Cloud cost data needs a connection to each provider. Use a dedicated, read-only identity for KloudSentinel, never a personal or admin account.
Open the settings
- Open Cloud Costs.
- Open the billing settings, shown as Configure Cloud Billing.
- Choose GCP, AWS or Azure.
Saved secrets stay hidden. Leave a secret blank to keep the current value.
AWS
- In your AWS account, enable Cost Explorer. New accounts can take up to 24 hours to show data.
- Create an IAM user for KloudSentinel with
ce:GetCostAndUsageand other read-onlyce:permissions. - Create an access key for that user.
- Enter the Access Key ID and Secret Access Key.
Inventory and audit pages need read access to the services they cover, such as EC2, S3, RDS and IAM. AWS's SecurityAudit managed policy is a good starting point.
Azure
- Create an app registration (service principal).
- Give it the Cost Management Reader role on your subscription.
- Create a client secret.
- Enter the Subscription ID, Tenant ID, Client ID and client secret.
Azure has no credits API at subscription level, so enter any credit totals by hand.
Google Cloud
- Turn on billing export to BigQuery in your billing account. Data can take a day to appear.
- Create a service account with read access to that dataset, permission to run BigQuery jobs, and Recommender viewer access if you want recommendations.
- Download a JSON key for it.
- Enter the Billing Project and Billing Dataset, then upload the key.
Check the connection
The settings panel shows a status for each provider. If one fails, the message usually names the missing permission.
Costs refresh about once an hour, and you can refresh by hand on the page.