Google Cloud VM Manager

Google Cloud VM Manager is an agent-based service for administering Windows and Linux virtual machines on Compute Engine. It is strongest for organizations already running substantial Google Cloud fleets that need coordinated patching, inventory, and configuration control. Its operational depth is useful, but single-project patch execution and an English-locale requirement can make another platform a better fit.

Overview

VM Manager combines patch management, operating-system inventory, and OS policies in a cloud deployment. Automation is designed to reduce the routine effort of maintaining VM fleets, while drift detection, policy as code, and compliance reporting support repeatable administration. The service is tightly aligned with Compute Engine, so it is a more natural choice for Google Cloud teams than for companies seeking one management layer across unrelated cloud or on-premises environments.

Key features

Patch control and reporting

Patch jobs can run on demand or on recurring schedules. Administrators can choose which patches receive approval and add scripts before and after a job. In practice, that gives operations teams control over maintenance windows and the preparation or cleanup work surrounding updates, rather than forcing a single all-or-nothing patch routine. Patch compliance reporting helps identify the machines that have or have not reached the intended state.

Execution has an important boundary: each patch job can run only against VMs in one Google Cloud project. Compliance data can be viewed across projects, so oversight can be broader than the action that produces it. Organizations with many projects will need to structure jobs accordingly instead of expecting one cross-project deployment.

Inventory and policy

OS inventory records hostnames, operating-system and kernel versions, installed packages, available updates, Windows applications, and OS vulnerabilities. That breadth makes it useful for locating outdated software and understanding fleet composition before maintenance decisions are made. OS policies centralize deployment, configuration, maintenance, and reporting of software configurations, helping teams enforce a consistent baseline rather than relying on separate manual procedures.

Administration and security

The service is manageable through the Google Cloud console, Google Cloud CLI, and OS Config API. Terraform can extend management across projects, which is valuable for infrastructure-as-code workflows even though individual patch jobs retain their project scope. VM Manager supports projects inside VPC Service Controls service perimeters.

Access must be designed carefully. Creating patch jobs or OS policy assignments requires IAM permissions that Google says can grant the ability to run code on VMs, so broad administrative grants are inappropriate; least-privilege assignments are essential. Inventory and vulnerability data remains until the VM is deleted, but is removed if the OS Config agent stops reporting for a few days. The agent model also creates an operational dependency: when reporting stops, retained visibility does not continue indefinitely.

Pricing

The VM Manager plan is listed as free, with billing of $0.003 per hour per VM when an active OS Config agent runs after the free tier. The charge is per VM-hour. Each Google Cloud Billing account receives 100 VMs per month free, making the plan practical for small fleets or limited deployments; larger estates pay for usage beyond that allowance.

A limited-functionality mode provides a subset of features at no cost for unlimited VMs. It can suit organizations that need basic coverage without the full feature set, but teams requiring the complete patch, inventory, policy, and reporting capability should budget for the per-VM-hour charge after the allowance. There is no separate seat charge stated, and support packages are purchased through Google Cloud, with options including 24/7 coverage, phone support, and access to a technical support manager.

Platforms

VM Manager is a cloud service with API, Linux, web, and Windows interfaces. Supported guest systems include Windows Server, Red Hat Enterprise Linux, Rocky Linux, CentOS, Debian, Ubuntu, and SUSE Linux Enterprise Server. All supported operating systems must be configured with an English locale; a non-English locale can cause the OS Config agent and VM Manager features to fail. That is a material deployment constraint for internationally standardized fleets.

Who it's for

Choose VM Manager when your machines run on Compute Engine and you want one Google Cloud-aligned workflow for patch scheduling, asset inventory, configuration policy, drift detection, and compliance reporting. It is especially appropriate for administrators managing many Windows and Linux VMs who can organize maintenance by project and enforce careful IAM boundaries.

It is less suitable for mixed-provider or heavily on-premises estates that need provider-neutral control, for fleets requiring non-English operating-system locales, or for teams that need a single patch action to span multiple projects.

Pros and cons

• Pro: On-demand and recurring patch jobs, approval selection, and pre- and post-patch scripts provide practical maintenance-window control.
• Pro: Inventory covers versions, packages, applications, updates, and vulnerabilities, giving administrators a detailed fleet picture.
• Pro: OS policies, policy as code, drift detection, and compliance reporting support enforceable configuration standards.
• Pro: The 100-VM monthly allowance and unlimited-VM limited mode create no-cost entry points.
• Con: A patch job cannot cross project boundaries, so multi-project execution requires separate jobs.
• Con: English locale is mandatory; non-English configurations can break the agent and features.
• Con: IAM for patch and policy assignments can permit code execution on VMs, increasing the consequences of overbroad access.
• Con: Inventory and vulnerability history disappears after several days without agent reporting.

Alternatives

For broader comparison, see Configuration Management Tools, Patch Management Software, IT Configuration Management Software, and IT Automation Software.

• Salt is a free, Apache 2.0-licensed option with Linux, Windows, macOS, API, and self-hosted support.
• CFEngine offers a free Community Edition, a free trial, and a paid Enterprise Edition with pricing not listed.
• AWS Systems Manager State Manager is the better directional choice for AWS estates; its plan has no additional charge, although limits may apply.
• config.XO suits a very small environment needing a free workspace capped at three managed systems.
• Rudder is an open-source-oriented alternative with free Core availability and a free trial.
• cdist is a free Linux, macOS, and self-hosted tool with no paid plans or usage limits stated.
• OpenVox is community-maintained software usable with an agent/server setup or standalone.
• pyinfra is a free MIT-licensed option for teams comfortable with Python 3.10 or newer.

Verdict

Google Cloud VM Manager is a strong choice for Compute Engine operators who need centralized patching, rich OS inventory, and policy-driven configuration at fleet scale. Its main reason to choose it is the combination of Google Cloud integration and detailed maintenance controls. Look elsewhere if patch execution must span projects, operating systems use non-English locales, or your infrastructure extends beyond Google Cloud and demands a provider-neutral control plane.