A Practical Guide to Google Cloud Recommender

Paying for empty cloud space is a popular corporate hobby that’s surprisingly hard to quit. Infrastructure scaling always outpaces manual control, and at some point, your monthly cloud bill starts looking like an international phone number. Enter Google Cloud Recommender (Recommender AI) — a native, deeply integrated GCP tool that analyzes telemetry, access logs, and usage metrics to answer one simple question: “Where are we burning money and creating security holes?”

This article is a deep dive into how Recommender AI actually works, what data it looks at, how much it costs, and how to integrate it into your Cloud management processes without accidentally taking down your production environment.

The Architecture: How Recommender AI Actually Works

Many people mistakenly think Recommender is just a simple script looking for virtual machines (VMs) with under 5% CPU usage. In reality, it’s a complex data pipeline built on heuristic algorithms and machine learning (ML) models.

It runs in the background, constantly pulling data from several sources:

• Cloud Monitoring (Stackdriver): Gathers time-series data on CPU, memory, disk I/O, and network traffic.
• Cloud Audit Logs: Analyzes API calls and how specific permissions are actually used.
• Billing Export: Looks at your current pricing, Committed Use Discounts (CUDs), and license types.

Every piece of advice comes in two parts: an Insight and a Recommendation. An Insight is a raw fact (e.g., “User X hasn’t used the bigquery.tables.delete permission in 90 days”). A Recommendation is the action you should take based on that fact (e.g., “Downgrade the role from Owner to roles/bigquery.dataViewer”).

The ML models analyze a historical window (usually 8 to 90 days), calculate peak load percentiles (like P95 or P99), and predict if making a change will break your system.

The Six Pillars of Optimization

Google Cloud Recommender categorizes its advice into six main pillars. Let’s break them down.

1. Cost Optimization (The main reason you are here)

• VM Rightsizing: The algorithm checks your vCPU and RAM usage over the last 8 days. If your 99th percentile CPU usage is below 10%, the system will suggest a smaller instance type (like moving from n2-standard-16 to n2-standard-4) or switching to a Custom Machine Type.
• Idle VMs & Abandoned Disks: It hunts down “zombie resources.” These are unattached Persistent Disks (PDs), forgotten static IP addresses routing to nowhere, and idle Cloud SQL instances that are just sitting there eating your budget.
• Committed Use Discounts (CUD): It analyzes your stable baseline usage and suggests buying 1-year or 3-year commitments, showing you the exact financial profit and break-even point.

2. Security

• IAM Least Privilege: Analyzes access logs over the last 90 days. If a service account has the Editor role but only ever reads from Cloud Storage, Recommender will generate the exact Terraform or gcloud command to downgrade those permissions.
• Service Account Keys: Reminds you to rotate old, long-lived access keys before someone finds them on GitHub.
• VPC Security: Detects dangerously open firewall rules (because opening 0.0.0.0/0 on port 22 to the whole internet is always a bad idea).

3. Performance

• Cloud SQL Insights: Finds slow database queries and suggests creating specific indexes for PostgreSQL and MySQL.
• Compute Engine: Detects instances hitting their Network Egress Throttling limits or disk IOPS caps.

4. Reliability

• Managed Instance Groups (MIG): If all your instances are sitting in a single zone, the algorithm will suggest a Regional MIG so your app doesn’t die when one data center has a bad day.
• Snapshot Schedules: Nudges you to set up automatic backups for critical disks that currently have none.

5. Manageability

Helps automate the boring stuff. It suggests deleting outdated Custom Images and unused Instance Templates so your infrastructure registry doesn’t look like a digital junkyard.

6. Sustainability

Estimates your carbon footprint. It suggests deleting idle resources not just to save dollars, but also to show you how many kilograms of CO2 emissions you prevented.

Engineering Use Cases: Recommender in the Wild

To understand the real value of the tool, let’s look at three typical scenarios where Recommender pays for itself on day one.

Case 1: The Load-Testing Hangover

The Setup: Your engineering team spun up a massive backend to stress-test a new routing service. They launched dozens of massive c2-standard-60 VMs and huge SSDs. After the test, they deleted the VMs, but the script “forgot” the disks.

The Fix: Recommender identifies the Unattached Persistent Disks, sees zero IOPS for days, and calculates the exact money you are wasting.

The Action: You set up an automated pipeline: Recommender -> Pub/Sub -> Cloud Function, which takes a final cheap snapshot of the disk and permanently deletes the expensive SSD.

Case 2: The BigQuery Budget Black Hole

The Setup: Your data team processes terabytes of logs daily. Suddenly, infrastructure costs skyrocket, even though data volume barely increased.

The Fix: Recommender analyzes data processing costs at the table level. It points out that specific queries are doing Full Scans instead of using partitions.

The Action: You apply the recommendation to set up Time-partitioned tables, instantly dropping the cost of a single query from $5.00 to $0.10.

Case 3: The IAM Wild West

The Setup: To speed up a release, every developer was given the Project Editor role. After the release, nobody remembered to take it back.

The Fix: The IAM Recommender looks at a 90-day window and notices that Developer A only ever uses storage.objects.get.

The Action: It suggests a custom role with the absolute minimum required permissions, drastically reducing the risk of a massive breach if one laptop gets stolen.

Pricing: Is it really free?

The core functionality of Google Cloud Recommender is absolutely free. You do not pay to get Cost, Performance, or basic Security recommendations. However, this is the cloud, so there is always a catch.

Where you might actually pay:

1. Security Command Center (SCC) Premium: For advanced security recommendations (container vulnerabilities, deep network analysis), you need SCC Premium, which is a paid, enterprise-level tier.
2. BigQuery Export: If you export your recommendations to a data warehouse to build dashboards, you will pay standard BigQuery rates for data storage and SQL queries.
3. API Quotas: If you write a crazy script that pings the Recommender API every single second, you might hit paid API limits — though you’d have to try really hard.

Infrastructure as Code (IaC) Rules

Clicking the “Apply” button in the GCP web interface is a mortal sin for serious engineering teams.

If Recommender changes a machine type in the cloud, but your main.tf file still has the old machine type, your next terraform apply will overwrite the AI’s fix or recreate the machine entirely, causing downtime.

Best Practices for Terraform:

1. Use it as an Auditor: When you see a good recommendation, an engineer should manually update the Terraform code and push it through your CI/CD pipeline.
2. Organization Policies: Instead of fighting the symptoms, use insights to create strict rules. If Recommender keeps finding VMs with external IPs, just ban them at the organization level using the constraints/compute.vmExternalIpAccess policy.

The Blind Spots (When NOT to listen to the AI)

To use Recommender effectively, you need to know where it fails.

• Zero Business Context: The ML model does not know your marketing calendar. If the last 14 days were quiet, it will tell you to downsize your servers. If tomorrow is Black Friday, applying that recommendation will crash your entire platform. Always filter AI advice through human business logic.
• The Domino Effect: Downgrading a CPU also proportionally downgrades your Network Bandwidth and Disk IOPS limits. Make sure that by saving a few bucks on the processor, you aren’t creating a massive network bottleneck for your high-load applications.

Ultimately, Google Cloud Recommender is not an autopilot. It is a highly intelligent co-pilot that points out your blind spots and hands you the math. But the final decision to pull the trigger is always yours.

Uncontrolled BigQuery queries, over-provisioned infrastructure, and hidden cloud waste often build up silently as data platforms scale. Rather than cutting resources blindly or imposing rigid limits that stall engineering velocity, effective cost control requires a precise, architectural review of your workload. My FinOps on GCP service is designed to identify query inefficiencies, optimize data partitioning, and align your cloud expenses directly with technical and business value. We focus on finding the root causes of runaway bills—from unoptimized transformations to redundant storage—without compromising system performance. If you are looking for a calm, data-driven approach to make your Google Cloud environment predictable and cost-efficient, I invite you to explore the details.