zombiescan prices each Google Cloud waste finding from the Billing Catalog API

Refreshing a Google credentials object signs through OpenSSL, and one credentials object refreshed from several threads at once ends the process instead of raising an exception ^[9]. zombiescan fetches the first token before any worker thread starts. The threads then share a single credentials object, and the wrapper serialises later refreshes behind a lock ^[8]. Credentials come from Application Default Credentials, with no key file downloaded and no service account created ^[7]. You hit that failure on the fourth project of a scan, not in a unit test.

An unattached Persistent Disk keeps billing after the instance it served is gone, and a GKE cluster keeps charging its management fee after the last node pool scaled to zero ^[19]. Each one bills every hour and reports nothing, according to the post ^[19], while the billing console shows the total and the Recommender surfaces candidates ^[4]. What makes a finding usable, it argues, is a figure that "names one resource, in one project, and its monthly cost" ^[5]. The available text of the walkthrough breaks off at the first scan command, before any priced finding prints ^[20], so the comparison with the Recommender rests on the design.

Each check declares the APIs it calls, and that declaration generates both the published API listing and the read-only custom role ^[12]. The listing names 11 APIs ^[24]. The per-API check counts sum to 22 declarations across 20 checks ^[21], so at least two checks call more than one API ^[21].

Read the check names and you can see which findings are facts about billing and which are policy. An unattached disk is a fact. stale-secret flags secrets nothing has updated in 90 days, unmanaged-gcs-bucket flags versioned buckets with no lifecycle rule, and unbounded-log-bucket flags log buckets retaining logs indefinitely ^[25]. Those three encode a retention opinion, and the cleanup they justify carries a different risk than deleting a disk nothing is mounted on. The checks span Compute Engine, Cloud SQL, Storage, DNS, KMS, Secret Manager, Artifact Registry, Filestore, Cloud Logging, Cloud Monitoring and GKE ^[2].

Running it needs uv on the path and Python 3.11 or newer ^[18]. There are two routes, a clone driven with uv run and uv tool install from git, and the post says both run the same engine ^[23]. uv sync reads the committed uv.lock, so the resolved set is the one the tests ran against ^[16]; the run shown in the post resolved 39 packages and checked 38 ^[17].