service-account keys older than 90 days. Long-lived bearer credentials are the top GCP breach vector.

• Security

  Org allows service-account key creation

  The organization does not enforce iam.disableServiceAccountKeyCreation. Long-lived service-account keys. The most common GCP credential-leak vector. Can be created in any project under the org.

• Security

  Org domain restriction not enforced

  The organization does not enforce the domain-restricted-sharing org policy (iam.allowedPolicyMemberDomains). Identities outside your Cloud Identity domains can be granted IAM roles anywhere in the org.

• Security

  Owner/Editor granted to users

  Basic roles/owner or roles/editor granted directly to user accounts. Basic roles span thousands of permissions across every service (CIS 1.5).

• Security

  Persistent disk without CMEK

  Persistent disk encrypted with the default Google-managed key, with no customer-managed key reference. Off by default - many workloads accept Google-managed encryption.

• Security

  Personal accounts in project IAM

  user: members with personal-domain emails (gmail.com etc.) in the project IAM policy. Personal accounts bypass org lifecycle controls - they survive offboarding (CIS 1.1).

• Security

  Possibly unused service accounts

  Enabled service accounts with zero user-managed keys and no role in the project IAM policy. Free APIs expose no usage data, so this is a review hint, not proof of disuse.

• Security

  Project owner-role sprawl

  Project IAM policy grants roles/owner to more members than a safe threshold. Broad owner access is a standing privilege-escalation and blast-radius risk (CIS 1.x).

• Security

  Public Artifact Registry repositories

  Artifact Registry repositories granting access to allUsers or allAuthenticatedUsers. Public images leak code, secrets baked into layers, and internal tooling.

• Security

  Public BigQuery datasets

  Datasets whose access entries include allUsers or allAuthenticatedUsers - anyone can query the tables.

• Security

  Public DNS zone with internal-looking name

  Public managed DNS zone whose dns_name suggests internal/private use (internal, corp, intranet, local), potentially leaking internal hostnames into public DNS.

• Security

  Public members in project IAM

  allUsers or allAuthenticatedUsers granted a role at the project level. Every Google account (or the whole internet) holds that role on every resource in the project.

• Security

  Publicly accessible KMS keys

  Crypto keys whose IAM policy grants allUsers or allAuthenticatedUsers. Anyone matching the member can use the key per the granted role (CIS 1.9).

• Security

  Publicly accessible buckets

  Buckets granting IAM roles to allUsers or allAuthenticatedUsers. Critical when the role allows writes.

• Security

  Publicly invokable Cloud Functions

  Cloud Functions granting IAM roles to allUsers or allAuthenticatedUsers. Public functions are unauthenticated entry points into your project.

• Security

  Publicly invokable Cloud Run services

  Cloud Run services granting run.invoker to allUsers or allAuthenticatedUsers. Often intentional for public sites - always worth an explicit review.

• Security

  Redis without AUTH

  Memorystore Redis instances with AUTH disabled - anything that can reach the instance's VPC address can read and write the cache.

• Security

  Redis without in-transit encryption

  Memorystore Redis instances with transit encryption DISABLED. Traffic between clients and the cache crosses the VPC in plaintext.

• Security

  Secrets without rotation

  Secrets older than 90 days with no rotation schedule. Unrotated secrets accumulate copies in configs, laptops, and logs.

• Security

  Self-managed SSL certificates expiring

  Self-managed load-balancer SSL certificates expiring within 90 days (HIGH under 30). Google-managed certs renew themselves; self-managed ones take the site down when they lapse.

• Security

  Serial port access enabled

  Project metadata or instances with serial-port-enable=TRUE. The interactive serial console has no IP allowlisting and accepts connections from any source (CIS 4.5).

• Security

  Service account as project owner/editor

  A service account is bound directly to roles/owner or roles/editor at project level. Compromise of one SA key then yields broad project control (CIS 1.x).

• Security

  Service account with multiple user keys

  Service account holding more than one user-managed key. Each long-lived key expands the credential-leak blast radius - prefer Workload Identity / short-lived credentials (CIS 1.x).

• Security

  Service accounts with Owner/Editor

  Service accounts granted roles/owner or roles/editor. A leaked key for such an account compromises the entire project (CIS 1.5/1.6).

• Security

  Shielded GKE nodes off

  Standard GKE clusters without Shielded GKE nodes - node identity is not cryptographically verified, easing node impersonation attacks (CIS GKE 5.5.5).

• Security

  Shielded VM protections off

  Instances without vTPM + integrity monitoring (Shielded VM). Without them, boot-level rootkits go undetected (CIS 4.8).

• Security

  Snapshot without CMEK

  Disk snapshot encrypted with the default Google-managed key, with no customer-managed key reference. Off by default - many workloads accept Google-managed encryption.

• Security opt-in

  Unused public access grant (audit-verified)

  Resources granting allUsers/allAuthenticatedUsers whose public access was never actually exercised in the audit window. Theoretical exposure you can remove with low risk.

• Security opt-in

  Unused service-account key (audit-verified)

  User-managed service-account keys older than 90 days with zero authentication events in the audit window. Verified safe to delete, not just rotate.

• Security

  User-managed keys on default SAs

  User-managed (downloadable) keys on the default compute or App Engine service accounts. Default SAs are often Editor - an exportable key for them is a project-wide credential on disk.

• Security

  VM disk without customer-managed encryption

  Compute Engine VM with one or more attached disks encrypted only with Google-managed keys (no customer-managed CMEK reference). Off by default - many workloads accept Google-managed keys.

• Security

  VM inherits project-wide SSH keys

  Running VM that neither enables OS Login nor blocks project-wide SSH keys, so every project-level SSH key grants shell access to the instance (CIS 4.x).

• Security

  VM with full cloud-platform OAuth scope

  Compute Engine VM whose attached service account is configured with the broad cloud-platform OAuth scope. Access is then bounded only by IAM, not by scopes - prefer least-privilege scopes.

• Security

  VMs accepting project-wide SSH keys

  Running VMs without block-project-ssh-keys. Any project-level SSH key (added by anyone with compute.projects.setCommonInstanceMetadata) grants login to the VM (CIS 4.3).

• Security

  VMs using the default compute SA

  VMs running as the default compute service account (often project Editor). High risk when paired with the cloud-platform access scope.

• Security

  VMs with external IPs

  Running VMs with an external IP attached. Informational exposure inventory. Prefer IAP / load balancers / Cloud NAT where possible.

• Security

  VMs without Confidential Computing

  Running VMs without Confidential VM (memory encryption in use). Informational inventory for regulated workloads - Confidential VM requires supported machine families and carries a price premium.

• Security

  Weak TLS on HTTPS load balancers

  SSL policies allowing TLS < 1.2 or the COMPATIBLE profile, and HTTPS proxies with no SSL policy at all (the GCP default allows TLS 1.0) - CIS 3.9.

• Storage

  Buckets without lifecycle rules

  STANDARD-class buckets older than 30 days with no lifecycle rules. Cold objects never migrate to cheaper classes.

• Storage

  GCS soft-delete retention beyond default

  Buckets whose soft-delete policy retains deleted objects longer than the 7-day default. Soft-deleted bytes bill at the bucket's storage rate; on churn-heavy buckets that surcharge adds up.

• Storage opt-in

  Idle image (GCP Recommender)

  Custom images GCP's Recommender flags as idle.

• Storage opt-in

  Idle persistent disk (GCP Recommender)

  Persistent disks GCP's Recommender flags as idle / unused.

• Storage

  Old disk snapshots

  Disk snapshots older than 180 days. Manual snapshots routinely outlive their purpose and bill forever.

• Storage

  Old unused custom images

  Custom images older than 180 days that no collected disk was created from. Image storage bills per GB-month indefinitely.

• Storage

  Orphaned disk snapshots

  Snapshots whose source disk has been deleted. Usually leftovers from a decommissioned workload.

• Storage uses metrics

  Overprovisioned Filestore instances

  Filestore instances using under 20% of provisioned capacity (1 TB+ shares). Capacity bills whether used or not; most tiers can be shrunk only by recreating, so sizing right matters.

• Storage

  Premium Filestore tiers in non-prod

  SSD/Enterprise Filestore tiers on dev/test/staging instances (name/label inference). Basic HDD is roughly half the price and plenty for non-prod file shares.

• Storage

  Regional PDs in non-prod

  Regional persistent disks (synchronously replicated across two zones, 2x the zonal price) whose name/labels look non-prod. Dev/test rarely needs cross-zone disk durability.

• Storage

  STANDARD buckets without Autoclass or class tiering

  STANDARD-class buckets that have lifecycle rules but none that transition storage classes, and Autoclass disabled. Cold objects keep billing at the STANDARD rate forever.

• Storage

  Stale Artifact Registry repositories

  Artifact Registry repositories not updated in 180+ days holding 1 GB+ of artifacts. Storage bills $0.10/GB-month for images nobody ships anymore.

• Storage

  Stopped notebooks with billing disks

  STOPPED Workbench notebook instances. Compute stops billing but the boot/data persistent disks keep accruing storage charges.

• Storage

  Unattached persistent disks

  Persistent disks with no attached instance for 7+ days. They bill full price whether or not anything uses them.

• Storage

  pd-ssd disks -> pd-balanced

  pd-ssd disks that can usually migrate to pd-balanced for ~41% lower cost at SSD-class latency. Keep pd-ssd only for sustained high-IOPS workloads.

Checks marked opt-in use a paid or billing-data cloud API and never run unless you switch them on. A default scan uses only free APIs.