CloudJanitor

an autonomous agent that continuously audits your cloud, eliminates waste, flags security risks, and takes action while you sleep.

Comment

CloudJanitor - Autonomous Cloud Hygiene Agent

Inspiration

Every cloud account rots over time. Idle instances keep billing. Unattached volumes pile up. A developer flips an S3 bucket public "just for testing" and forgets. Costs creep 20 to 30% higher than they should be, and security gaps sit undetected for months.

As someone who has managed enterprise cloud environments for 20 years, including a $4.25M AWS commitment and multi-account organizations, I have lived this friction. Cloud hygiene is a real, recurring, multi-step chore that nobody wants to do manually, and it never gets done consistently. This is my "Bring Your Own Friction."

What it does

CloudJanitor is an autonomous agent that runs asynchronously in the background and owns the entire cloud hygiene workflow end to end:

  1. Scans a cloud account across compute, storage, networking, and security (idle EC2, unattached EBS volumes, public S3 buckets, cost anomalies, over-privileged IAM, orphaned resources).
  2. Reasons about each finding using Gemini 3.5, assessing severity, business impact, and whether remediation is safe to automate or requires human approval.
  3. Acts autonomously. It auto-remediates low-risk items (for example, deletes an unattached volume after a snapshot, stops a confirmed-idle dev instance), and for risky items it files structured, evidence-backed tickets with a recommended fix.
  4. Reports. It sends a prioritized summary with estimated savings and a remediation log to Slack or email.

It does not just write text about your cloud. It takes action on it.

How we built it

  • Gemini 3.5 (via Vertex AI) for reasoning, severity classification, and remediation decisions
  • Google Agent Development Kit (ADK) for the agent orchestration and tool definitions
  • Cloud Run hosts the agent as an asynchronous background service
  • Firestore for persistent state, tracking findings, remediation history, and cross-run memory so the agent never re-flags an approved exception
  • Pub/Sub triggers scheduled scans and decouples detection from remediation
  • Each capability (scan, assess, remediate, notify) is an isolated, security-scoped tool the agent invokes, so the blast radius of any single action is contained

Architecture highlights (engineering discipline)

  • Decoupled by design: detection, reasoning, and action are separate stages connected via Pub/Sub, so a failure in one never corrupts the others.
  • State management: Firestore holds an approved-exceptions ledger and a full audit trail. Every action is reversible and logged.
  • Failure-tolerant: if Gemini returns a low-confidence or malformed decision, the agent defaults to "report, do not act." It never auto-remediates on uncertainty.
  • Least privilege: remediation tools run under tightly scoped IAM roles, and destructive actions always snapshot first.

Challenges we ran into

Balancing autonomy with safety. An agent that can delete cloud resources is dangerous. We solved this with a confidence-gated decision model: Gemini classifies each action's risk, and only high-confidence, reversible, low-risk actions are automated. Everything else becomes a ticket.

Accomplishments we are proud of

A genuinely autonomous agent that does real work on live infrastructure, with guardrails that make it safe enough to trust in production.

What's next

Multi-cloud support (Azure, GCP), a policy-as-code layer so teams define their own hygiene rules, and integration into a managed services offering for SMEs across the GCC.

Built with

Gemini 3.5, Google ADK, Vertex AI, Cloud Run, Firestore, Pub/Sub, Python

Built With

Share this project:

Updates

Submission history