CoverOps on Google Cloud
Read-only through a service account with four predefined viewer roles on your project.
The access you give
A service account with viewer roles.
- Cloud Asset Viewer, Monitoring Viewer, Compute Viewer and Billing Viewer: viewer roles only, none of which can change anything
- Created with a gcloud script or Terraform from the console
The service account key is encrypted at rest (AES-256-GCM) and used only by scans.
What it reads
- Compute Engine instances and disks, snapshots, addresses, networking, Cloud SQL, storage buckets, GKE clusters and serverless services
- Cloud Monitoring utilisation, and billing for the cost
Never read: your application data, database contents or the files in your storage.
Where the rupee figures come from
Billed cost where billing can be read; otherwise public list prices, labelled as estimates.
What it finds
- Idle and oversized instances and databases
- Unattached disks, old snapshots and unused static addresses
What it changes
Advice only on Google Cloud: each finding comes with the gcloud or Terraform change and its undo, for your team to run.
How to connect
- Sign up and open Cloud accounts → Connect Google Cloud
- Run the generated gcloud script: it creates the coverops-reader service account, grants the viewer roles and makes a key
- Paste the key file and project ID, press Verify access, then Connect
How to end it
Delete the coverops-reader service account or its key. Access ends at once. Your workloads keep running: none of them ever ran on CoverOps. More in revoking access and the security overview.
Other clouds: AWS · Azure · DigitalOcean · Oracle Cloud