Unattached storage
Persistent disks with no instance attached still bill for provisioned capacity every month.
- Unattached disks
- Disks still billing on stopped instances
Google Cloud cost optimization tool
GCP cost optimization that finds idle resources and ranks every fix
Varcio is a Google Cloud (GCP) cost optimization tool that connects with a Service Account, combines billing export, Asset Inventory, monitoring signals and Recommender output, and runs 59 GCP detectors. Findings are costed and ranked by savings, confidence and effort, and approved fixes such as stopping idle Compute Engine instances run behind protected tags, dry-run and audit logging.
59Google Cloud detectors, plus 23 cross-cloud detectors on the shared ledger
Service AccountEncrypted service account key; short-lived access tokens minted per call
Read-onlyThe complete analytical product runs on read-only credentials
11Google Cloud cost recommenders read, plus the IAM recommender
Detection
What Varcio finds on Google Cloud
59 Google Cloud detectors look across your projects for resources that keep billing after they stop being useful, and put a monthly cost on each one.
Google Cloud waste accumulates quietly. Projects are cheap to create and easy to forget, persistent disks and static IP addresses remain after the instances using them are gone, and Google’s documentation is explicit that a stopped instance keeps incurring charges for resources still attached to it.
Each Varcio finding includes an estimated monthly saving, a confidence score, an effort level, a risk note and a recommended action. Because Recommender output is ingested alongside billing export and Asset Inventory, Google’s own recommendations are read in the context of what you actually spend.
Unused static IPs
Reserved static external IP addresses that no longer route to anything, or that are held by an instance that has been stopped.
- Unused static IP addresses
- Static IPs still billing on stopped instances
Idle compute, GKE and Cloud Run
Compute that is running, and billing, while showing no meaningful activity in Cloud Monitoring.
- Idle Compute Engine instances
- Idle GKE node pools
- Idle Cloud Run services
Idle and oversized Cloud SQL
Managed database instances that remain provisioned after the application using them has moved on, or that are sized well above their measured load.
- Idle Cloud SQL instances
- Cloud SQL rightsizing
Stale snapshots
Snapshots kept long past any recovery or compliance need, billing for storage indefinitely.
- Stale snapshots
Spend drift and cross-cloud
Anomalies and forecast drift from billing export, plus 23 cross-cloud detectors that catch duplication between Google Cloud and your other clouds.
- Anomalous cost changes by project or service
- Duplicated environments spanning clouds
The signals behind Google Cloud findings
Each Google Cloud detector uses the signals that answer its question. Not every signal applies to every resource type; these are the kinds of evidence Varcio reads.
- Spend data
Cloud Billing export in BigQuery shows projects, services and SKUs whose cost is moving without a matching change in demand, including committed use discount credits.
- Live resource inspection
Cloud Asset Inventory shows what exists and what it is attached to, which is the basis for unattached disk and unused static IP findings.
- Utilisation metrics
Cloud Monitoring identifies idle Compute Engine instances, GKE node pools, Cloud Run services and Cloud SQL instances.
- Recommender
Eleven Google Cloud cost recommenders, including commitment utilisation, are read alongside Varcio’s own detectors.
- Identity and pricing
The IAM recommender adds access context to findings, and Cloud Billing Catalog pricing costs each finding and proposed change.
Connection
How Varcio connects to Google Cloud
A Service Account with encrypted key material, Google Cloud’s billing, inventory and monitoring data, and a firm line between reading and acting.
Service account key
You provide a service account key (JSON), which Varcio stores encrypted. For each call, Varcio uses it to obtain a short-lived access token rather than holding a long-lived session. You control the service account’s roles, and can disable or delete it, from IAM at any time.
Google Cloud data sources
- Cloud Billing export in BigQuery for detailed spend
- Cloud Asset Inventory for resources and relationships
- Cloud Monitoring for utilisation
- Recommender, including 11 cost recommenders and the IAM recommender
- Cloud Billing Catalog for pricing
Read-only, indefinitely
Findings, forecasts, anomaly detection, allocation, tag governance and Apex questions all run on read-only credentials with no time limit.
Write access on the same service account
If you want Varcio to act, you grant write roles to the same service account and Varcio checks them separately. The write-role script Varcio provides covers stopping, starting and changing the machine type of instances; other actions need additional permissions.
Google Cloud is one of the three clouds, with AWS and Azure, where Varcio’s automation goes deepest.
Rate optimization
Committed use discounts and Recommender
Commitments reduce the rate you pay for steady Google Cloud usage, once waste has been removed.
Google Cloud offers resource-based committed use discounts for Compute Engine and spend-based commitments across eligible services, and Active Assist includes a recommender for each. Billing reports also include a committed use discount analysis view.
Varcio reads commitment utilisation from Recommender and committed use discount credits from billing export, and models 1- and 3-year spend-based commitments and 3-year resource-based commitments. Resource-based commitments can be purchased through Varcio after approval; Varcio does not buy commitments automatically. Keeping commitments next to open waste findings matters, because a commitment sized before idle instances are removed covers capacity you do not need.
What Varcio covers on Google Cloud
- Commitment utilisation from Recommender
- Committed use discount credits from billing export
- 1-Year and 3-Year spend-based commitments, modelled
- 3-Year resource-based commitments, modelled
- Approval-gated purchase of resource-based commitments
- Commitment decisions reviewed alongside open waste findings
Remediation
Remediation with guardrails
A finding can become a completed, audited change without anyone opening the console.
Stopping an idle Compute Engine instance is a common first action. Through Apex, a request returns a plan listing the instances, the expected saving and the guardrails that apply, and runs only after someone types APPROVE with a single-use token or approves it from Slack or Teams. Because attached persistent disks and static external IPs keep billing after a stop, those resources remain visible as their own findings.
Supported changes can be rolled back automatically. Varcio tracks identified savings separately from realised savings, verifying the realised figure against subsequent spend in billing export.
Example actions on Google Cloud
- Compute and databases: stop or rightsize instances, stop Cloud SQL, stop Vertex AI Workbench instances, undeploy idle Vertex AI models
- Cleanup: delete unattached disks, unused forwarding rules, orphaned snapshots, instance templates and buckets; release static IPs
- Hardening: KMS key rotation, bucket hardening and project metadata hardening
- Parking: instances and instance groups on a schedule
- Automatic rollback for supported changes
Guardrails every remediation inherits
These controls apply to all remediation Varcio executes, on every cloud, alongside the write permissions you grant and Varcio verifies before anything changes.
Protected-tag exemption
Resources carrying a protected tag are excluded from every remediation run, so a production database or a regulated workload cannot be changed by a rule that happens to match it.
Execution windows
Approved changes run only inside the windows you define, which keeps stops, deletions and resizes away from peak traffic, release trains and change freezes.
Rollout-safety gates
Before a live run, Varcio checks for step-up approval on high blast-radius changes, a rollback success floor, and a maintenance window for larger blast radius. If a gate is not met, the run drops to a dry run instead.
Dry run, action caps and budgets
Any action can be previewed without making live API calls, and individual rules can be held to dry run. Per-rule action caps, a maximum number of actions per run and a monthly action budget bound how much changes at once.
Approval, and Autopilot limits
Write actions requested through Apex come back as a plan that runs only after an authorised person types APPROVE, backed by a single-use token, or approves from Slack or Microsoft Teams. Autopilot runs in observe, suggest or autopilot mode. In autopilot mode it can act without a person above a confidence threshold, including deleting unattached volumes and orphaned snapshots, but resources that look production, public, critical or deletion-protected go to approval instead.
Full audit logging
Every action records who requested it, who approved it, what changed and when, so finance, security and auditors can reconstruct any change after the fact.
Native tools
Cloud Billing reports, Recommender and Varcio
Google Cloud’s billing reports and Active Assist recommenders are strong, included tools. Here is what they provide, according to Google Cloud documentation.
Cloud Billing reports
Customisable views of Google Cloud spend with filters, grouping and forecasts based on historical trends, plus cost table, cost breakdown, pricing and committed use discount analysis reports.
Cloud Billing export to BigQuery
Exports detailed billing data to BigQuery throughout the day for custom analysis and dashboards.
Recommender and Active Assist
Recommenders including Idle VM, Idle persistent disk, Idle IP address, Idle custom image, Cloud SQL idle and overprovisioned instance, Idle GKE cluster, and resource-based and spend-based committed use discount recommenders.
| Capability | Google Cloud native tools | Varcio |
|---|---|---|
| Cost visibility | Billing reports with filters, grouping and forecasts; billing export to BigQuery for custom analysis | One normalised ledger across Google Cloud, AWS, Azure, OCI and Kubernetes |
| Waste and rightsizing | Recommenders for idle VMs, disks, IPs, custom images, Cloud SQL and GKE clusters | 59 GCP detectors, with Recommender output ingested as an input |
| Prioritisation | Recommendations grouped by category with estimated impact | Findings costed and ranked by savings, confidence and effort |
| Commitments | Resource-based and spend-based CUD recommenders and CUD analysis reports | Spend-based and resource-based commitment modelling, with approval-gated resource-based purchases |
| Acting on findings | Changes made in the console, gcloud, APIs or infrastructure code | Plan confirmed with APPROVE, protected tags, execution windows, rollout-safety gates, dry-run, action caps and audit log |
| Pre-merge cost review | Not covered by the tools listed here | PR cost review prices Terraform changes before they merge |
| Collaboration | Recommendations viewed in the console or retrieved through the API | Findings, alerts and approvals in Slack or Teams |
Scroll sideways to see the full table.
What Varcio adds
If your estate is almost entirely Google Cloud and your team already builds on billing export in BigQuery, native tools may cover much of what you need. Varcio is designed for the point where cost work has to span clouds, reach the owning team and leave an approval record.
Varcio places Google Cloud in one ledger with AWS, Azure, OCI and Kubernetes, runs 23 cross-cloud detectors over it, adds tag governance, allocation and showback, reviews infrastructure pull requests for cost before merge, and routes approvals through Slack or Teams. Apex answers spend questions in plain language and turns requests into governed plans.
Teams
Who uses Varcio for Google Cloud
Cost is shared work. Each team sees the same findings and ledger, framed for the decisions it owns.
Platform engineering
Gets findings for the projects it owns with evidence and a recommended action, and sees cost deltas on Terraform pull requests before merge.
FinOps and finance
Allocates Google Cloud spend through tag governance and showback in the same ledger as other clouds, and reports identified against realised savings.
SRE and operations
Approves instance stops and other changes from Slack or Teams, with protected tags and execution windows keeping critical workloads out of scope.
Engineering leadership
Asks Apex why Google Cloud spend changed, reviews forecasts, and schedules a ranked savings backlog like any other engineering work.
FAQ
Google Cloud cost questions, answered
How do I reduce my Google Cloud bill?
Remove what bills without doing anything first: unattached persistent disks, unused static IP addresses and stale snapshots. Then deal with idle Compute Engine and Cloud SQL instances and rightsize what remains. Consider committed use discounts once usage is settled, and use tag governance and cost review on infrastructure changes to stop waste returning. Varcio finds and ranks these opportunities with 59 GCP detectors.
Does Varcio replace Google Cloud Recommender?
No. Varcio ingests Recommender output as one of its inputs, alongside billing export, Asset Inventory and monitoring signals. It adds its own 59 GCP detectors, cross-cloud detectors, ranking by savings, confidence and effort, and an approval-gated path to act.
Do stopped Compute Engine instances still cost money?
Yes, partly. Google Cloud documentation states that after you stop an instance you keep incurring charges for resources that remain attached to it, such as persistent disks and static external IP addresses. Detach and delete resources you no longer need.
Is it safe to give a cost tool a Google Cloud service account?
Varcio stores the service account key encrypted and uses it to obtain short-lived access tokens for each call. The whole analytical product runs on read-only access indefinitely. If you want Varcio to act, you grant write roles to the same service account and Varcio checks them separately. All remediation is covered by protected tags, execution windows, rollout-safety gates, dry-run, approval or Autopilot limits, and audit logging.
Which Google Cloud data does Varcio use?
Cloud Billing export in BigQuery for spend and committed use discount credits, Cloud Asset Inventory for resources and their relationships, Cloud Monitoring for utilisation, Recommender output including 11 cost recommenders and the IAM recommender, and Cloud Billing Catalog pricing.
Can Varcio manage Google Cloud alongside AWS and Azure?
Yes. Google Cloud spend sits in the same normalised ledger as AWS, Azure, OCI and Kubernetes, and 23 cross-cloud detectors run across that ledger to catch duplicated environments and redundant workloads spanning clouds.
When will I see Google Cloud findings?
Findings appear from the first scan after you connect. The free trial runs entirely on read-only access.
Rank your Google Cloud savings from the first scan
Connect a read-only service account, see costed findings across your projects, and grant write access only when you are ready.