Connecting your clouds: overview

Every cloud and service you can connect, how each one connects, what access it needs, how long data takes and your plan limits.

Connecting your clouds: overview

CostGlass reads cost and usage data from the clouds and services you connect. This page lists every source, how each one connects, what access you give, and how long data takes to appear.

Where in CostGlassSettings → Cloud Accounts

PlanAll plans (the number of connections depends on your plan)

Who can do thisOwner or Admin recommended

Time needed3 to 20 minutes per source

In short

Thirteen kinds of source can be connected: AWS, Azure, Google Cloud, Oracle Cloud, Alibaba Cloud, DigitalOcean, Linode, Cloudflare, Kubernetes, OpenAI, Anthropic, Datadog and Snowflake.
Almost everything is read-only. The only write access CostGlass ever asks for is the optional Instance Scheduler (start and stop of virtual machines).
Your cloud credentials are never typed into CostGlass for the big three: AWS uses a role you create, Azure uses admin consent, Google Cloud uses IAM grants.
Most sources sync every 6 hours. Kubernetes pushes every 15 minutes.
Your plan sets how many cloud connections you can have: Free 1, Starter 3, Growth 10, Scale 25, Enterprise unlimited.

Before you begin

Someone in your team who can create IAM roles, or the equivalent, in the cloud you are connecting (the individual guides say exactly which permission).
A CostGlass login. Owners and Admins should connect clouds.
For billing data, the cloud account that pays the bill (for AWS, the management or payer account).

Every source at a glance

The table shows the method each source uses, the access you grant, and when you can expect data. "Sync" means how often CostGlass reads new data after the first load.

Source	How it connects	Access you grant	First data	Sync
AWS	CloudFormation stack from the wizard (or Terraform)	A role CostGlass assumes, plus an S3 bucket that receives your Cost and Usage export. Read-only, except optional Instance Scheduler.	Up to 24 hours (AWS delivers the first export)	Every 6 hours
Azure	Microsoft admin consent, then two role assignments	Reader and Cost Management Reader on a subscription or management group. Optional VM scheduler role.	After the next sync following Verify	Every 6 hours
Google Cloud	FOCUS billing export in BigQuery plus IAM grants	BigQuery Data Viewer on the export dataset, BigQuery Job User and inventory roles on the project	At Verify, if Google has already delivered data	Every 6 hours
Oracle Cloud	Resource Manager stack creating an API user	A read-only user, group and policy in your tenancy	Up to 24 hours on a new tenancy	Every 6 hours
Alibaba Cloud	ROS template plus a Bill Subscription to your own OSS bucket	A read-only RAM role that can read that bucket	Up to a day	Every 6 hours
DigitalOcean	Personal access token	Read-only token (billing)	At connect	Every 6 hours
Linode (Akamai)	Personal access token	Account: Read Only	At connect	Every 6 hours
Cloudflare	Account API token plus Account ID	Account · Billing · Read	At connect	Every 6 hours
Kubernetes	Helm install of OpenCost plus a CostGlass agent manifest	The cluster pushes out to CostGlass. A read-only role for pods, nodes and volumes is optional.	Within 15 minutes	Every 15 minutes
OpenAI, Anthropic, Datadog, Snowflake	Admin API keys (Snowflake uses a key pair)	Read access to cost and usage reports	At connect	Every 6 hours

Note

Pages for Oracle Cloud, Alibaba Cloud, DigitalOcean, Linode, Cloudflare, Kubernetes and SaaS and AI sources are separate guides. Links above go to them.

Which method should I choose?

Only AWS offers more than one way in. For the rest, use the single method shown above.

Your situation	Use	Why
You use the AWS console and want the quickest route	AWS wizard (CloudFormation)	CostGlass builds the template for you with your unique External ID already inside.
Your team manages AWS with Terraform and reviews every change	AWS with Terraform	The same resources as code. You must keep it in step with the wizard yourself.
You have an AWS Organization with many accounts	AWS wizard, account type "AWS Organization"	Deploy once in the management account. Member accounts receive the role automatically.
You have one standalone AWS account	AWS wizard, account type "Single account"	One stack in that account.
Azure with several subscriptions	Azure admin consent, role at management group scope	One grant covers every subscription underneath.
Azure and your security team forbids third-party applications in Entra	Azure "bring your own service principal"	You create the principal and secret yourself. One subscription only.

The Cloud Integration Wizard

The wizard is the guided screen for adding a cloud. You see it in two places: on Settings → Cloud Accounts in the section Connect a New Cloud Account or Platform, and on the Cloud Connection Wizard screen shown after sign-up when nothing is connected yet. Both use the same component and give the same AWS template.

Settings → Cloud Accounts. Connected accounts are at the top; the wizard is below them.

The wizard has five steps, shown as chips along the top: Cloud, Features, Deploy, Verify, Connected.

Cloud

Pick a cloud card under Connect a cloud. AWS continues inside the wizard. Every other cloud opens its own connect screen (its tab on Cloud Accounts).

Features (AWS only)

Choose AWS Organization or Single account, then the features. See Connect AWS.

Deploy (AWS only)

Download or copy the generated template and create the stack in AWS.

Verify (AWS only)

Paste the stack outputs and click Verify & connect. CostGlass checks the access before saving anything.

Connected

Shows the delivery status. Integrate another starts again, for example for a second AWS Organization.

A meter at the top right of the wizard shows your usage, for example "2 of 3 connections used · Starter plan".

Plan limits on connections

Plan	Cloud connections
Free	1
Starter	3
Growth	10
Scale	25
Enterprise	Unlimited

A connection is one row in Cloud Accounts. An AWS Organization counts as one connection however many member accounts it has.
A connection you started but have not finished (status pending) counts until you finish or remove it. Resuming a pending AWS setup does not use extra quota.
When you are at the limit, connecting shows You have reached your plan's connection limit with a See plans and upgrade button.
The limit is checked when cloud connections are created. OpenAI, Anthropic, Datadog and Snowflake connectors and Kubernetes agents are not part of that check today.

Warning

Do not rely on this table if your contract says otherwise. The meter in the wizard always shows the limit that applies to you.

How long until I see data?

Token-based sources (DigitalOcean, Linode, Cloudflare, AI and SaaS) start syncing at once. Cloudflare may show no spend, see its guide.
AWS shows data only after AWS delivers the first export, up to 24 hours. Meanwhile the dashboard offers Fetch data now, a one-off pull from Cost Explorer. AWS charges $0.01 per request and the button tells you the cost first.
Azure fills in on the next 6-hourly sync after you click verify.
Kubernetes reports within 15 minutes of applying the manifest.

Can CostGlass change anything in my cloud?

No, with one opt-in exception: Instance Scheduler, which can start and stop the virtual machines and scaling groups you schedule. Leave it unticked and every connection is read-only.

Where are my credentials stored?

Tokens and keys you paste are checked against the provider first and then stored encrypted in a secrets vault, never in the database row. AWS, Azure (consent) and Google Cloud need no secret from you.

I lost my place halfway through. What now?

Open Cloud Accounts. Unfinished AWS, Azure and Oracle connections can be resumed from there; an unfinished one shows as pending.

Can I connect two accounts of the same provider?

Yes, within your plan limit. See Managing connected accounts.

All Documentation Guides

Welcome to CostGlass — What CostGlass does, who it is for, how your data gets in, the plans and regions, and a plain-English glossary.
Quickstart: your first hour — Sign up, connect a first cloud, invite your team, set a budget and turn on anomaly alerts, with a first-week checklist.
Finding your way around — A tour of the sidebar, top bar and page controls: what every page answers, plan gating, currency, language, links and caching.
Dashboards — The Overview dashboard widget by widget, plus building custom dashboards you can share with your organisation.
Cloud Resources — The multi-cloud inventory: filters, search, categories, estimated cost, terminated resources and CSV or Excel export.
Uptime, incidents & support requests — Monitor public endpoints, route alerts, see incidents and raise requests to CostGlass engineers.
How CostGlass accesses your data — Security and data ingestion architecture: how CostGlass reads multi-cloud billing and telemetry through read-only roles and least-privilege permissions.
Dashboard & Platform Screenshot Tour — Visual walkthrough of the CostGlass interface with screenshots covering multi-cloud spend, Cost Explorer, anomalies, Kubernetes allocation, and savings.
Connecting your clouds: overview — Every cloud and service you can connect, how each one connects, what access it needs, how long data takes and your plan limits.
Connect AWS (CloudFormation) — Deploy the generated CloudFormation template, choose organization or single account and optional features, then verify.
Connect AWS with Terraform instead of CloudFormation — A Terraform equivalent of the generated AWS template, with an Organization variant and a way to compare it to the wizard.
Connect Azure — Admin consent for the CostGlass application, Reader and Cost Management Reader roles, management group or subscription scope, and a Terraform version.
Connect Google Cloud — Enable the FOCUS BigQuery export, run the IAM grants CostGlass prints, verify, and a Terraform version.
Managing connected accounts — The Cloud Accounts page: statuses, syncing, errors, naming, disconnecting, and the FOCUS 1.0 and CUR Export pages.
Connect Oracle Cloud (OCI) — Give CostGlass read-only access to Oracle Cost and Usage Reports with a Resource Manager stack or your own Terraform.
Connect Alibaba Cloud — Connect Alibaba Cloud through Bill Subscription files in OSS and a read-only RAM role created by a ROS template.
Connect DigitalOcean — Connect DigitalOcean accounts with a read-only personal access token and see invoices by month.
Connect Akamai / Linode — Connect Linode (Akamai Connected Cloud) accounts with an account read-only token.
Connect Cloudflare — Connect Cloudflare usage-based charges with a Billing Read account token and see credits and unpaid debt.
Connect OpenAI, Anthropic, Datadog and Snowflake — Connect AI and software vendors with admin keys or a Snowflake key pair so their spend sits beside your cloud costs.
Cost Explorer — Slice, compare and drill into spend across every connected cloud: group by, filters, charts, overlays, details, AI, links and export.
Saved views, saved filters & scheduled emails — Keep, share and email the Cost Explorer views you use often, and reuse include/exclude filters across views and reports.
Reports — Build, compare, export, save and schedule spend reports, with presets, Excel, CSV and PDF exports.
SaaS & AI Spend — Spend and token analytics for OpenAI, Anthropic, DeepSeek, Datadog, Snowflake and cloud AI services.
Unit Economics — Cost per business unit: define metrics, send volumes, set targets and alerts.
Connect a Kubernetes cluster — Install OpenCost and the CostGlass exporter in your cluster so cost data is pushed to CostGlass every 15 minutes.
Kubernetes Costs page — Understand cluster, namespace, workload and pod costs, idle capacity, rightsizing, carbon and health.
Tagging strategy: getting the most from tags — How to tag cloud resources, enforce tagging, and when to use cloud tags or virtual tags in CostGlass.
Tag Explorer — Group billed spend by the value of a tag, see tag coverage per cloud and drill into resources.
Tag Compliance — Define required AWS tags, measure compliance, and fix missing tags with Quick Tag, batch apply or a CLI script.
Virtual tagging — Allocate spend by team, product or environment with rules, no cloud changes, with a rule builder and CostGlass AI.
Forecasting — Forecast month-end spend, the next months and a yearly run-rate, and simulate the cost of changes.
Budgets — Create spending limits for a cloud, account, service or team, and see how CostGlass budgets differ from native AWS, Azure and Google budgets.
Anomaly detection — How CostGlass finds unusual daily cost, how to tune it, explain it and be notified.
Cost alerts — Alert when spend rises versus the previous day, week, month or quarter.
All alert and notification types — A comparison of every alert and notification in CostGlass, with channel setup and testing.
Issues & annotations — Dated notes on spend, and a lightweight issue tracker for cost work with Jira push.
Savings playbook — A prioritised, step-by-step programme for reducing your cloud bill, with a 30/60/90-day plan.
Savings recommendations — How the Savings page finds, prices and tracks savings for every connected cloud and platform.
Rightsizing — Find servers and databases that are too big, or too small, using real CPU and memory measurements.
Commitments: Savings Plans & Reserved Instances — Track coverage, utilisation, expiry and purchase recommendations for Savings Plans, Reservations and committed use discounts.
Instance Scheduler — Start and stop non-production servers on a weekly schedule to stop paying for idle hours.
Giving your team access — Invite people, choose Owner, Admin or Member roles, remove users and limit what they see.
Setting up your organisation hierarchy — Build a tree of nodes, place cloud accounts by hand, rule or CSV, and scope people to a branch.
Designing your hierarchy (with enterprise examples) — Principles and worked patterns for AWS Organizations, single accounts, multi-cloud groups, MSPs and regulated regions.
Single sign-on (SAML & OIDC) — Connect Okta, Entra ID, Google Workspace or another provider, verify your domain, test and require SSO.
API keys & AI assistants (MCP) — Create API keys and connect Claude Desktop, Cursor or Claude Code to your cost data.
Audit log — See who changed what and when, with before and after values, kept for 24 months.
Data residency & retention — Your fixed region, how long cost history is kept, purge now and the data handling summary.
Notification settings, Jira & chat — Weekly spend summary, Slack and Teams webhooks, and connecting Jira Cloud.
Troubleshooting & Common Setup Fixes — Solutions for common cloud connection and ingestion issues across AWS, Azure, Google Cloud, OCI, Alibaba Cloud, Kubernetes, and SSO.

Connecting your clouds: overview