Connect Oracle Cloud (OCI)

Give CostGlass read-only access to Oracle Cost and Usage Reports with a Resource Manager stack or your own Terraform.

Connect Oracle Cloud (OCI)

Give CostGlass read-only access to your Oracle Cloud Cost and Usage Reports, using a dedicated IAM user and a signing key that CostGlass generates for you.

Where in CostGlassSettings → Cloud Accounts → Oracle Cloud

PlanDepends on your plan's connection limit

Who can do thisSomeone who can create IAM users and policies in your Oracle tenancy, and an owner or admin in CostGlass

Time neededAbout 15 minutes, then up to 24 hours for Oracle's first report

In short

Oracle Cloud has no cross-account role like AWS. Instead CostGlass creates a signing key pair for the connection, keeps the private half in its encrypted vault and gives you a Terraform stack that registers the public half on a new read-only user in your tenancy.
You run the stack in Oracle Resource Manager (browser only, no tools to install), or with your own Terraform if you prefer.
You paste three outputs back into CostGlass: the tenancy OCID, the CostGlass user OCID and the home region.
CostGlass reads the cost reports Oracle already produces. It cannot sign in to the console and has no write access.
On a brand-new tenancy Oracle can take up to 24 hours to publish the first report. CostGlass connects anyway and loads the data when it appears.
You can connect more than one tenancy to the same organisation.

How it works

Oracle publishes your cost data as CSV files called Cost and Usage Reports. They are written to a storage bucket that lives in an Oracle-owned tenancy, not in yours, and Oracle gives you access to them through an IAM policy. CostGlass needs a user it can sign in as, so the stack creates one.

Tenancy: Your top-level Oracle Cloud account. Every resource lives inside it.
OCID: Oracle Cloud Identifier: the long ID (it starts with ocid1.) that Oracle gives every resource. Your tenancy and each user have one.
API signing key: A pair of keys. The private half proves who is calling. The public half is registered on a user so Oracle can check the proof. CostGlass keeps the private half and only ever shows you the public half.
Resource Manager: Oracle's built-in service for running Terraform from the browser. You upload a file and click Apply.
Home region: The region your tenancy was created in. Oracle stores Cost and Usage Reports there, whichever region you work in day to day.
Identity Domains: Oracle's current way of organising users. The stack creates the new group in the Default identity domain.

The stack creates exactly these things in your tenancy:

Resource	Name	Purpose
IAM user	`costglass-readonly-billing`	The identity CostGlass signs in as. It has no console password. It carries the email address you supply.
IAM group	`CostGlassReadOnly`	Holds the user and receives the policy.
Group membership	n/a	Puts the user in the group.
API key	n/a	Registers CostGlass's public signing key on the user.
IAM policy	`CostGlassReadOnlyBillingPolicy`	Allows reading the cost reports, plus a read-only inventory (see below).

The policy has one statement that lets the group read objects in Oracle's cost-report tenancy, and several read-only statements for resource inventory:

inspect compartments in tenancy
inspect tenancies in tenancy
read instance-family in tenancy
inspect volume-family in tenancy
read public-ips in tenancy

No use or manage permission is ever granted. The inventory statements are what let CostGlass list compute instances, volumes and reserved IP addresses so it can look for savings. If you connected before they existed, apply a fresh stack to add them; the Cloud Accounts card shows a notice when that is needed.

Before you begin

An Oracle Cloud tenancy where you (or a colleague) can create IAM users, groups and policies.
An email address you control for the CostGlass user. A shared FinOps mailbox is ideal. It must not be used by any other user in the tenancy.
An owner or admin account in CostGlass, and room in your plan for another connection (see Manage accounts).
Your tenancy uses Identity Domains with a Default domain. The generated policy refers to the group as Default/CostGlassReadOnly.

Connect with Resource Manager (recommended)

Open the Oracle Cloud tab

Go to Settings → Cloud Accounts and open the Oracle Cloud tab. Read the heads-up box, then click Generate Keypair & Continue →. CostGlass creates the signing key pair for this connection. Nothing is created in your Oracle account yet.

Cloud Accounts → Oracle Cloud.

Download the stack

Under Step 1 — Download & deploy the stack click Download Stack (.zip). The file is called costglass-oci-readonly.zip and contains one Terraform file with the public key already filled in. The page also shows the key's fingerprint; keep it visible, you will compare it later.

Create the stack in Oracle

Click Open OCI Console (or go to Developer Services → Resource Manager → Stacks yourself), click Create stack and upload the zip. Resource Manager fills in tenancy_ocid and region from your session, and the signing key is pre-filled. It asks for one value: costglass_user_email. Enter the email address you chose.

Apply the stack

Click through the wizard and choose Apply. Wait until the job shows Succeeded. If it fails, open the job log. The most common causes are in the troubleshooting section below.

Copy the outputs

Open the stack, then its Outputs (or the job's outputs). Copy tenancy_ocid, costglass_user_ocid, region and, if you want the extra safety check, api_key_fingerprint.

Paste them into CostGlass and verify

Back in CostGlass, under Step 2 — Paste the stack outputs, fill in Tenancy OCID, CostGlass User OCID, OCI Region (home region) and, optionally, API key fingerprint (recommended). Click Verify & Connect Oracle Cloud.

Tip

Paste the fingerprint. If the stack you applied was made for a different key (for example before you chose Start over with a new key), CostGlass compares the two and tells you to download a fresh stack, instead of giving a vague sign-in error.

What each field means

Where	Field	What to enter
Resource Manager	`costglass_user_email`	An email address you control, unique in the tenancy. Oracle requires one for every user when Identity Domains are used. The user never signs in with it.
Resource Manager	`tenancy_ocid`	Filled in by Resource Manager. Leave it.
Resource Manager	`region`	Filled in by Resource Manager. Any region you can use works; it is only where the job runs.
Resource Manager	`costglass_public_key`	CostGlass's public key, already filled in. Do not edit.
CostGlass	Tenancy OCID	The tenancy_ocid output, starting ocid1.tenancy.
CostGlass	CostGlass User OCID	The costglass_user_ocid output, starting ocid1.user.
CostGlass	OCI Region (home region)	The region output. This is your tenancy home region, for example uk-london-1 or us-ashburn-1, not necessarily where you ran the stack.
CostGlass	API key fingerprint (recommended)	The api_key_fingerprint output. It must match the fingerprint shown in step 1.

What happens when you verify

CostGlass signs a real request with the stored private key and asks Oracle to list your Cost and Usage Reports bucket. There are three outcomes:

Result	What you see	What it means
Connected with data	A card for the tenancy with the last sync time and a record count.	Reports exist and were read.
Connected, reports pending	A green message saying Oracle has not published your first cost report yet.	Your key, user and tenancy are right, but the report bucket cannot be read yet. See the next section.
Rejected	A red message under the form.	The key, user or tenancy do not match, or the fingerprint is from a different key. Nothing is saved as active.

The same tenancy cannot be connected twice. A second attempt returns a message that it is already connected.

Waiting for the first report, resuming and starting over

Oracle generates cost reports roughly every six hours. For a tenancy that was only just created, the first report can take up to 24 hours, and a policy you applied a few minutes ago may need a short time to take effect. Until a report exists Oracle cannot be asked for it.

You do not need to wait at the screen

CostGlass connects straight away, shows the status waiting for the first report and checks again on its six-hourly schedule. If it is still waiting after about 48 hours the status changes to an error that names the likely cause, usually the policy.

Resume or start over

If you leave before pasting the outputs, the Oracle Cloud tab shows You have an unfinished Oracle Cloud connection with two buttons:

Button	What it does	When to use it
Resume this connection	Keeps the same signing key. The stack you already applied stays valid; you only paste its outputs again.	Almost always. For example when you applied the stack but have not verified yet.
Start over with a new key	Discards the unfinished connection and its stored key and generates a new key.	Only if you want a new key. You then need to apply a new stack, because the old stack carries the old public key.

Only one OCI connection can be mid-setup at a time; starting over replaces the unfinished one.

Using Terraform directly instead of Resource Manager

The downloaded zip is ordinary Terraform: one main.tf that uses the official oracle/oci provider. Resource Manager is just a convenient place to run it. If your organisation standardises on Terraform, runs it through its own pipeline or does not want to use the Oracle console for this, you can run the same file yourself. Nothing else changes: you still paste the same outputs into CostGlass.

Running it locally

Run the CostGlass stack with your own Terraform

You need Terraform installed and credentials for the OCI provider (the OCI CLI session or an API key in ~/.oci/config). These are yours; they are never sent to CostGlass.
The file only configures the provider with a region. In Resource Manager, tenancy and region come from your session; locally you pass them with -var as shown.
The public key is the default value of the costglass_public_key variable, so you do not need to supply it.
Use an identity that is allowed to create users, groups, API keys and policies in the tenancy root compartment.
Keep the Terraform state somewhere safe. It holds OCIDs and the public key only; there is no secret in it, because CostGlass never gives you the private key.
To remove CostGlass access later, run terraform destroy with the same variables, or delete the stack in Resource Manager, then disconnect the tenancy in CostGlass.

Warning

Do not edit the policy statements. In particular the define tenancy usage-report as … line uses a fixed ID that belongs to Oracle, the same for every customer. Changing it makes the policy silently useless.

Note

If your tenancy does not use the Default identity domain, or your own policies forbid creating a group there, adjust the group reference in your copy and test it. CostGlass has only tested the file as generated.

Connecting more than one tenancy

Once one tenancy is connected the tab lists it as a card, with the heading Connected Oracle Cloud tenancies. Click + Add another Oracle Cloud tenancy and repeat the steps with the other tenancy. Each tenancy has its own key, user and sync status, and one failing tenancy never stops the others syncing. Sync all appears when there are two or more. Every connection counts towards your plan's limit.

How syncing works and what you will see

CostGlass checks every six hours, or when you click Sync Now on a tenancy's card. Each card shows the last sync time, the status and the number of records.
Oracle's reports can be several hours behind, and on each pass CostGlass reads up to the most recent 60 report files rather than the whole history. Costs appear in Cost Explorer and Reports next to your other clouds.
The card shows the tenancy OCID and home region. CostGlass does not read compartment names for cost data, so budgets and filters apply to the tenancy as a whole.
Disconnecting asks you to confirm, stops reading reports and deletes the stored signing key. Cost data already collected is kept. Your own user, group and policy stay in Oracle until you remove them.

Troubleshooting

The stack fails with "The primary email must be specified".

Enter an email address for costglass_user_email. Tenancies that use Identity Domains refuse to create a user without one.

The stack fails because the email already exists.

The address must be unique across the tenancy. Use a different mailbox, or one that no other user has.

Verification says the key does not match the stack.

The stack you applied was made for a different key. Download the stack again from the current connection (or choose Start over with a new key and apply the new stack), then use that stack's outputs.

Verification fails with an authentication error.

Check the Tenancy OCID, the User OCID and that the region is your home region. A typo in any of them is rejected by Oracle before anything else is checked.

It connected but shows no data.

Probably the first report has not been published yet. Wait up to 24 hours. If the status turns into an error after about two days, check that the policy exists and contains the usage-report statements.

I ran the stack in a different region from my home region.

That is fine. Paste the region output, which is the home region. The reports live there.

The Cloud Accounts card says resource inventory needs a grant.

Your connection was made before the inventory statements existed. Download a new stack from a fresh connection, apply it, or add the five read-only statements listed above to your policy.

What CostGlass can and cannot do

It can read the cost reports and the read-only inventory the policy allows.
It cannot change, create or delete anything in your tenancy.
It has no console password and no administrator access.
The private signing key is stored only in CostGlass's encrypted secrets store and is not returned by any screen.

All Documentation Guides

Welcome to CostGlass — What CostGlass does, who it is for, how your data gets in, the plans and regions, and a plain-English glossary.
Quickstart: your first hour — Sign up, connect a first cloud, invite your team, set a budget and turn on anomaly alerts, with a first-week checklist.
Finding your way around — A tour of the sidebar, top bar and page controls: what every page answers, plan gating, currency, language, links and caching.
Dashboards — The Overview dashboard widget by widget, plus building custom dashboards you can share with your organisation.
Cloud Resources — The multi-cloud inventory: filters, search, categories, estimated cost, terminated resources and CSV or Excel export.
Uptime, incidents & support requests — Monitor public endpoints, route alerts, see incidents and raise requests to CostGlass engineers.
How CostGlass accesses your data — Security and data ingestion architecture: how CostGlass reads multi-cloud billing and telemetry through read-only roles and least-privilege permissions.
Dashboard & Platform Screenshot Tour — Visual walkthrough of the CostGlass interface with screenshots covering multi-cloud spend, Cost Explorer, anomalies, Kubernetes allocation, and savings.
Connecting your clouds: overview — Every cloud and service you can connect, how each one connects, what access it needs, how long data takes and your plan limits.
Connect AWS (CloudFormation) — Deploy the generated CloudFormation template, choose organization or single account and optional features, then verify.
Connect AWS with Terraform instead of CloudFormation — A Terraform equivalent of the generated AWS template, with an Organization variant and a way to compare it to the wizard.
Connect Azure — Admin consent for the CostGlass application, Reader and Cost Management Reader roles, management group or subscription scope, and a Terraform version.
Connect Google Cloud — Enable the FOCUS BigQuery export, run the IAM grants CostGlass prints, verify, and a Terraform version.
Managing connected accounts — The Cloud Accounts page: statuses, syncing, errors, naming, disconnecting, and the FOCUS 1.0 and CUR Export pages.
Connect Oracle Cloud (OCI) — Give CostGlass read-only access to Oracle Cost and Usage Reports with a Resource Manager stack or your own Terraform.
Connect Alibaba Cloud — Connect Alibaba Cloud through Bill Subscription files in OSS and a read-only RAM role created by a ROS template.
Connect DigitalOcean — Connect DigitalOcean accounts with a read-only personal access token and see invoices by month.
Connect Akamai / Linode — Connect Linode (Akamai Connected Cloud) accounts with an account read-only token.
Connect Cloudflare — Connect Cloudflare usage-based charges with a Billing Read account token and see credits and unpaid debt.
Connect OpenAI, Anthropic, Datadog and Snowflake — Connect AI and software vendors with admin keys or a Snowflake key pair so their spend sits beside your cloud costs.
Cost Explorer — Slice, compare and drill into spend across every connected cloud: group by, filters, charts, overlays, details, AI, links and export.
Saved views, saved filters & scheduled emails — Keep, share and email the Cost Explorer views you use often, and reuse include/exclude filters across views and reports.
Reports — Build, compare, export, save and schedule spend reports, with presets, Excel, CSV and PDF exports.
SaaS & AI Spend — Spend and token analytics for OpenAI, Anthropic, DeepSeek, Datadog, Snowflake and cloud AI services.
Unit Economics — Cost per business unit: define metrics, send volumes, set targets and alerts.
Connect a Kubernetes cluster — Install OpenCost and the CostGlass exporter in your cluster so cost data is pushed to CostGlass every 15 minutes.
Kubernetes Costs page — Understand cluster, namespace, workload and pod costs, idle capacity, rightsizing, carbon and health.
Tagging strategy: getting the most from tags — How to tag cloud resources, enforce tagging, and when to use cloud tags or virtual tags in CostGlass.
Tag Explorer — Group billed spend by the value of a tag, see tag coverage per cloud and drill into resources.
Tag Compliance — Define required AWS tags, measure compliance, and fix missing tags with Quick Tag, batch apply or a CLI script.
Virtual tagging — Allocate spend by team, product or environment with rules, no cloud changes, with a rule builder and CostGlass AI.
Forecasting — Forecast month-end spend, the next months and a yearly run-rate, and simulate the cost of changes.
Budgets — Create spending limits for a cloud, account, service or team, and see how CostGlass budgets differ from native AWS, Azure and Google budgets.
Anomaly detection — How CostGlass finds unusual daily cost, how to tune it, explain it and be notified.
Cost alerts — Alert when spend rises versus the previous day, week, month or quarter.
All alert and notification types — A comparison of every alert and notification in CostGlass, with channel setup and testing.
Issues & annotations — Dated notes on spend, and a lightweight issue tracker for cost work with Jira push.
Savings playbook — A prioritised, step-by-step programme for reducing your cloud bill, with a 30/60/90-day plan.
Savings recommendations — How the Savings page finds, prices and tracks savings for every connected cloud and platform.
Rightsizing — Find servers and databases that are too big, or too small, using real CPU and memory measurements.
Commitments: Savings Plans & Reserved Instances — Track coverage, utilisation, expiry and purchase recommendations for Savings Plans, Reservations and committed use discounts.
Instance Scheduler — Start and stop non-production servers on a weekly schedule to stop paying for idle hours.
Giving your team access — Invite people, choose Owner, Admin or Member roles, remove users and limit what they see.
Setting up your organisation hierarchy — Build a tree of nodes, place cloud accounts by hand, rule or CSV, and scope people to a branch.
Designing your hierarchy (with enterprise examples) — Principles and worked patterns for AWS Organizations, single accounts, multi-cloud groups, MSPs and regulated regions.
Single sign-on (SAML & OIDC) — Connect Okta, Entra ID, Google Workspace or another provider, verify your domain, test and require SSO.
API keys & AI assistants (MCP) — Create API keys and connect Claude Desktop, Cursor or Claude Code to your cost data.
Audit log — See who changed what and when, with before and after values, kept for 24 months.
Data residency & retention — Your fixed region, how long cost history is kept, purge now and the data handling summary.
Notification settings, Jira & chat — Weekly spend summary, Slack and Teams webhooks, and connecting Jira Cloud.
Troubleshooting & Common Setup Fixes — Solutions for common cloud connection and ingestion issues across AWS, Azure, Google Cloud, OCI, Alibaba Cloud, Kubernetes, and SSO.

Connect Oracle Cloud (OCI)