Connect a cloud account

Ingest a real cloud estate so Costs, Hunters, Governance, and the Savings Register populate with your data. leancosts is read-only — connecting grants read access only; it never writes to or mutates your cloud. For the full posture — encryption, tenant isolation, and sub-processors — see Security and data handling.

All connectors live on Admin → Connections. Pick your cloud’s tab.

Azure

1. Go to Admin → Connections → Azure.
2. Add connection opens the connect wizard:

   • One-Click Connect (device-code OAuth), when available, provisions the service principal, secret, and role assignments, validates, and kicks off the first sync for you.

   • Manual credentials otherwise: open Setup guide (or Download PDF) for the exact steps. Register an app, create a client secret, then assign the roles. The guide, the CLI snippet, and the PDF all split the grants into required and optional — with the consequence of skipping each — so nobody mistakes an optional step for a blocker:

     Required (the connection won’t validate without these) — at each subscription scope:

     • Reader — inventory: resource groups, resources, tags.
     • Cost Management Reader — the 13-month cost-history backfill.
     • Log Analytics Reader — lets the ingestion hunter run its KQL probes.

     Optional (each unlocks extra findings; safe to skip):

     • Reservations Reader at tenant scope — reservation / savings-plan utilization. Lives outside subscription RBAC, so it needs a Reservations Administrator or a Global Admin with elevated access. Skip → under-used RIs / Savings Plans stay invisible.
     • Backup Reader at subscription scope — Recovery Services Vault / backup over-retention findings. Skip → those vault findings stay dark.
     • Billing Account Reader at billing-account scope (EA/MCA) — your exact negotiated prices. Skip → savings use a derived discount factor instead.

     Paste tenant/client/secret into the wizard.

3. Hit Test, then save. The first healthy connection starts auto-discovery.

AWS

1. Go to Admin → Connections → AWS → Add connection. leancosts pre-fills your ExternalId and shows a ready-to-run role-creation snippet that already embeds it — you never hand-invent one. A Download PDF button gives a branded setup doc to hand to whoever owns the AWS account, and a collapsible permissions guide explains why each read-only grant is requested.
2. Run the snippet in your Organizations payer account. It creates a read-only cross-account IAM role (AWS-managed ReadOnlyAccess plus a small inline Cost Explorer / CUR read policy — nothing that can mutate a resource).
3. Paste the resulting role ARN back into leancosts and Test — the ExternalId is already filled in. (An access-key path exists for quick evaluation, but the cross-account role is the recommended posture.)
4. To slice AWS cost by your tags, activate them as cost-allocation tags in your AWS management account (Billing → Cost allocation tags). AWS cost data carries no per-resource tags, so until a key is activated, AWS spend shows as untagged under Costs → Cost by tag — Cost Explorer can only group cost by activated cost-allocation tags. Activation applies going forward (up to ~24h to populate) and leancosts picks the keys up automatically on the next sync. The connector setup panel and the Download PDF both repeat this step.

GCP

Go to Admin → Connections → GCP and follow the connector wizard. GCP hunters read the same canonical cost model as Azure/AWS; remediation ships as guided gcloud kits.

What happens on first sync

The moment a connection is healthy, auto-discovery ingests, with no “pick your subscriptions” prompt:

1. Subscriptions / accounts the connector can see.
2. Resources (Azure Resource Graph / AWS & GCP inventory APIs).
3. Resource groups (derived counts).
4. Tags — populated onto each resource; tag governance reads them directly.
5. Cost data — daily granularity for the current month + 12 prior months.

Watch progress in the global sync banner (top of every page) and the per-row progress strip on the connection. You only ever opt subscriptions out (a toggle), never in.

Trials: 7 days of full access

If you’re on a trial, the first completed sync of a cloud account opens the entire product for 7 days — every finding and every surface, no card. The window applies once per cloud account (ever), and access stays read-only by construction. When it ends, the savings total stays visible and subscribing brings everything back. Under the Micro monitored-spend band, leancosts is simply free while you stay under it — no window needed.

Verifying it worked

• Admin → Connections → Details → Identified permissions (Azure) shows, per role, whether leancosts has already observed it working — “Identified” with the evidence and date, “Gap detected” when your bill proves commitments exist that the connection cannot read (a missing or partial Reservations Reader grant), or “Not observed” when there is no evidence either way.
• Costs shows non-zero trend/daily data.
• Coverage shows your real resources under each required tag.
• Opportunities starts surfacing optimization findings as hunters fan out.

Troubleshooting

• Connection won’t validate — re-check the role assignments (Azure) or the ExternalId + trust policy (AWS). The Test button surfaces the failing call.
• No cost rows after sync — Cost Management/CUR data lags; the resource and tag phases complete first, costs follow. Re-open the connection console to see the cost phase progress.