# OneLens Documentation

Everything you need to know about using OneLens to control cloud spend — all in one place.

### Welcome to the OneLens Manual!

Your guide to onboard, manage, and maximize cost visibility and savings across your cloud infrastructure through OneLens. 

Head to [Introduction to OneLens Capabilities](/getting-started/introduction-to-onelens-capabilities) to know more about what OneLens does.

***

## Getting Started

Set up OneLens and connect your environment with minimal effort.

<table data-card-size="large" data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-cover data-type="image">Cover image</th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h3>Connect to AWS</h3></td><td>Connect AWS accounts, deploy the required templates, and initiate data ingestion.</td><td><a href="/files/5JhK5XoGu5ytOq461eiq">/files/5JhK5XoGu5ytOq461eiq</a></td><td><a href="/pages/Jmz8pV6cekHgTKBPvHoK">/pages/Jmz8pV6cekHgTKBPvHoK</a></td></tr><tr><td><h3>Connect to Azure</h3></td><td>Connect Azure Subscriptions, Management Groups, or Resource Groups.</td><td><a href="/files/epBzjIoUc3wIPpGOAM4j">/files/epBzjIoUc3wIPpGOAM4j</a></td><td><a href="/pages/7NdTDdXrv8OKjlY7AqNX">/pages/7NdTDdXrv8OKjlY7AqNX</a></td></tr><tr><td><h3>Connecting to GCP</h3></td><td>Connect GCP Projects, Folders or Organisation.</td><td><a href="/files/YUIZGCiIw5uMSNVzQwXo">/files/YUIZGCiIw5uMSNVzQwXo</a></td><td><a href="/pages/pfRGy8jOeo5dgH0zl8rk">/pages/pfRGy8jOeo5dgH0zl8rk</a></td></tr><tr><td><h3>Connecting to OCI</h3></td><td>Connect OCI Tenancies, Compartments or Resource families.</td><td><a href="/files/NdTTaLG8Gvh6a6FwO7S1">/files/NdTTaLG8Gvh6a6FwO7S1</a></td><td><a href="/pages/zBK4P0Om8tZF84GtT0mT">/pages/zBK4P0Om8tZF84GtT0mT</a></td></tr><tr><td><h3>Kubernetes Integration</h3></td><td>Deploy the OneLens agent to capture Kubernetes cost and usage metrics.</td><td><a href="/files/bJ0OpXbch7vhFfU4FjFO">/files/bJ0OpXbch7vhFfU4FjFO</a></td><td><a href="/pages/37ELYFHcHx6ysp5eR39g">/pages/37ELYFHcHx6ysp5eR39g</a></td></tr><tr><td><h3>Onboarding Users</h3></td><td>Add users, assign access levels, and configure organization-wide roles.</td><td><a href="/files/U1gqpZgYfIicIxrvGD5P">/files/U1gqpZgYfIicIxrvGD5P</a></td><td><a href="/pages/a4evRaIQz4ijB7QFlHUk">/pages/a4evRaIQz4ijB7QFlHUk</a></td></tr><tr><td><h3>Third Party Integrations</h3></td><td>Integrate OneLens with tools like Jira and Slack for alerts, ticketing, and notifications.</td><td><a href="/files/2MfrG1d0QxyDx29Q8VYS">/files/2MfrG1d0QxyDx29Q8VYS</a></td><td><a href="/pages/SlLtluz7I9W2XOhIvrUt">/pages/SlLtluz7I9W2XOhIvrUt</a></td></tr></tbody></table>

***

## User Guides

Explore OneLens core capabilities categorized into four pillars.

<table data-card-size="large" data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-cover data-type="files"></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h3>Observe</h3></td><td>Visualize cost, usage, resource-level data, and anomalies across environments.</td><td><a href="/files/wTmSMqH0cY9XjBrK2FWn">/files/wTmSMqH0cY9XjBrK2FWn</a></td><td><a href="/pages/P3wIna4eIPdzOh1h3PC6">/pages/P3wIna4eIPdzOh1h3PC6</a></td></tr><tr><td><h3>Optimize</h3></td><td>Uncover inefficiencies and cost-saving insights with policy-based recommendations.</td><td><a href="/files/BxtQzE4G1q3yahZp7OHA">/files/BxtQzE4G1q3yahZp7OHA</a></td><td><a href="/pages/ibiVsqOKtBvGAVFXSPnA">/pages/ibiVsqOKtBvGAVFXSPnA</a></td></tr><tr><td><h3>Automate</h3></td><td>Streamline operations with ticket generation, customizable workflows, and executable runbooks.</td><td><a href="/files/rOviKS5k6L6k3IhYxTNS">/files/rOviKS5k6L6k3IhYxTNS</a></td><td><a href="/pages/kKuUGjOzsKnyHm1yS6k4">/pages/kKuUGjOzsKnyHm1yS6k4</a></td></tr><tr><td><h3>Govern</h3></td><td>Enforce accountability with cost optimization policies, and set budgets to control overspend.</td><td><a href="/files/BtIXhX6KF11ABsFDTJzR">/files/BtIXhX6KF11ABsFDTJzR</a></td><td><a href="/pages/hWJIdb2BreoVsCgOuRgk">/pages/hWJIdb2BreoVsCgOuRgk</a></td></tr></tbody></table>

***

## Help & Support

Resolve issues quickly or clarify common questions.

<table data-card-size="large" data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th><th data-hidden data-card-cover data-type="files"></th></tr></thead><tbody><tr><td><h4>Facts &#x26; FAQs</h4></td><td>Answers to common questions and key details about using OneLens effectively.</td><td><a href="/pages/ZQDzzeHCP1aDcpNiQWuK">/pages/ZQDzzeHCP1aDcpNiQWuK</a></td><td><a href="/files/G5Edh4EM66Xati4HorXg">/files/G5Edh4EM66Xati4HorXg</a></td></tr></tbody></table>

{% hint style="success" %}

## OneLens Support Team

For questions or support, reach out to our OneLens team at **<support@astuto.ai>**
{% endhint %}


# Introduction to OneLens Capabilities

OneLens is a unified cloud cost platform built to help organizations observe spend, optimize usage, automate actions, and govern infrastructure through policies. OneLens simplifies identifying inefficiencies, prioritizing savings, and acting with confidence at scale.

OneLens supports AWS, Azure, GCP, and OCI, with Kubernetes support for EKS and AKS.

## Core Capabilities

### [Observe](/observe-visibility-and-insights/cost-reporting)

Gain visibility into your cloud cost and usage:

* [**Cost Reporting**](/observe-visibility-and-insights/cost-reporting)\
  Analyze historical trends and cost breakdowns across multiple dimensions—including accounts, services, regions, usage types, cost centers, and custom groupings.
* [**Cost Watcher**](/observe-visibility-and-insights/cost-watcher)\
  Monitor anomalies, spikes, and new resources with root cause insights.
* **Cost Allocation**\
  Organize spend using up to four-level groupings with tags, accounts, and cost centers.
* [**Service Cost Monitoring**](/observe-visibility-and-insights/service-cost-monitoring)\
  Track service-level costs and detect usage patterns contributing to increased spend.

### [Optimize](/optimize-cost-savings-and-recommendations/saving-dashboard)

Discover and prioritize cloud cost savings:

* [**Savings Dashboard**](/optimize-cost-savings-and-recommendations/saving-dashboard)

  View total potential savings, top opportunities by account, service, and region.
* [**Policy Violations**](/optimize-cost-savings-and-recommendations/policy-violations)

  Identify inefficiencies flagged by built-in automated policies.
* [**S3 Optimization**](/optimize-cost-savings-and-recommendations/s3-optimization)

  Review storage costs per bucket and get insights to reduce storage cost.
* **Rate Optimization**\
  Identify cost-saving opportunities through better rate plans or commitments.

### [Automate](/automate/approvals)

Accelerate action through automation:

* [**Workflows**](/automate/workflows-and-automation)

  Automate alerts, reports, and ticketing through custom-built workflows (series, parallel, hybrid).
* #### [**Tickets**](/automate/ticketing-and-work-management)

  Track optimization recommendations and assign them for resolution.
* [**Remediations**](/automate/remediations)\
  Use prescriptive Runbooks to resolve issues quickly and consistently.
* **Approvals**

  Integrate with third-party tools like Jira or ServiceNow to manage approval steps before executing critical actions.
* **Schedulers**\
  Set up recurring reports and automated triggers for seamless operations.

### [Govern](/govern-control-and-governance/cost-optimization-policies)

Maintain cloud efficiency using policies:

* [**Policies**](/govern-control-and-governance/cost-optimization-policies)

  Run 90+ built-in policies daily to detect and track architectural inefficiencies.
* **Budgeting**\
  Set cost limits at account or cost center level to proactively manage spend.


# OneLens Operational Cost

This page details the operational costs associated with setting up the OneLens integration with various Cloud Platforms and Kubernetes.

## Amazon Web Services (AWS)

The following table outlines the key cost components associated with the integration to help you estimate costs for your AWS infrastructure.

<table data-full-width="false"><thead><tr><th width="230.42578125">Feature</th><th width="295.85546875">Unit of Usage</th><th width="188.71875">Estimated Cost</th></tr></thead><tbody><tr><td><a href="#cost-optimization-policies"><strong>Cost Optimization Policies</strong></a></td><td>~10,000 Resources</td><td>~$0.7 per day</td></tr><tr><td><a href="#cost-estimate-based-on-storage-size"><strong>Cost Reporting</strong></a></td><td>100 GB CUR</td><td>~$2.30 per month</td></tr><tr><td><a href="#automated-remediation"><strong>Automated Remediation</strong></a></td><td>1 Runbook execution <em>(after free tier)</em></td><td>~$0.31 per execution</td></tr><tr><td><a href="#agent-cost-based-on-number-of-pods"><strong>Kubernetes Agent</strong></a></td><td>Monitoring 500 pods</td><td>~$6 per month</td></tr><tr><td><a href="#additional-cost-for-split-allocation-in-eks"><strong>EKS Split Allocation</strong></a></td><td>10,000 pods</td><td>~$2.73 per month</td></tr></tbody></table>

{% hint style="warning" %}
These are *illustrative estimates*. Actual cost may vary based on your **workloads** and **AWS pricing region**.&#x20;
{% endhint %}

{% hint style="success" %}
For general understanding, the **simplified version of OneLens** that is without automated remediation and K8 Agent, the cost will be **less than $10/month**.&#x20;

The remaining cost is highly variable:

* **Remediations**: It depends on the number of runs you execute.
* **Kubernetes Agent**: It varies based on the number of pods you run simultaneously.
  {% endhint %}

The sections below breaks down where charges apply and how they’re calculated:

### Costs incurred for Optimization Policies

OneLens cost optimization policies targets **to find cost optimization opportunities** in your AWS resources with 3 types of datasets:

1. **Resource metadata** that tells the resource configuration
2. **Resource metrics** relevant to policy evaluation
3. **Cost and Usage Report (CUR)** data

{% hint style="info" %}

## Few examples to understand this better

* Evaluating GP2 EBS volumes for migration to GP3, and identifying EC2 instances suited for Graviton, both rely entirely on resource configuration.
* Evaluating underutilized instance in EC2, RDS, MSK requires resource configuration and metrics data.
* Finding idle resources will combine resource configuration, metrics and cost data.
  {% endhint %}

### Costs incurred for Resource and Metric Data Extraction

OneLens leverages the **official AWS SDK** **to collect** both resource and metric cost data. Currently, it onboarded **15 AWS services** and gathers only the metadata and metrics related to these specific services.&#x20;

**Retrieving resource metadata is entirely free.** However, the cost is incurred in getting the metrics information. OneLens collect CloudWatch metrics using the **`GetMetricData`** API, typically charged at $.01 for 1000 API calls.&#x20;

Costs are primarily driven by the number of API calls, calculated using the following formula:

> **Total API Calls per day = Σ (#Metrics × Resources)**

Where:

* **Metrics**: The number of CloudWatch metrics collected per resource (varies by service).
* **Resource Count**: The number of resources available in your accounts for each service.

{% hint style="success" %}

## NOTE

The cost of extracting metrics does not depend on your Cloud bill but actual number of resources under the services OneLens monitor.&#x20;

For instance, a small bill of $50K/year bill may have 1 million resources, leading to high cost. Whereas, a $10M/year account may have a few resources (such as costly GPU machines).
{% endhint %}

<details>

<summary>Sample Estimate</summary>

For simplicity, lets assume you have 10000 EC2 instances and  100 resources across 14 other services we observe. The table below simplifies the calculations for this infrastructure:&#x20;

<table><thead><tr><th width="228.3828125">Service (Namespace)</th><th width="100.51953125"># Metrics</th><th># Resources</th><th width="118.67578125">API Calls/Day</th><th>Cost/Day ($)</th></tr></thead><tbody><tr><td>AWS/EC2</td><td>7</td><td>10,000</td><td>70,000</td><td>0.70</td></tr><tr><td>AWS/RDS</td><td>6</td><td>100</td><td>600</td><td>0.006</td></tr><tr><td>AWS/DynamoDB</td><td>3</td><td>100</td><td>300</td><td>0.003</td></tr><tr><td>AWS/ElastiCache</td><td>27</td><td>100</td><td>2,700</td><td>0.027</td></tr><tr><td>AWS/ApplicationELB</td><td>1</td><td>100</td><td>100</td><td>0.001</td></tr><tr><td>AWS/NetworkELB</td><td>1</td><td>100</td><td>100</td><td>0.001</td></tr><tr><td>AWS/GatewayELB</td><td>1</td><td>100</td><td>100</td><td>0.001</td></tr><tr><td>AWS/PrivateLinkEndpoints</td><td>1</td><td>100</td><td>100</td><td>0.001</td></tr><tr><td>AWS/Redshift</td><td>2</td><td>100</td><td>200</td><td>0.002</td></tr><tr><td>AWS/ES</td><td>13</td><td>100</td><td>1,300</td><td>0.013</td></tr><tr><td>AWS/S3</td><td>3</td><td>100</td><td>300</td><td>0.003</td></tr><tr><td>CWAgent</td><td>2</td><td>100</td><td>200</td><td>0.002</td></tr><tr><td>AWS/Lambda</td><td>4</td><td>100</td><td>400</td><td>0.004</td></tr><tr><td>LambdaInsights</td><td>1</td><td>100</td><td>100</td><td>0.001</td></tr><tr><td>AWS/NATGateway</td><td>5</td><td>100</td><td>500</td><td>0.005</td></tr><tr><td><strong>Total</strong></td><td><strong>77</strong></td><td></td><td><strong>76,000</strong></td><td><strong>0.76</strong></td></tr></tbody></table>

</details>

### Costs incurred for Reporting (CUR 2.0)

The cost you incur here is for storing the Cost and Usage Report (CUR 2.0) in your S3 bucket. You are charged for the storage of the CUR report before OneLens ingests the data for analysis and provides granular insights.

<details>

<summary>Cost Estimate Based on Storage Size</summary>

| **Storage Size** | **Approx. Cost per Month** |
| ---------------- | -------------------------- |
| 100 GB -500 GB   | $2.30 - $11.50             |
| 500GB – 1 TB     | $11.50 - $23.00            |
| 1 TB – 2 TB      | $23.00 - $46.00            |

{% hint style="success" %}
The AWS cost pricing for storage is based on the region where the bucket is stored. To get the exact cost as per your region, head to [AWS S3 pricing](https://aws.amazon.com/s3/pricing/).
{% endhint %}

</details>

### Costs incurred for Automated Remediation

When automated remediation is enabled, you are charged based on the AWS Systems Manager services used during runbook execution via Change Manager and Systems Manager Automation.

<details>

<summary>Charges Based on AWS Pricing</summary>

| Components       | Cost                | Free Tier Limits                   |
| ---------------- | ------------------- | ---------------------------------- |
| Change Request   | $0.296 per request  | 30 days free trial per new account |
| Automation Steps | $0.002              | Upto 100,000 steps/month           |
| Script Duration  | $0.00003 per second | Upto 5,000 seconds/month           |

</details>

{% hint style="warning" %}
**NOTE** : Charges apply after exceeding the **free tier limits**.
{% endhint %}

<details>

<summary><strong>Estimate Example</strong>: Cost for running EBS volumes migration from gp2 to gp3 runbook</summary>

After exhausting your free tier, here’s the breakdown of the charges for a runbook called **migrating EBS volumes from gp2 to gp3**:

| Component        | Units       | Price Per Unit | Total Cost              |
| ---------------- | ----------- | -------------- | ----------------------- |
| Change Request   | 1 request   | $0.296         | $0.296                  |
| Automation Steps | 7 steps     | $0.002         | $0.014                  |
| Script Duration  | 1-5 seconds | $0.00003       | $0.00003 - $0.00015     |
| **Total**        | **-**       | **-**          | **$0.31003 - $0.31015** |

</details>

### Costs incurred for K8s Visibility and Optimization

#### OneLens Agent

The OneLens agent runs as a set of lightweight pods within the cluster. These pods monitor container-level metrics, resource limits, and usage trends. The cost structure is mainly influenced by the number of pods in the cluster.

<details>

<summary>Agent Cost based on Number of Pods</summary>

The agent incurs a variable cost per cluster, based on pod count:

| Cluster Size (Pods) | CPU (Cores) | Memory (GB) | Total Monthly Cost ($) |
| ------------------- | ----------- | ----------- | ---------------------- |
| < 100               | 0.237       | 1.33        | \~ $3                  |
| 100-499             | 0.386       | 1.92        | \~ $6                  |
| 500-999             | 0.587       | 3.70        | \~ $17                 |
| 1000-1499           | 0.696       | 5.47        | \~ $22                 |
| 1500-2000           | 0.805       | 7.25        | \~ $27                 |

</details>

Please note that we run our agent pods on shared nodes. The given pricing is an indication and actual price depends on node which the pods are placed.

Refer to the [Agent Setup](/integrations/kubernetes/onelens-agent) for more details on how the agent works and how to deploy it.

#### Split Allocation in EKS

You may incur an estimated <kbd>**$2.73/month per 10,000 pods**</kbd> due to increased CUR data size and processing overhead.

Refer to the [Split Allocation Setup Guide](/integrations/kubernetes/enable-split-cost-allocation-for-eks) for steps to enable this option and understand its cost implications.

## Google Cloud Platform (GCP)

The following table outlines the key cost components associated with the integration to help you estimate costs for your GCP infrastructure.

<table><thead><tr><th width="253">Feature</th><th width="221">Unit of Usage</th><th width="218">Estimated Cost per month</th></tr></thead><tbody><tr><td>Cost Reporting (BigQuery Storage)</td><td>100 GiB billing data stored</td><td>~$1.50</td></tr><tr><td>Cost Reporting (BigQuery Queries)</td><td>1 TiB data scanned</td><td>~$6.25 per TiB</td></tr><tr><td>Cost Reporting (BigQuery Storage Read API)</td><td>1 TiB bulk read</td><td>~$1.10 per TiB</td></tr><tr><td>Resource Rightsizing / Optimization</td><td>~500 API calls per project</td><td>Free</td></tr><tr><td>Cloud Monitoring API</td><td>1000 API read calls</td><td>~$0.01 per 1K calls</td></tr><tr><td>IAM</td><td>IAM bindings to Service Account &#x26; External User</td><td>Free</td></tr><tr><td>API Enablement</td><td>15 APIs per project</td><td>Free</td></tr><tr><td>Network Egress</td><td>Per GiB transferred cross-region</td><td>~$0.12 per GiB (0-1 TiB)<br>~$0.11 per GiB (1-10 TiB)</td></tr></tbody></table>

{% hint style="warning" %}
All prices are as of February 2026 and based on standard US multi-region pricing. Actual costs may vary based on workload characteristics, query patterns, and GCP pricing updates.
{% endhint %}

Google provides generous free tiers for various usage types, relevant to our setup. Also, costs incurred for the setup largely depends on the number of projects your organisation is onboarding onto OneLens.&#x20;

Considering the above, we have listed approximate pricing for various scales applying the free tier discount (and without, as your other workloads may have exhausted the quota).

### Cost Summary (with Free tier)

<table><thead><tr><th width="229">Category</th><th width="102">10 Projects</th><th width="111">50 Projects</th><th width="110">100 Projects</th><th width="105">500 Projects</th><th width="105">1000 Projects</th></tr></thead><tbody><tr><td>BigQuery Storage</td><td>$0.00</td><td>$0.00</td><td>$0.10</td><td>$1.00</td><td>$2.12</td></tr><tr><td>BigQuery Queries</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$3.12</td><td>$12.50</td></tr><tr><td>BigQuery Storage Read API</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td></tr><tr><td>Cloud Monitoring</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td></tr><tr><td>IAM and Service Accounts</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td></tr><tr><td>API Enablement and Read Calls</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td></tr><tr><td>Network Egress</td><td>$1.38</td><td>$6.72</td><td>$13.44</td><td>$65.53</td><td>$133.02</td></tr><tr><td><strong>Total Monthly Cost</strong></td><td><strong>$1.38</strong></td><td><strong>$6.72</strong></td><td><strong>$13.54</strong></td><td><strong>$69.65</strong></td><td><strong>$147.64</strong></td></tr></tbody></table>

### Cost Summary (without Free tier)

<table><thead><tr><th width="189">Category</th><th width="108">10 Projects</th><th width="111">50 Projects</th><th width="106">100 Projects</th><th width="109">500 Projects</th><th width="105">1000 Projects</th></tr></thead><tbody><tr><td>BigQuery Storage</td><td>$0.02</td><td>$0.11</td><td>$0.23</td><td>$1.12</td><td>$2.25</td></tr><tr><td>BigQuery Queries</td><td>$0.31</td><td>$1.22</td><td>$2.44</td><td>$9.38</td><td>$18.75</td></tr><tr><td>BigQuery Storage Read API</td><td>$0.01</td><td>$0.05</td><td>$0.11</td><td>$0.54</td><td>$1.10</td></tr><tr><td>Cloud Monitoring</td><td>$0.02</td><td>$0.10</td><td>$0.20</td><td>$1.00</td><td>$2.00</td></tr><tr><td>IAM and Service Accounts</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td></tr><tr><td>API Enablement and Read Calls</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td></tr><tr><td>Network Egress</td><td>$1.38</td><td>$6.72</td><td>$13.44</td><td>$65.53</td><td>$133.02</td></tr><tr><td><strong>Total Monthly Cost</strong></td><td><strong>$1.74</strong></td><td><strong>$8.20</strong></td><td><strong>$16.42</strong></td><td><strong>$77.57</strong></td><td><strong>$157.12</strong></td></tr></tbody></table>

Next, let's go through each integration component to break down the costs associated.

### Costs incurred for BigQuery

This includes the cost of setting up a Detailed Usage cost report in GCP, to be ingested by OneLens for pinpointing your costs. Three components make up this cost:

<details>

<summary>BigQuery Storage</summary>

Pricing:

* Active (modified < 90 days): **$0.02/GiB/month**
* Long-term (unmodified > 90 days): **$0.01/GiB/month** (auto-transition, no action needed)
* **Free Tier:** First **10 GiB** free per month.

</details>

<details>

<summary>BigQuery Queries (On-Demand)</summary>

* **Pricing:** **$6.25/TiB** of data processed (US multi-region on-demand).
* **Free Tier:** First **1 TiB/month** free.

</details>

<details>

<summary>BigQuery Storage Read API</summary>

* **Pricing:** **$1.10/TiB** of data read via the Storage Read API.
* **Free Tier:** First **300 TiB/month** free per billing account — this is an extremely generous free tier.
* *Note: Even at 1,000 projects (< 1 TiB/month), this stays well within the 300 TiB free tier. This component is **effectively always $0.00**.*

</details>

### Costs incurred for Cloud Monitoring API Reads

This is the cost due to querying the Cloud Monitoring API to read metrics on target projects.

<details>

<summary>Cloud Monitoring</summary>

* **Pricing:** **$0.01 per 1,000 read API calls** after free tier.
* **Free Tier:** First **1,000,000 read calls** per billing account per month.
* At 1,000 projects × \~200 monitoring calls = \~200K calls/month - within the 1M free tier.
* If free tier is exhausted: 200K × ($0.01/1K) = **$2.00/month** at 1,000 projects.

</details>

### Costs incurred for Network Egress

This cost consists of the data transfer from your BigQuery dataset to our environment.

<details>

<summary>Network Egress</summary>

Egress volume estimates:

* 10 projects: 1.50 GiB results + 10 GiB Storage API = 11.50 GiB -> $1.38/month
* 50 projects: 6.00 GiB + 50 GiB = 56.00 GiB -> $6.72/month
* 100 projects: 12.00 GiB + 100 GiB = 112.00 GiB -> $13.44/month
* 500 projects: 46.08 GiB + 500 GiB = 546.08 GiB -> $65.53/month
* 1,000 projects: 92.16 GiB + 1,024 GiB = 1,116.16 GiB -> (1,024 x $0.12) + (92.16 x $0.11) = $133.02/month

</details>

### Other Components (Free)

These operations are either provided free of charge by Google or well under the free tier limits.

<details>

<summary>IAM</summary>

* Creation of Service Account
* Creation of External User
* Assigning of roles at Organization-level for Service Account and External User
* Assigning of roles at Project/Folder-level for Service Account and External User
* Assigning of roles at Billing Account-level for Service Account and External User
* Assigning of roles at Billing Project-level for Service Account and External User

</details>

<details>

<summary>APIs</summary>

* Enabling APIs at Project-level and Billing Project-level
* API Read calls for metadata & metrics
* Service Account Impersonation (Token Creator API)

</details>

<details>

<summary>Billing</summary>

* Creating a Billing Project (with a BigQuery dataset)
* Enabling Detailed Usage report

</details>

## Microsoft Azure

The following table outlines the key cost components associated with the integration to help you estimate costs for your Azure infrastructure.

<table><thead><tr><th width="226">Feature</th><th width="282">Unit of Usage</th><th width="152">Estimated Cost per month</th></tr></thead><tbody><tr><td>Cost Reporting (Storage)</td><td>45 GB billing data stored (500 subs after 12 months)</td><td>~$1.07</td></tr><tr><td>Cost Reporting (Write Operations)</td><td>60K write operations per month (500 subs)</td><td>~$0.30</td></tr><tr><td>Cost Reporting (Read Operations)</td><td>60K read operations per month (500 subs)</td><td>~$0.02</td></tr><tr><td>Azure Resource Manager API Calls</td><td>Per call</td><td>Free</td></tr><tr><td>IAM</td><td>IAM bindings to App Registration &#x26; External User</td><td>Free</td></tr><tr><td>Resource Provider Enablement</td><td>Per provider</td><td>Free</td></tr><tr><td>Network Egress (same region)</td><td>Per GB</td><td>Free</td></tr></tbody></table>

Considering different scales (by number of Subscriptions) and free tiers provided by Microsoft for various usage types, we have listed approximate pricing for this setup.

### Cost Summary

<table><thead><tr><th width="294">Feature</th><th width="95">5 Subs</th><th width="106">20 Subs</th><th width="104">50 Subs</th><th width="110">200 Subs</th><th width="112">500 Subs</th></tr></thead><tbody><tr><td>Cost Reporting (Blob Storage)</td><td>$0.01</td><td>$0.04</td><td>$0.11</td><td>$0.43</td><td>$1.07</td></tr><tr><td>Cost Reporting (Write Ops)</td><td>$0.00</td><td>$0.01</td><td>$0.03</td><td>$0.12</td><td>$0.30</td></tr><tr><td>Cost Reporting (Read Ops)</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.01</td><td>$0.02</td></tr><tr><td>Cost Management Exports</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td></tr><tr><td>Resource Rightsizing / Optimization</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td></tr><tr><td>Identity and Access Management</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td></tr><tr><td>Network Egress (Same-Region)</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td></tr><tr><td>Total Monthly Cost</td><td>$0.01</td><td>$0.06</td><td>$0.14</td><td>$0.56</td><td>$1.40</td></tr></tbody></table>

Next, let's go through each integration component to break down the costs associated.

### Costs incurred for Blob Storage

This is the cost attributed to storing and performing operations on the cost export data. This cost is divided into 3 parts:

<details>

<summary>Blob Storage</summary>

* **Cost:** $0.0238/GB/month (Hot LRS, South India, first 50 TB) + operations costs.
* After 12 months at 500 subscriptions (Typical Enterprise profile): \~45 GB → $1.07/month storage cost.
* **Storage sizing:** Based on Microsoft's reference of \~1M rows ≈ 1 GB CSV data, with \~30K rows/sub/month (typical enterprise), 2 exports, and Parquet+Snappy 8x compression.

</details>

<details>

<summary>Blob Write Operations</summary>

* **Pricing:** $0.05 per 10,000 write operations (Hot tier, South India).
* **Volume:** \~4 writes per subscription per day (2 exports x 2 files each) = \~120 writes/sub/month.
* At 500 subscriptions: 60,000 writes x ($0.05/10K) = $0.30/month.

</details>

<details>

<summary>Blob Read Operations</summary>

* **Pricing:** $0.004 per 10,000 read operations (Hot tier, South India).
* **Volume:** \~4 reads per subscription per day = \~120 reads/sub/month.
* At 500 subscriptions: 60,000 reads x ($0.004/10K) = $0.024/month.
* Extremely small cost, negligible at all scales.

</details>

### Other Components (Free)

These operations are either provided free of charge by Microsoft or well under the free tier limits.

<details>

<summary>Billing</summary>

* Azure Cost Management service
* Cost exports

</details>

<details>

<summary>IAM</summary>

* Creation of App Registration
* Creation of External User
* Roles assigned to App Registration
* Roles assigned to External User

</details>

<details>

<summary>APIs</summary>

* Enabling of Resource Providers
* API calls to Azure Resource Manager

</details>


# Onboarding Guide

Get started in just a few steps.

### **Connect Your Cloud Account**

Connect at least one cloud account to enable OneLens to begin analyzing your costs and resources.

Choose your cloud provider and follow the relevant connection guide:

* **AWS** - [**Connect your AWS**](/integrations/cloud-and-cost-sources/connect-to-aws) account. This enables OneLens to begin analyzing your selected resources along with cost and usage data via CUR.
* **Azure** - [**Connect your Azure**](/integrations/cloud-and-cost-sources/connecting-to-azure) subscription or management group. OneLens will pull cost data via actual & amortized cost exports.
* **GCP** - [**Connect your GCP**](/integrations/cloud-and-cost-sources/connecting-to-gcp) billing account. OneLens will ingest cost data from BigQuery cost exports.
* **OCI** - [**Connect your OCI**](/integrations/cloud-and-cost-sources/connecting-to-oci) tenancy. OneLens will pull cost data via Oracle's cost exports.

### **Wait for Data Processing**

Once connected, OneLens will begin ingesting your AWS data. Initial processing may take a few hours depending on data size.

### **Explore Insights**

After data is processed, access dashboards for cost optimization, anomaly detection and optimization opportunities.

### **Integrate Kubernetes (AKS/EKS)**

Enhance your insights by [**integrating your Kubernetes clusters**](/integrations/kubernetes) to get a unified view across cloud and containerized workloads.


# Onboarding Users to OneLens

## Overview

To ensure **secure and role-appropriate access** across your organization, OneLens requires all  other team users to be **explicitly added by an Admin user**. Without this setup, team members cannot sign in or interact with the platform.

Through the following setup you can also:&#x20;

* **Control** over who has access to OneLens.
* **Align permissions** with user roles and personas.
* Maintain **organizational governance** over their cost visibility and actions.

{% hint style="warning" %}

## NOTE

Only users with the **"Admin"** user type can add or manage other users in OneLens. Make sure you log in with an **admin account**.
{% endhint %}

## Adding a  New User

{% stepper %}
{% step %}
**Log in with Admin Access**

Sign in to [OneLens UI](https://app-in.onelens.cloud/) using an email that has **admins privileges.**
{% endstep %}

{% step %}
**Go to User Settings**

* Click **Settings** in the left sidebar.
* Under the **Organization** section, select **User Settings**.

  <figure><img src="/files/tWoDMhkwm5iT9Phzed8y" alt="" width="563"><figcaption></figcaption></figure>

{% endstep %}

{% step %}
**Create User**

The user list appears displaying all the current users along with their status (**Active, Inactive**). Click the **Create User** button located at the top right.

<figure><img src="/files/sHAzp6jQF9Vao7EBE3ju" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}

{% step %}
**Select User Type**

* **Admin**: Has full platform access and can change organization-wide settings.
* **Member**: Has limited access to specific cost centers with assigned roles.

  <figure><img src="/files/67x4028QP4VCRE8faImh" alt="" width="375"><figcaption></figcaption></figure>

{% endstep %}

{% step %}
**Enter User Details**

* &#x20;Enter the user email address, first name and last name.
* Choose the User persona (e.g FinOps Owner, Developer, DevOps Owner)
  {% endstep %}

{% step %}
**Assign Cost Centers (Member User Only)**

For members type, select one or more cost centers the user can access.

<figure><img src="/files/N5PFrPGNneeioxu1uB6T" alt="" width="375"><figcaption></figcaption></figure>

{% hint style="info" %}

## **Understand Your Cost Center Hierarchy First**

Before assigning, ensure you’re familiar with how cost centers are structured in your organization. This determines what data and actions the user can access.

You can also **view or modify the cost center hierarchy** anytime by going to **Settings → Business Mapping Cost → Organization Cost Center**.
{% endhint %}
{% endstep %}

{% step %}
**Confirm the Creation**

Click **Create** to send out a confirmation mail to the user.&#x20;
{% endstep %}
{% endstepper %}

## What Happens After

* Once the user is created, their status updates to **Active**.
* The user can then log in to the OneLens platform.

{% hint style="success" %}
[**Read the login guide**](/getting-started/accessing-onelens) to learn how users can access their account.
{% endhint %}

## Managing Existing User Access

You can view and take actions on any user—whether they are **Active or** **Inactive** state.

{% stepper %}
{% step %}
**Open User Settings**

Navigate to **User Settings** via the **Settings** menu.
{% endstep %}

{% step %}
**Find Users**

Use the **search bar** or **status filters** to locate the user.
{% endstep %}

{% step %}
**Access User Actions**

Click the **three horizontal dots** at the end of the user's row to open the menu.&#x20;

<figure><img src="/files/eX6tYLhVzXqhpaTEj7Vd" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}

{% step %}
**Choose Action**

* **Revoke Access**: Deactivate the user immediately.
* **Edit Access**: Modify user role, persona or access level as per cost centers.

  <figure><img src="/files/stp1wXyU3leG8Ov7gJUI" alt="" width="375"><figcaption></figcaption></figure>

{% endstep %}
{% endstepper %}

## **Access Revocation: Impact & Recovery**

Revoking a user’s access deactivates their account immediately. The user's status will change to **Inactive**.

Once revoked:

* The user will no longer be able to log in.
* Their profile will remain visible with an **Inactive** status.

  <figure><img src="/files/NfMyE2F2yxfXAz4GJLXt" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="success" %}

## Reactivating User Access

If access needs to be restored later, follow these steps:

* Open the **three-dot menu** next to the user's row in the User Settings table.
* Click **Re-activate**.
* The user's status updates to **Active**, and their previous access and roles are reinstated.
  {% endhint %}


# Single Sign-On (SSO) Setup

## Overview

Managing access across teams can be complex. With Single Sign-On (SSO), you can **simplify authentication** by using your organization’s existing identity provider. This means your users can access OneLens with the same credentials they already use across your systems—securely and seamlessly.

{% hint style="warning" %}

## IMPORTANT

Only users with **Admin access** can view and modify the SSO setup.\
If you don’t see the **SSO option**, check if you have the required permissions.
{% endhint %}

Here is the guide on how you can setup Single Sign-On (SSO) in OneLens:

## Set Up Single Sign-On

{% stepper %}
{% step %}
**Go to SSO Settings**

To get started:

* Head to the **Settings** section from the left-hand sidebar in OneLens.
* Scroll down, from the **Security** section and select **SSO (Single Sign-On)**.

  <figure><img src="/files/u5I53Jo0NDYdwkN6HZi1" alt="" width="375"><figcaption></figcaption></figure>

{% endstep %}

{% step %}
**Enable SSO**

You’ll see a toggle to enable SSO. Turn it on to show the configure options.

<figure><img src="/files/KqHRRRK6S72RLEGiH6JY" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="danger" %}

## NOTE

* You can enable or disable SSO at any time.
* If you disable it, all SSO configurations will be **permanently deleted**.
* If you want to use SSO again later, you’ll need to reconfigure everything from scratch.
  {% endhint %}
  {% endstep %}

{% step %}
**Go for Configuration**

Once enabled, a **Configure** button appears just below the toggle. Click it to proceed with setup.
{% endstep %}

{% step %}
**Choose Your Identity Provider**

OneLens supports the following providers:

* Google
* Okta
* Entra ID (formerly Azure AD)
* OneLogin
* JumpCloud
* Duo
* Rippling
* **Other** – use this if you're setting up a different SAML-compatible provider.

Pick the one your organization uses. Once selected, you’ll **get clear step-by-step instructions** tailored to that provider. Follow these instructions to complete the **SAML connection** required for SSO setup.&#x20;
{% endstep %}

{% step %}
**Enter SAML Details**

At the end of the setup, you’ll be asked to enter details such as:

* SSO URL
* Entity ID
* Certificate
* or  other value based on your chosen identity provider.

Once the information is filled in, click on the **Finish**.
{% endstep %}

{% step %}
**Test and Activate Connection**

On the **Test Connection** page:

* You can verify if the connection between your identity provider and OneLens is working correctly.
* If the test is successful, click **Finish & Go Live** to activate SSO.

  <figure><img src="/files/9yEFgB8Xc97WQRqp5NBX" alt="" width="375"><figcaption></figcaption></figure>

{% hint style="info" %}
In case test fails, you can choose to **Remove Connection**.\
This clears the setup, and you’ll need to start the configuration process from scratch.
{% endhint %}
{% endstep %}
{% endstepper %}

Once that’s done, your SSO integration is live. Your team can now log in to OneLens using your identity provider—no separate credentials required.

## Next Steps

**Before users can log in** through SSO, make sure you've [added them to OneLens](/getting-started/onboarding-users-to-onelens). Users must exist in the system for their SSO credentials to work correctly.


# Accessing OneLens

You can access OneLens through two login methods:&#x20;

1. [**Magic Link**](#magic-link)&#x20;
2. [**Single Sign-On (SSO)**](#single-sign-on-sso)&#x20;

{% hint style="warning" %}
Both require initial setup by an admin to ensure secure access.
{% endhint %}

## &#x20;Magic Link

The magic link method allows you to log in using your email address without worrying about any password. Once you provide your registered email id on the login screen, you receive an email which contains a secure temporary link. Clicking on this link will redirect you to OneLens console, without you having to enter any password.

{% hint style="success" %}

## Prerequisites

* Your account admin should **add you as user with valid email address and role,** from the **User Settings** section.
  {% endhint %}

### Steps to Log In

* Go to the [OneLens login page](https://auth.onelens.cloud/).
* Choose the **Sign in with Magic Link** option.<br>

  <figure><img src="/files/3FbwhPRTHBtO9tWHdXhQ" alt="" width="563"><figcaption></figcaption></figure>
* Enter your **registered email address**.

  <figure><img src="/files/8OuedE5lVt1T2juHjfcD" alt="" width="375"><figcaption></figcaption></figure>
* Click on the **Send Magic Link.**
* Check your inbox for a login link. Here is how the mail will look:

  <figure><img src="/files/RyacmYBmVspXbd2P9t1v" alt="" width="375"><figcaption></figcaption></figure>

{% hint style="warning" %}
Note that magic link works only once for security reasons and has an expiry of 1 hour. In case you fail to utilize the magic link while under validity, you have to generate a new one.
{% endhint %}

* Click **Login** button to access OneLens.

## Single Sign-On(SSO)

SSO allows you to sign in using your organization’s identity provider.

{% hint style="success" %}

## Prerequisites

* An admin must first **enable SSO**  and then **configure the SSO integration** to grant access to organization members.
* Your email along with role must be **added in the User Settings** section by an admin.
  {% endhint %}

### Steps to Log In

1. Visit the the [OneLens login page](https://auth.onelens.cloud/).
2. Click **Sign in with SSO**.
3. Enter your **work email address**.

   <figure><img src="/files/QsVMJ59LUEY2mRr2CxJL" alt="" width="375"><figcaption></figcaption></figure>
4. Click on **Continue** and you’ll be redirected to your SSO provider to complete authentication.

You're now logged in. Head to the [User Guide](/observe-visibility-and-insights/cost-reporting) to explore OneLens features and get the most out of the platform.


# AI Cost Governance

> Gain complete visibility into AI spending, optimize costs, automate operations, and enforce governance across every AI provider from a single platform.

AI Cost Governance brings together observability, optimization, automation, and governance into a unified platform. Whether you're using OpenAI, Anthropic, Amazon Bedrock, Azure AI Foundry, Vertex AI, or multiple providers, OneLens helps you understand where your AI budget is going, identify savings opportunities, and establish organization-wide controls.

***

### Why AI Cost Governance?

As AI adoption grows, managing costs becomes increasingly complex.

Organizations often struggle with:

* AI spend spread across multiple providers
* No visibility into which teams or applications own costs
* Budget overruns discovered only after invoices arrive
* Expensive models being used unnecessarily
* Difficulty allocating AI costs to products or customers
* Limited governance over AI usage

OneLens provides a centralized platform to monitor, optimize, and govern AI spend across your entire organization.

***

### One Unified Platform

Instead of using separate tools for reporting, budgeting, optimization, and governance, OneLens brings everything together in a single platform.

The platform is built around four key pillars:

| Pillar       | Description                                                                              |
| ------------ | ---------------------------------------------------------------------------------------- |
| **Observe**  | Analyze AI costs, usage, tokens, and workloads across all providers.                     |
| **Optimize** | Identify cost-saving opportunities across models, tokens, infrastructure, and workloads. |
| **Automate** | Generate reports, detect anomalies, and notify teams automatically.                      |
| **Govern**   | Enforce budgets, controls, policies, and accountability across the organization.         |

<figure><img src="/files/5jVdpWcVTKxKM0Zitxd0" alt=""><figcaption></figcaption></figure>

***

## Observe

Gain complete visibility into AI costs and usage across your organization.

Capabilities include:

* AI Cost & Usage Analyzer
* AI Cost Allocation
* Unit Metrics
* AI Cost Anomalies
* Custom Dashboards
* Saved Reports
* Advanced Filters
* Multi-level Group By

Quickly understand:

* Which teams are spending the most
* Which models drive costs
* How token usage changes over time
* Which customers or products generate AI costs

<figure><img src="/files/1G2fonWnvKCSLSbcE3MT" alt=""><figcaption></figcaption></figure>

***

## Optimize

Continuously identify opportunities to reduce AI costs without impacting application quality.

Optimization recommendations include:

* Model right-sizing
* Prompt cache optimization
* Output token optimization
* Batch API opportunities
* Idle provisioned throughput
* Endpoint right-sizing
* Fine-tuned model utilization
* Workload-specific recommendations

Every recommendation includes estimated savings and implementation guidance.

<figure><img src="/files/mFTId5Bm5aQQu3bTFg3m" alt=""><figcaption></figcaption></figure>

***

## Automate

Reduce manual effort by automating reporting, monitoring, and notifications.

Automate:

* AI Summary Reports
* Cost Change Reports
* Anomaly Notifications
* Budget Alerts
* Executive Reports
* Workflow Notifications

Deliver updates directly through Email, Slack, Microsoft Teams, or ServiceNow.

***

## Govern

Ensure AI adoption remains secure, accountable, and financially sustainable.

Govern AI usage with:

* AI Budgets
* Budget Utilization Tracking
* Pro-rata Forecasting
* AI Controls
* Model Governance
* Spending Limits
* Policy-Based Controls
* Audit History

Keep every team accountable while maintaining centralized visibility across the organization.

***

### Multi-Provider Support

OneLens normalizes billing and usage data across multiple AI providers into a single reporting model.

Supported providers include:

* OpenAI
* Anthropic Claude
* Amazon Bedrock
* Azure AI Foundry
* Google Vertex AI
* Google Gemini
* LiteLLM
* OpenRouter

This enables consistent reporting, dashboards, and governance regardless of where your AI workloads run.

***

### Built for Every Team

#### Engineering

* Monitor application-level AI costs
* Optimize model usage
* Investigate anomalies
* Improve workload efficiency

#### Platform & FinOps

* Track AI spending across providers
* Allocate costs accurately
* Identify optimization opportunities
* Improve operational visibility

#### Finance

* Forecast AI spend
* Track budgets
* Allocate costs by business unit
* Measure AI COGS

#### Product

* Understand AI cost per feature
* Measure unit economics
* Track customer profitability
* Build sustainable pricing strategies

***

### Enterprise Capabilities

In addition to core AI cost governance, OneLens provides:

* Custom Dashboards
* Saved Reports
* Scheduled Reports
* Advanced Filters
* Up to 4-Level Group By
* Cost Allocation
* Budget Management
* Workflow Automation
* Email & Slack Notifications
* ServiceNow Integration
* Role-Based Access Control (RBAC)
* Audit Logs

***

### Privacy First

OneLens is designed with a privacy-first architecture.

The platform only accesses billing and usage metadata required for cost governance.

OneLens **never** collects:

* Prompts
* Conversations
* Model responses
* Uploaded files
* Embeddings
* Training datasets

Your AI data remains within your environment while OneLens provides complete visibility into costs and usage.

***

### Benefits

* Centralize AI cost management across providers.
* Improve visibility into AI spending and usage.
* Reduce AI costs through actionable optimization recommendations.
* Detect unexpected cost spikes automatically.
* Allocate AI costs to teams, products, and customers.
* Enforce budgets and governance policies.
* Improve collaboration between engineering, finance, and leadership.
* Scale AI adoption with confidence.


# VPC Flow logs


# AI Integrations

OneLens integrates with your AI platforms to provide unified cost visibility, per-user attribution, and usage analytics across all your LLM providers. Choose your integration below to get started.

{% content-ref url="/pages/6ff0c2e2438e61671b5a257a387262ac2c437a7a" %}
[AWS Bedrock Integration](/integrations/ai-integrations/aws-bedrock-integration)
{% endcontent-ref %}

{% content-ref url="/pages/a1614baa279d951bb7abda1f30981679be655521" %}
[Claude Enterprise Integration](/integrations/ai-integrations/claude-enterprise-integration)
{% endcontent-ref %}

{% content-ref url="/pages/ed77f6eff41a90ff2596da908d9ea70ef3aba97d" %}
[LiteLLM Integration](/integrations/ai-integrations/litellm-integration)
{% endcontent-ref %}

{% content-ref url="/pages/e7b44caab4d83b92017be97c769d1e7548033c8f" %}
[OpenAI Integration](/integrations/ai-integrations/openai-integration)
{% endcontent-ref %}

{% content-ref url="/pages/rGPwSJzspm7IWsgYc0px" %}
[Gemini Enterprise](/integrations/ai-integrations/gemini-enterprise)
{% endcontent-ref %}


# AWS Bedrock Integration

Customer Onboarding Guide CUR 2.0 + Bedrock CloudWatch Metrics + Invocation Logging

## TL;DR

* **What this does:** Connects OneLens to your AWS account to collect Amazon Bedrock cost, usage, and performance data — giving you model-level spend visibility, token consumption tracking, and AI cost optimization recommendations.
* **Time required:** \~25 minutes
* **Who you need:** An AWS IAM administrator who can deploy CloudFormation templates and (optionally) enable Bedrock model invocation logging. One DevOps or platform engineer to run the setup.
* **What OneLens reads:** Read-only access to CloudWatch metrics (AWS/Bedrock namespace), Cost and Usage Report (CUR 2.0) line items, and — if you opt in — model invocation logs stored in CloudWatch Logs or S3. Your prompts, responses, and production application data are never accessed unless you explicitly enable invocation logging.

## What You'll Get Once Connected

| Capability                            | What it does for you                                                                                                                                                |
| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Unified AI Cost Explorer              | See Bedrock spend broken down by model, token type (input/output/cache-read/cache-write), service tier, and region — all in one view.                               |
| Model-Level Cost Attribution          | Track costs per model (Claude, Nova, Llama, Mistral, etc.) using CUR 2.0 line-item data with IAM principal and cost-allocation tag breakdowns.                      |
| Token Usage Analytics                 | Monitor InputTokenCount and OutputTokenCount by model ID via CloudWatch metrics. Spot which models and workloads consume the most tokens.                           |
| Cost Anomaly Detection                | Get alerted when Bedrock spend deviates from historical patterns — catch runaway agent loops, unexpected model switches, or traffic spikes early.                   |
| Budget Tracking                       | Set per-model or per-team budgets and track actuals against them, using CUR cost-allocation tags from IAM principals, Projects, or Application Inference Profiles.  |
| Invocation-Level Insights *(opt-in)*  | When model invocation logging is enabled, OneLens can analyze per-request token counts, latency, and metadata — without reading prompt/response content by default. |
| Idle Provisioned Throughput Detection | Flag provisioned throughput commitments with low utilization so you can rightsize or release capacity.                                                              |

## Security at a Glance

| Question                                         | Answer                                                                                                                                                                                                                                                                                                                   |
| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Does OneLens read my prompts or model responses? | No, by default. OneLens reads only CloudWatch metrics and CUR billing data. If you enable invocation logging and grant OneLens access, it reads invocation metadata (model ID, token counts, latency). Prompt/response content is not read unless you explicitly opt in to full-content mode.                            |
| Does OneLens see my application data?            | No. OneLens accesses only Bedrock usage metadata, CloudWatch metrics, and billing reports. It has no access to your application databases, S3 data buckets, or any Bedrock knowledge bases.                                                                                                                              |
| Is access read-only?                             | Yes. The IAM role grants bedrock:List\* and three specific bedrock:Get actions (GetFoundationModel, GetProvisionedModelThroughput, GetModelInvocationLoggingConfiguration), plus CloudWatch and CUR/S3 read access. No Invoke\*, Create\*, Update\*, or Delete\* permissions are granted.                                |
| What authentication is used?                     | Cross-account IAM role assumption via AWS STS. OneLens assumes a role in your account using an external ID unique to your tenant (enforced via sts:ExternalId condition in the trust policy). IAM role credentials (STS tokens) are short-lived. OneLens stores configuration securely, encrypted at rest using GCP KMS. |
| How is data transmitted and stored?              | TLS 1.2+ in transit. At rest, data is encrypted using GCP KMS in OneLens infrastructure with standard organizational policies meeting ISO 27001 and SOC 2 compliance.                                                                                                                                                    |
| Can I restrict by IP?                            | Yes. You can add an aws:SourceIp condition to the IAM role's trust policy. OneLens egress IPs are provided during onboarding.                                                                                                                                                                                            |

## Cost of the Integration

OneLens does not create any new AWS resources (no compute instances, no additional S3 buckets for its own use). The only costs are from AWS services you're already using or enabling.

| Item                                | What it is                                                                                                                                                                         | Typical cost                                                                                                                               |
| ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| CloudWatch metrics                  | Bedrock publishes InputTokenCount, OutputTokenCount, Invocations, InvocationLatency etc. to CloudWatch automatically at no extra charge. OneLens calls GetMetricData to read them. | $0.01 per 1,000 metrics requested. At daily collection across \~10 models: <$1/month.                                                      |
| CUR 2.0 (AWS Data Exports)          | You likely already have CUR enabled. If not, CUR data is delivered to an S3 bucket in your account.                                                                                | S3 storage for CUR files: typically <$1/month for most accounts.                                                                           |
| Model invocation logging *(opt-in)* | If enabled, Bedrock writes invocation logs to CloudWatch Logs and/or S3.                                                                                                           | CloudWatch Logs ingestion: $0.50/GB. At \~1 KB per invocation x 100K invocations/month \~ 100 MB \~ $0.05/month. S3 storage is negligible. |
| Data egress                         | Metadata leaving AWS for OneLens.                                                                                                                                                  | <10 MB/month of metadata: <$0.01/month.                                                                                                    |
| Storage in your account             | CUR S3 bucket only (which you likely already have).                                                                                                                                | $0 incremental.                                                                                                                            |
| **Estimated total**                 | **Sum of above**                                                                                                                                                                   | **See scale table below**                                                                                                                  |

**Cost by scale:**

| Scale  | Invocations/month | Estimated OneLens overhead                                                                                  |
| ------ | ----------------- | ----------------------------------------------------------------------------------------------------------- |
| Small  | <100K             | <$2/month (metrics + CUR only)                                                                              |
| Medium | 100K-1M           | $2-5/month (with invocation logging: \~1 GB logs = $0.50 ingestion)                                         |
| Large  | 1M-10M+           | $5-15/month (10+ GB logs = $5+ ingestion; larger CUR files; more GetMetricData calls across models/regions) |

Costs scale linearly with invocation volume and number of models/regions. The primary cost driver at high volume is CloudWatch Logs ingestion for invocation logging ($0.50/GB). If you skip invocation logging, overhead stays under $3/month at any scale.

## How It Works

Amazon Bedrock is AWS's fully managed service for accessing foundation models (Anthropic Claude, Amazon Nova, Meta Llama, Mistral, etc.) via API. Every model invocation is billed per token — input tokens, output tokens, and (if using prompt caching) cache-read and cache-write tokens — each at different rates that vary by model and service tier.

OneLens collects cost and usage data from three sources:

1. **CloudWatch Metrics (AWS/Bedrock namespace):** Real-time token counts, invocation counts, and latency per model. Published automatically by Bedrock.
2. **CUR 2.0:** Line-item billing data with per-token-type cost breakdowns, IAM principal attribution, and cost-allocation tags. Delivered to your S3 bucket.
3. **Model Invocation Logs&#x20;*****(optional)*****:** Per-request metadata including model ID, input/output token counts, latency, and (if opted in) request/response content. Delivered to CloudWatch Logs and/or S3.

OneLens assumes a read-only IAM role in your account to pull this data daily, processes it, and surfaces it through the OneLens dashboard.

## Prerequisites

* AWS account with Amazon Bedrock enabled in at least one region.
* IAM administrator access to deploy CloudFormation templates.
* (Optional) Model invocation logging enabled in Bedrock if you want per-request analytics. See Step 4.

## What OneLens Will Access

The Bedrock CFT creates a role with these specific permissions:

| Permission                                                                                                  | Why                                                                                                    |
| ----------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
| bedrock:List\*                                                                                              | Enumerate models, inference profiles, and provisioned throughput                                       |
| bedrock:GetFoundationModel                                                                                  | Model lifecycle dates (EOL, deprecation) for proactive alerting                                        |
| bedrock:GetProvisionedModelThroughput                                                                       | Commitment duration, expiry, model units for idle capacity detection                                   |
| bedrock:GetModelInvocationLoggingConfiguration                                                              | Check if invocation logging is enabled                                                                 |
| cloudwatch:GetMetricData, cloudwatch:GetMetricStatistics, cloudwatch:ListMetrics, cloudwatch:DescribeAlarms | Read AWS/Bedrock namespace metrics — InputTokenCount, OutputTokenCount, Invocations, InvocationLatency |
| logs:FilterLogEvents, logs:GetLogEvents, logs:DescribeLogStreams                                            | Read invocation logs *(only if logging is enabled — scoped to the specific log group ARN you provide)* |
| s3:GetObject, s3:ListBucket on CUR bucket                                                                   | Read CUR 2.0 billing data                                                                              |
| s3:GetObject, s3:ListBucket on invocation log bucket                                                        | Read invocation log files from S3 *(only if logging to S3 is enabled)*                                 |

## What OneLens Will NOT Access

* bedrock:InvokeModel, bedrock:Converse — OneLens cannot call any model
* bedrock:Create\*, bedrock:Update\*, bedrock:Delete\* — OneLens cannot modify any Bedrock resource
* bedrock:GetGuardrail, bedrock:GetAgent, bedrock:GetKnowledgeBase, bedrock:GetCustomModel — OneLens does not access guardrails, agents, knowledge bases, or custom model configurations
* Any S3 bucket other than the CUR bucket and (optionally) the invocation-logging bucket
* Any CloudWatch log group other than the Bedrock invocation log group you specify
* Any application database, knowledge base, or agent configuration data

## AWS Environment Types

You likely operate your AWS accounts in one of two ways. The steps you need to follow depend on which environment you're using.

> ***Already connected to OneLens via AWS?** You still need to (1) enable IAM principal allocation data on your existing CUR export and (2) deploy the Bedrock-specific CloudFormation template to grant OneLens read access to Bedrock metrics and metadata.*

### Centralized Accounts (Master-Child Setup)

If you manage multiple AWS accounts from a master or admin account (using AWS Organizations):

* **CUR Template using Stack** — Run this in the master/admin account. Ensure the Stack is created in us-east-1 region. If child accounts need independent billing visibility, deploy the CUR template in those accounts as well.
* **Bedrock Role using Stack** — Run this in the master/admin account.
* **Bedrock Role using StackSet** — Run this from the master/admin account to all child accounts where Bedrock is used.

> **Note:** Bedrock CloudWatch metrics (InputTokenCount, OutputTokenCount, etc.) are published per-account and per-region. The StackSet deployment ensures OneLens can read Bedrock metrics from every account where Bedrock is used.

### Decentralized Accounts (Individually Managed Accounts)

If each AWS account is configured independently:

* **CUR Template using Stack** — Deploy in each account individually. Ensure the Stack is created in us-east-1 region.
* **Bedrock Role using Stack** — Deploy in each account individually.

## Existing Accounts on OneLens

For AWS accounts already onboarded onto OneLens earlier, we follow two steps:

1. Delete the existing Data Export, and create a new Data Export with the additional "Include caller identity (IAM principal) allocation data" toggle enabled.
2. Delete the older Stack (or StackSet) created for resource role deployment, and create a new Stack (or StackSet) following the normal process of CloudFormation deployment using the new CF template including Bedrock permissions.

### Step 1: Manual CUR Export Setup

This creates a Cost and Usage Report (CUR 2.0) export and the IAM role OneLens needs to read it. The CUR contains per-model, per-token-type Bedrock billing data.

{% stepper %}
{% step %}
In the AWS Management Console, navigate to **Billing and Cost Management -> Data Exports**, and select the existing cost export "*OneLens-Standard-CUR-Export*".

Delete the export.

{% hint style="info" %}
The export is deleted and recreated, since AWS does not allow editing exports to include additional columns.
{% endhint %}
{% endstep %}

{% step %}
Click Create to create a new cost export, matching the existing settings.

**Export name:** *OneLens-Standard-CUR-Export*
{% endstep %}

{% step %}
Under **Data table content settings**, make the following changes:

* Enable **Include resource IDs**
* Enable **Split cost allocation data**
* Enable **Include caller identity (IAM principal) allocation data**

Rest of the settings here can be left as default.&#x20;
{% endstep %}

{% step %}
Under **Data export storage settings**, make the following changes:

* Click **Configure** next to the S3 bucket path configuration, choose **Select existing bucket**, then search for and select your existing S3 bucket created for OneLens cost exports.
* Make sure to tick the **I agree to overwrite my S3 bucket policy** toggle on the bottom, and then click **Select bucket**.
* Under **S3 path prefix**, enter the value "*cur*".
  {% endstep %}

{% step %}
Click Create on the bottom to finish creating the new export.
{% endstep %}
{% endstepper %}

### Step 2: Re-deploy resource role Stack (or StackSet)

{% stepper %}
{% step %}
In the AWS Management console, navigate to **CloudFormation** -> **Stacks**
{% endstep %}

{% step %}
Select the existing resource role Stack deployment and delete. This will delete the IAM role and IAM policies created by the Stack.

{% hint style="info" %}
For accounts onboarded using the Master-child setup ([Centralized Accounts](#centralized-accounts-master-child-setup)), please delete the StackSet instead, with all child Stacks.
{% endhint %}
{% endstep %}

{% step %}
Create a new Stack and deploy, using the new resource role CloudFormation template that includes the Bedrock permissions, following the normal deployment steps detailed in the [#step-2-deploy-bedrock-role-using-stack](#step-2-deploy-bedrock-role-using-stack "mention") or [#step-3-deploy-bedrock-role-using-stackset-centralized-setup-only](#step-3-deploy-bedrock-role-using-stackset-centralized-setup-only "mention") sections.
{% endstep %}
{% endstepper %}

## New Accounts on OneLens

### Step 1: Manual CUR Export Setup

This creates a Cost and Usage Report (CUR 2.0) export and the IAM role OneLens needs to read it. The CUR contains per-model, per-token-type Bedrock billing data.

{% stepper %}
{% step %}
Click Create to create a new cost export.

**Export name:** *OneLens-Standard-CUR-Export*
{% endstep %}

{% step %}
Under **Data table content settings**, make the following changes:

* Enable **Include resource IDs**
* Enable **Split cost allocation data**
* Enable **Include caller identity (IAM principal) allocation data**

Rest of the settings here can be left as default.&#x20;
{% endstep %}

{% step %}
Under **Data export storage settings**, make the following changes:

* Click **Configure** next to the S3 bucket path configuration, choose **Select existing bucket**, then search for and select your existing S3 bucket created for OneLens cost exports.
* Make sure to tick the **I agree to overwrite my S3 bucket policy** toggle on the bottom, and then click **Select bucket**.
* Under **S3 path prefix**, enter the value "*cur*".
  {% endstep %}

{% step %}
Click Create on the bottom to finish creating the new export.
{% endstep %}
{% endstepper %}

> After enabling, allow 48 hours for the IAM principal data to begin appearing in CUR. You must also activate the relevant cost allocation tags in **Billing Console -> Cost allocation tags** for them to appear in CUR and Cost Explorer.

### Step 2: Deploy Bedrock Role Using Stack

This creates a Bedrock-specific IAM role scoped exclusively to the permissions OneLens needs. All Bedrock permissions are included in the CFT, no manual policy edits required.

{% stepper %}
{% step %}
In the AWS Management Console, go to **CloudFormation -> Stacks -> Create Stack -> With new resources (standard)**.
{% endstep %}

{% step %}
Select **Choose an existing template -> Amazon S3 URL** and enter:

```
https://astuto-products.s3.ap-south-1.amazonaws.com/onelens/aws/cft/bedrock-role-v1.yaml
```

{% endstep %}

{% step %}
Fill in the stack parameters:

<table><thead><tr><th width="244">Parameter</th><th>Value</th></tr></thead><tbody><tr><td>Stack Name</td><td>OneLens-Bedrock-Stack (or your naming convention)</td></tr><tr><td>Role Name</td><td>OneLens-Bedrock-&#x3C;10-char-alphanumeric-unique-id>: use a unique identifier, or contact OneLens support for your assigned role name</td></tr><tr><td>InvocationLogGroupArn</td><td><em>(Optional)</em> ARN of the CloudWatch Logs log group for Bedrock invocation logs (e.g., <em>arn:aws:logs:us-east-1:123456789012:log-group:/aws/bedrock/invocations:*</em>). <br>Leave blank to skip invocation log access.</td></tr><tr><td>InvocationLogBucketName</td><td><p><em>(Optional)</em> S3 bucket name for Bedrock invocation logs. </p><p>Leave blank to skip.</p></td></tr></tbody></table>
{% endstep %}

{% step %}
Acknowledge the IAM resource creation warning and click **Submit**.
{% endstep %}

{% step %}
Once the stack shows **CREATE\_COMPLETE**, go to the **Outputs** tab and note the **Bedrock Role ARN**.
{% endstep %}
{% endstepper %}

> **What this CFT creates:** A single IAM role (OneLensBedrockRole) with up to three managed policies: OneLensBedrockPolicy (always Bedrock + CloudWatch read-only), OneLensBedrockLogPolicy (only if you provide a log group ARN, scoped to that specific log group), and OneLensBedrockLogBucketPolicy (only if you provide a log bucket, scoped to that specific bucket). No other AWS resources are accessed.

**Verification:** Run this CLI command to confirm the role has the required permissions:

```bash
aws iam simulate-principal-policy \
  --policy-source-arn "arn:aws:iam::<ACCOUNT_ID>:role/<ONELENS_BEDROCK_ROLE_NAME>" \
  --action-names "bedrock:GetFoundationModel" "bedrock:GetProvisionedModelThroughput" "bedrock:GetModelInvocationLoggingConfiguration" \
  --query 'EvaluationResults[].{Action:EvalActionName,Decision:EvalDecision}' \
  --output table
```

All actions should show **allowed**.

### Step 3: Deploy Bedrock Role Using StackSet (Centralized Setup Only)

This deploys the Bedrock role across all child accounts where Bedrock is used. Skip this step if you are using decentralized (individually managed) accounts.

> **Prerequisite:** You must have access to the Master or Payer (also known as Management) account.

{% stepper %}
{% step %}
In the AWS Management Console (master account), go to **CloudFormation -> StackSets -> Create StackSet**.
{% endstep %}

{% step %}
Select **Template is ready -> Amazon S3 URL** and enter:

```
https://astuto-products.s3.ap-south-1.amazonaws.com/onelens/aws/cft/bedrock-role-v1.yaml
```

{% endstep %}

{% step %}
Fill in the stack parameters:

<table><thead><tr><th width="244">Parameter</th><th>Value</th></tr></thead><tbody><tr><td>StackSet Name</td><td>OneLens-Bedrock-StackSet (or your naming convention)</td></tr><tr><td>Role Name</td><td>OneLens-Bedrock-&#x3C;10-char-alphanumeric-unique-id> — use a unique identifier, or contact OneLens support for your assigned role name</td></tr><tr><td>InvocationLogGroupArn</td><td><em>(Optional)</em> Leave blank if invocation logging varies per account — configure per-account after StackSet deployment.</td></tr><tr><td>InvocationLogBucketName</td><td><em>(Optional)</em> Leave blank if not using S3 for invocation logs.</td></tr></tbody></table>
{% endstep %}

{% step %}
Acknowledge the IAM resource creation warning and click **Next**.
{% endstep %}

{% step %}
In **Set Deployment Options**, specify the target AWS accounts or organizational units where Bedrock is used, and select the region(s) for deployment. IAM is a global service, so any region works and click **Submit**.
{% endstep %}

{% step %}
Monitor the **Operations** tab — status should show **SUCCEEDED** for all child accounts.
{% endstep %}
{% endstepper %}

> **Important:** StackSets deploy to child accounts only, not the account where the StackSet is created. You must also deploy the Bedrock role in the master account using Step 2.

### Step 4 (Optional): Enable Model Invocation Logging

Model invocation logging gives OneLens per-request visibility — token counts, latency, model ID, and request metadata for each Bedrock API call. This is optional; OneLens works with CloudWatch metrics and CUR data alone.

> **Privacy note:** By default, OneLens reads only invocation metadata (model ID, token counts, timestamps, latency). If you enable full-content logging in Bedrock (which writes prompt and response bodies to S3/CloudWatch), OneLens will not read that content unless you explicitly opt in by confirming in the OneLens dashboard.

> **Note:** Invocation logging must be enabled per-region in each account that uses Bedrock. There is no centralized toggle.

#### Permissions you need (on your side)

Enabling invocation logging is a customer action — OneLens does not enable it for you. The IAM identity (user or role) enabling logging needs:

* **bedrock:PutModelInvocationLoggingConfiguration** — to configure logging
* **iam:PassRole** — to pass a service role to Bedrock for writing logs
* The Bedrock service role itself needs logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents (for CloudWatch) and/or s3:PutObject (for S3)

#### Permissions OneLens needs (to read the logs)

If you provided the InvocationLogGroupArn and/or InvocationLogBucketName parameters when deploying the Bedrock CFT in Step 2, OneLens already has read access scoped to those specific resources. If you skipped those parameters initially, update the stack to add them:

1. Go to **CloudFormation -> Stacks -> select OneLens-Bedrock-Stack**.
2. Click **Update -> Use current template**.
3. Fill in the **InvocationLogGroupArn** and/or **InvocationLogBucketName** parameters.
4. Click **Submit**.

#### To enable invocation logging in Bedrock:

{% stepper %}
{% step %}
Open the **Amazon Bedrock console -> Settings -> Model invocation logging**.
{% endstep %}

{% step %}
Toggle logging **On**.
{% endstep %}

{% step %}
Select destinations:

* **CloudWatch Logs:** Choose or create a log group (e.g., /aws/bedrock/invocations).
* **S3&#x20;*****(optional)*****:** Specify a bucket for long-term retention.
  {% endstep %}

{% step %}
Under **Log data**, select:

* **Metadata** (always recommended)
* **Request body** and **Response body** — leave unchecked unless you want OneLens to analyze prompt/response content
  {% endstep %}

{% step %}
Click **Save**.
{% endstep %}
{% endstepper %}

Alternatively, enable via CLI:

```bash
aws bedrock put-model-invocation-logging-configuration \
  --logging-config '{
    "cloudWatchConfig": {
      "logGroupName": "/aws/bedrock/invocations",
      "roleArn": "arn:aws:iam::<ACCOUNT_ID>:role/<BEDROCK_LOGGING_ROLE>",
      "largeDataDeliveryS3Config": {
        "bucketName": "<YOUR_LOGGING_BUCKET>",
        "keyPrefix": "bedrock-logs/"
      }
    },
    "s3Config": {
      "bucketName": "<YOUR_LOGGING_BUCKET>",
      "keyPrefix": "bedrock-logs/",
      "s3EncryptionEnabled": true
    },
    "textDataDeliveryEnabled": false,
    "imageDataDeliveryEnabled": false,
    "embeddingDataDeliveryEnabled": false,
    "videoDataDeliveryEnabled": false,
    "audioDataDeliveryEnabled": false
  }'
```

> Setting all \*DataDeliveryEnabled flags to false ensures that prompt/response content is not logged — only metadata is captured.

### Step 5: Connect to OneLens

Share the following information with OneLens (via email to <support@astuto.ai> or through the OneLens dashboard):

| Field                                                            | Where to find it                                                                   |
| ---------------------------------------------------------------- | ---------------------------------------------------------------------------------- |
| Master Account ID or list of individually integrated account IDs | AWS Console -> Account Settings                                                    |
| Bedrock Role ARN                                                 | CloudFormation -> OneLens-Bedrock-Stack -> Outputs tab                             |
| CUR Role ARN                                                     | CloudFormation -> OneLens-CUR-Stack -> Outputs tab                                 |
| CUR S3 Bucket Name                                               | CloudFormation -> OneLens-CUR-Stack -> Outputs tab                                 |
| Bedrock Regions                                                  | List the AWS regions where you use Bedrock (e.g., us-east-1, us-west-2, eu-west-1) |
| Stack Role Names and unique identifiers                          | Only if role names were customized during deployment                               |
| Invocation Log Group *(if enabled)*                              | The CloudWatch Logs log group name from Step 4 (e.g., /aws/bedrock/invocations)    |
| Invocation Log S3 Bucket *(if enabled)*                          | The S3 bucket name from Step 4                                                     |

**Verification:** After OneLens confirms the connection (typically within 24 hours), check the OneLens dashboard for:

* Bedrock model list populated under your account
* CloudWatch metrics (token counts, invocations) flowing for the past 24 hours
* CUR cost data appearing for the current billing period

If any of these are missing after 24 hours, see Troubleshooting.

> **Secure credential sharing:** Never share Role ARNs or account IDs over email or chat. Use a validated secure sharing tool like [Password.link](https://password.link/en) to transmit credentials safely.

### Data Refresh Schedule

OneLens collects Bedrock data on the following cadence:

* **CloudWatch metrics:** Pulled once a day. CloudWatch retains Bedrock metrics at 1-minute granularity for 15 days, then at reduced granularity for up to 15 months.
* **CUR data:** Processed once daily after AWS delivers the updated CUR export (typically within 24 hours of usage). Current-period figures may shift until the billing period closes — AWS retroactively adjusts line items.
* **Invocation logs&#x20;*****(if enabled)*****:** Pulled once daily. Bedrock delivers logs to CloudWatch/S3 with a delay of seconds to minutes, but OneLens batches collection for efficiency.

### Data Privacy & Security

* Access is read-only — OneLens cannot invoke models, modify resources, or write to any AWS service.
* Scope is restricted to CloudWatch metrics, CUR billing data, and (optionally) invocation log metadata.
* All data is transmitted over TLS 1.2+ and encrypted at rest using GCP KMS.
* IAM role credentials are short-lived STS tokens. All configuration is encrypted at rest using GCP KMS in OneLens infrastructure.
* Prompt/response content is never accessed unless you explicitly enable full-content invocation logging and grant OneLens access.
* **Data retention** — 12-month default, configurable. Deletion within 30 days on request with confirmation.
* You can add IP restrictions to the IAM role trust policy; OneLens egress IPs are provided during onboarding.

## Troubleshooting

### 1. "Access Denied" when OneLens reads CloudWatch metrics

**Cause:** The IAM role is missing cloudwatch:GetMetricData or cloudwatch:ListMetrics permissions, or there is a region mismatch.

**Fix:** Verify the role policy includes:

```json
{
  "Effect": "Allow",
  "Action": ["cloudwatch:GetMetricData", "cloudwatch:ListMetrics"],
  "Resource": "*"
}
```

> **Note:** The cloudwatch:namespace condition key only applies to PutMetricData, not to read operations like GetMetricData or ListMetrics. Do not add a namespace condition to this statement — it would deny access.

Also confirm OneLens is querying the correct region(s) where you use Bedrock.

### 2. "AssumeRole" fails - trust policy error

**Cause:** The IAM role's trust policy does not include the OneLens AWS account as a trusted principal, or the external ID is wrong.

**Fix:** Check the trust policy in IAM -> Roles -> OneLens-\<id> -> Trust relationships. If you deployed the ExternalID version of the CFT, it should include:

```json
{
  "Effect": "Allow",
  "Principal": {"AWS": "arn:aws:iam::471112871310:root"},
  "Action": ["sts:AssumeRole", "sts:TagSession"],
  "Condition": {"StringEquals": {"sts:ExternalId": "<YOUR_EXTERNAL_ID>"}}
}
```

Ensure the external ID matches the value provided by OneLens during onboarding. If the role exists and was working for other AWS resources, the trust policy is likely fine — the issue may instead be a missing Bedrock permission (see item 7).

### 3. No Bedrock cost data in OneLens after 24 hours

**Cause (most common):** CUR is not enabled, or CUR does not include Bedrock line items yet (first delivery takes up to 24 hours after enablement).

**Fix:**

* Confirm CUR is configured in the AWS Billing console -> Data Exports.
* Ensure the CUR export includes resource-level data.
* Check the CUR S3 bucket for recent files — look for line\_item\_product\_code = "AmazonBedrock".
* If CUR was just enabled, wait 48 hours for the first full delivery.

### 4. CloudWatch metrics show zero token counts

**Cause:** No Bedrock invocations have occurred in the selected region/time range, or the model ID dimension filter is incorrect.

**Fix:**

* Verify Bedrock usage in the target region: AWS Console -> Bedrock -> Model access (confirm models are enabled).
* In CloudWatch, check AWS/Bedrock namespace -> InputTokenCount metric with the ModelId dimension.
* If using cross-region inference, metrics may appear in a different region than expected.

### 5. Invocation logs are enabled but OneLens shows no log data

**Cause:** OneLens does not have permission to read the invocation log group or S3 bucket, or the log group name was not provided during onboarding.

**Fix:**

* Verify that the IAM role policy includes logs:FilterLogEvents and logs:GetLogEvents for the correct log group ARN.
* Confirm the log group name shared with OneLens matches exactly (e.g., /aws/bedrock/invocations).
* Check Bedrock console -> Settings -> Model invocation logging to confirm logging is active.

### 6. Cost-allocation tags not appearing in OneLens

**Cause:** Tags from IAM principals, Projects, or Application Inference Profiles must be activated as cost-allocation tags in the AWS Billing console before they appear in CUR.

**Fix:**

* Go to AWS Billing Console -> Cost allocation tags -> Activate the relevant tags.
* Allow 48 hours after activation for tags to begin populating in CUR.
* Ensure you are using CUR 2.0 (AWS Data Exports) — IAM principal attribution requires CUR 2.0, not the legacy format.

### 7. "Connected but only partial model data"

**Cause:** The IAM role may lack permissions for certain Bedrock API actions, or some models are in regions not shared with OneLens.

**Fix:**

* Verify the Bedrock role policy includes the expected permissions by checking OneLensBedrockPolicy-\<stack-name> in IAM -> Policies.
* Confirm all Bedrock regions are listed in the OneLens connection configuration.
* For provisioned throughput models, ensure bedrock:ListProvisionedModelThroughputs is granted.

## FAQ

<details>

<summary>Can OneLens see our prompts, model responses, or application data?</summary>

No. By default, OneLens reads only CloudWatch metrics (token counts, latency) and CUR billing data. If you enable model invocation logging with content delivery, OneLens will still only read metadata unless you explicitly opt in to content access in the OneLens dashboard.

</details>

<details>

<summary>Can OneLens invoke models or run up our Bedrock bill?</summary>

No. The IAM role grants zero Invoke\* permissions. OneLens cannot call any Bedrock model, create resources, or modify your account in any way.

</details>

<details>

<summary>Will this impact our Bedrock model latency or throughput?</summary>

No. OneLens reads metrics and logs asynchronously — it does not sit in the request path. There is no impact on your model invocation performance or quotas.

</details>

<details>

<summary>Can I connect multiple AWS accounts?</summary>

Yes. Deploy the CloudFormation template in each account and share the role ARNs with OneLens. For organizations using AWS Organizations, you can use a StackSet to deploy across all member accounts.

</details>

<details>

<summary>How much will this cost on my AWS bill?</summary>

$2-15/month depending on scale and whether invocation logging is enabled. Without invocation logging, overhead stays under $3/month at any scale. See the Cost of the Integration section for the full breakdown by scale.

</details>

<details>

<summary>Can I disconnect Bedrock access without removing the full OneLens integration?</summary>

Yes. Delete the Bedrock CloudFormation stack to revoke all Bedrock-specific access:

```bash
aws cloudformation delete-stack --stack-name OneLens-Bedrock-Stack
```

To also remove CUR access, delete the CUR stack:

```bash
aws cloudformation delete-stack --stack-name OneLens-CUR-Stack
```

</details>

<details>

<summary>How do I rotate the IAM role credentials?</summary>

OneLens uses STS AssumeRole which generates short-lived tokens. All stored configuration is encrypted at rest using GCP KMS. If you want to revoke access temporarily, you can update the trust policy to remove the OneLens principal.

</details>

<details>

<summary>Does this work with Bedrock in GovCloud or China regions?</summary>

Contact OneLens support for GovCloud and China region availability.

</details>

<details>

<summary>Why do I need to grant these specific Bedrock permissions?</summary>

bedrock:List\* enumerates models, inference profiles, and provisioned throughput in your account. The three Get actions provide details not available from List: GetModelInvocationLoggingConfiguration checks logging status, GetProvisionedModelThroughput returns commitment and capacity details for idle-detection, and GetFoundationModel returns model lifecycle dates for deprecation alerts. No model invocations are possible with these permissions.

</details>

<details>

<summary>Can I see cost breakdowns by team or application?</summary>

Yes, if you use Bedrock's cost-attribution features: IAM principal-based cost allocation, Application Inference Profiles, or Bedrock Projects. Tags from these features flow into CUR and are surfaced in OneLens. See the AWS documentation on cost allocation tags.

</details>

***

## Need Help?

**AWS Documentation:**

* [Amazon Bedrock User Guide](https://docs.aws.amazon.com/bedrock/latest/userguide/)
* [Bedrock CloudWatch Metrics](https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html)
* [Bedrock Model Invocation Logging](https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html)
* [Understanding Bedrock CUR Data](https://docs.aws.amazon.com/bedrock/latest/userguide/cost-mgmt-understanding-cur-data.html)
* [IAM Managed Policies for Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html)

**OneLens Support:** <support@astuto.ai> | docs.onelens.cloud


# Azure Foundry

Connect one or more individual Azure subscriptions to OneLens for FinOps visibility, cost analysis, and optimization — using a read-only App Registration and Cost Management exports.

## TL;DR

* **What this does**: Gives OneLens read-only access to your Azure cost and usage data so it can deliver cost visibility, anomaly detection, and right-sizing recommendations across your subscriptions.
* **Time required**: \~30–45 minutes for a fresh setup; \~10 minutes if Azure is already connected and you're adding a subscription.
* **Who you need**: A user with the **Owner** role on each subscription being integrated (to create the App Registration, assign RBAC roles, and configure exports).
* **What OneLens reads**: Billing/cost-management metadata, resource inventory metadata (via the `Reader` role), and the Cost Management export files written to your storage account. Your application data, secrets, key contents, and workload payloads are never accessed.

## What You'll Get Once Connected

| Capability                         | What it does for you                                                                                                                     |
| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| **Unified Cost Explorer**          | Single view of actual and amortized spend across all integrated subscriptions.                                                           |
| **Resource Right-Sizing**          | Flags over-provisioned VMs, disks, and other resources based on cost and usage metadata.                                                 |
| **Cost Allocation by Tag**         | Groups spend by business unit, environment, or team using billing, resource group, and subscription tags (with tag inheritance enabled). |
| **Anomaly Detection**              | Surfaces unexpected cost spikes against historical baselines.                                                                            |
| **Budget Tracking**                | Tracks spend against budgets and alerts when thresholds are approached.                                                                  |
| **Idle Resource Detection**        | Identifies unused or underutilized resources that can be stopped or deleted.                                                             |
| **AKS / Kubernetes Cost Insights** | Breaks down container costs per cluster, namespace, and workload when AKS cost analysis is enabled.                                      |
| **Storage Cost Insights**          | Highlights redundant, over-replicated, or low-access-tier storage spend.                                                                 |

## Security at a Glance

| Question                                              | Answer                                                                                                                                                                                                                               |
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Does OneLens read our production or application data? | **No.** OneLens reads cost/billing metadata, resource inventory metadata, and the exported Cost Management files only. It has no access to the contents of your VMs, databases, or application workloads.                            |
| Is access read-only?                                  | **Yes.** The App Registration and external reader are granted only `Reader`, `Cost Management Reader`, `Billing reader`/`Billing account reader`, and `Storage Blob Data Reader`. No write, delete, or management roles are granted. |
| What authentication is used?                          | An Azure **App Registration (Service Principal)** with a client secret, plus an invited **external reader** identity. Credentials are scoped to the integrated subscriptions only.                                                   |
| How is data transmitted and stored?                   | All Azure API and blob access is over TLS. Cost exports are stored encrypted at rest in your own storage account (LRS). OneLens stores your client secret encrypted.                                                                 |
| Can I restrict access?                                | **Yes.** Roles are scoped per subscription and to the single storage account/container used for exports. You control which subscriptions and resource groups are onboarded.                                                          |
| Does enabling network access bypass RBAC?             | **No.** Setting the storage account network `--default-action Allow` controls network-level access only. Entities still require valid credentials and role assignments to read data.                                                 |

***

## Cost of the Integration

OneLens does not deploy any compute or paid services into your environment. The only Azure resources created are a **storage account** and a **resource group** (`onelens-rg`) to hold Cost Management export files. Costs are limited to storing and writing those export files.

| Item                        | What it is                                                                                                                   | Typical cost                             |
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------- |
| **Compute**                 | None — OneLens runs no compute in your tenant.                                                                               | $0                                       |
| **Cost Management exports** | Scheduled daily export of actual + amortized cost data. Exports themselves are free; you pay only for the resulting storage. | $0 (export feature)                      |
| **Blob storage**            | Parquet export files in a Standard LRS account. Volume depends on subscription size; typically a few GB.                     | \~$0.02–$0.50/month                      |
| **Data egress**             | OneLens reads exports and API metadata. Egress for metadata reads is negligible.                                             | <$0.05/month                             |
| **Estimated total**         | Sum of above                                                                                                                 | **\~$0.05–$0.55/month per subscription** |

> Costs scale with the number of resources and the volume of cost records. For very large subscriptions, storage may reach a few dollars per month. Standard LRS is the lowest-cost redundancy option and is recommended.

## How It Works

OneLens connects to Azure using an **App Registration (Service Principal)** that you create in Microsoft Entra ID. You assign read-only billing and resource roles to this service principal (and to a OneLens-provided external reader identity) scoped to the subscriptions you want to onboard.

OneLens collects data from two sources:

1. **Azure Cost Management exports** — You configure a daily export of actual and amortized cost/usage data (in Parquet format) to a storage account in your tenant. OneLens reads these files via the `Storage Blob Data Reader` role.
2. **Azure Resource Manager + Cost Management APIs** — Using the `Reader` and `Cost Management Reader` roles, OneLens reads resource inventory metadata and cost data to power right-sizing, anomaly detection, and allocation.

Optionally, enabling **AKS cost analysis** and **tag inheritance** enriches the data with per-cluster container costs and inherited tags for accurate cost allocation.

## Azure Integration

### Prerequisites

* The user performing the integration must have the **Owner** role on each subscription being integrated.
* The following resource providers must be enabled on the subscriptions in the management groups being onboarded:
  * `Microsoft.CostManagementExports`
  * `Microsoft.CostManagement`
  * `Microsoft.Billing`
  * `Microsoft.Storage`
* Know your Azure billing account type. Three types are supported, and only the IAM billing-permission step differs between them:
  * Microsoft Online Services Program / Pay-as-you-go (**MOSP / PayGo**)
  * Microsoft Customer Agreement (**MCA**)
  * Microsoft Enterprise Agreement (**EA**)
* Azure CLI installed (required for the storage network update and optional AKS steps).

### What OneLens will access

* **Cost Management & Billing data** — via `Billing reader` / `Billing account reader` and `Cost Management Reader`, to read spend by resource, service, and tag.
* **Resource inventory metadata** — via the subscription `Reader` role, to power right-sizing and idle-resource detection.
* **Cost export files** — via `Storage Blob Data Reader` on the single storage account holding the exports.

### What OneLens will NOT access

* ❌ The contents of your VMs, databases, storage objects (other than the export container), or application workloads.
* ❌ Any write, modify, or delete capability — all roles granted are read-only.
* ❌ Secrets, keys, or certificate material stored in your tenant.
* ❌ Subscriptions, resource groups, or storage accounts you do not explicitly onboard.

{% hint style="info" %}
Already have Azure connected to OneLens? If you've already onboarded another subscription, a management group, or a billing account, the App Registration (`onelens-sa`), client secret, storage account, cost exports, and OneLens external user already exist. You do **not** need to recreate them — skip to [Path B: Existing Azure Integration](#path-b-existing-azure-integration) and just extend access to the new subscription(s).
{% endhint %}

{% hint style="info" %}
Prefer an automated setup? OneLens also supports a seamless [automated integration using Terraform](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-azure/automated-using-terraform), which provisions the App Registration, storage account, exports, and IAM roles for you.
{% endhint %}

## Path A: Fresh Setup (No Existing Azure Integration)

If this is your first OneLens Azure connection, follow the full step-by-step guide:

**➡️** [**OneLens — Connecting to Azure at Subscription Level**](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-azure/at-subscription-level)

That guide walks through:

1. Creating the **App Registration** (`onelens-sa`) and copying the Client ID and Tenant ID.
2. Generating a **client secret** and copying its Value and ID.
3. Assigning **billing permissions** to the App Registration (`Billing account reader` for MCA/MOSP/PayGo, or `Billing reader` for EA).
4. Creating a **storage account** (`onelens-rg` resource group) and **container** (`onelens-cost-usage-reports`), and enabling **Cost Management exports** (actual + amortized, Parquet).
5. Assigning **Azure RBAC roles** to the App Registration (`Reader`, `Cost Management Reader` per subscription; `Storage Blob Data Reader` on the storage account).
6. Assigning **Azure RBAC roles** to the OneLens **external user** (`onelens.finops+<customername>@astuto.ai`).
7. Updating the **storage account network default action** (`az storage account update ... --default-action Allow`).
8. *(Optional)* Enabling **AKS cost analysis**.
9. *(Optional)* Enabling **tag inheritance**.

When you've finished those steps, continue to [Connect to OneLens](#connect-to-onelens) below to hand off the connection values.

## Path B: Existing Azure Integration

If your Azure environment is already connected to OneLens (at another subscription, a management group, or a billing account), the App Registration (`onelens-sa`), client secret, storage account, cost exports, and OneLens external user are already in place. You only need to extend read-only access to the new subscription. Do **not** recreate identities or storage.

{% stepper %}
{% step %}

## Confirm the required resource providers are registered on the new subscription.

```bash
for ns in Microsoft.CostManagementExports Microsoft.CostManagement Microsoft.Billing Microsoft.Storage; do
  az provider register --namespace $ns --subscription <newSubscriptionId>
done
```

{% endstep %}

{% step %}

## Assign `Reader` and `Cost Management Reader` on the new subscription

Assign `Reader` and `Cost Management Reader` on the new subscription to both the App Registration (`onelens-sa`) and the OneLens external user (`onelens.finops+<customername>@astuto.ai`).

For each identity: open **Subscriptions** → select the new subscription → **Access Control (IAM)** → **+ Add** → **Add role assignment** → assign `Reader`, then repeat for `Cost Management Reader`. The existing `Storage Blob Data Reader` grants on the shared storage account still apply, so no storage-account change is needed.
{% endstep %}

{% step %}

## Add the new subscription to a cost export.

If the existing export does not cover the new subscription, create a new export scoped to it (Cost Management + Billing → Exports), pointing at the **same** storage account and container (`onelens-cost-usage-reports`).
{% endstep %}

{% step %}

## Enable AKS cost analysis and tag inheritance

(Optional) Enable AKS cost analysis and tag inheritance for the new subscription.
{% endstep %}

{% step %}

## Continue to Connect to OneLens

Share only the new Subscription ID — the App Registration, secret, storage account, and container are unchanged.
{% endstep %}
{% endstepper %}

## Connect to OneLens

Once your chosen path is complete, share the following values with the OneLens team (via email to <support@astuto.ai> or through the OneLens dashboard) to finish the connection:

| Field                                                                  | Where to find it                                                           |
| ---------------------------------------------------------------------- | -------------------------------------------------------------------------- |
| **App Registration Tenant (Directory) ID**                             | Entra ID → App registrations → `onelens-sa` overview                       |
| **App Registration Client (Application) ID**                           | Entra ID → App registrations → `onelens-sa` overview                       |
| **App Registration Client Secret Value**                               | Entra ID → App registrations → `onelens-sa` → Certificates & secrets       |
| **App Registration Client Secret ID**                                  | Entra ID → App registrations → `onelens-sa` → Certificates & secrets       |
| **Storage Account name**                                               | The storage account holding the exports (`onelens-<customername>-billing`) |
| **Container name**                                                     | `onelens-cost-usage-reports`                                               |
| **Subscription ID(s) / Resource Group ID(s) / Management Group ID(s)** | The scopes you onboarded                                                   |

> **Existing integration?** If Azure is already connected, you only need to share the new **Subscription ID** — all other values are unchanged.

**Verification**: After OneLens confirms the connection (typically within 24–48 hours, once the first export has run), check the OneLens dashboard for:

* Cost data appearing in the Cost Explorer for each onboarded subscription.
* Resource inventory populated for right-sizing recommendations.
* AKS cost breakdowns (if AKS cost analysis was enabled).

## Data Refresh Schedule

* **Cost & usage data**: Azure Cost Management exports run daily; OneLens ingests the latest export files once per day. Daily cadence matches Azure's own export frequency and keeps storage cost minimal — polling more often does not surface fresher data.
* **Resource metadata**: Refreshed daily via the Azure Resource Manager APIs.

Current-period (month-to-date) figures may shift until the billing period closes and amortized costs are finalized.

## Data Privacy & Security

* ✅ **Read-only access** — only `Reader`, `Cost Management Reader`, `Billing reader`/`Billing account reader`, and `Storage Blob Data Reader` roles are granted.
* ✅ **Restricted scope** — access is limited to the subscriptions you onboard and the single export storage account/container.
* ✅ **No application data** — OneLens reads cost and resource metadata and export files only; it never reads VM, database, or workload contents.
* ✅ **TLS in transit, encrypted at rest** — all API/blob access is over TLS; exports are stored encrypted in your own storage account.
* ✅ **No write capability** — no role grants write, modify, or delete permissions.
* ✅ **Credentials stored encrypted** — your client secret is stored encrypted by OneLens and can be rotated at any time.
* ✅ **Network access does not bypass RBAC** — `--default-action Allow` affects network rules only; valid credentials and role assignments are still required.

## Troubleshooting

| # | Symptom                                         | Cause                                                                                    | Fix                                                                                                                                            |
| - | ----------------------------------------------- | ---------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| 1 | "Authorization failed" when assigning roles     | The signed-in user lacks **Owner** on the subscription.                                  | Have a subscription Owner perform the role assignments, or request the Owner role.                                                             |
| 2 | App registration not found when adding a member | `onelens-sa` was created in a different tenant or hasn't propagated.                     | Confirm you are in the correct tenant and search by the exact name `onelens-sa`.                                                               |
| 3 | Client secret authentication fails              | The secret `Value` was mistyped, expired, or you shared the `ID` instead of the `Value`. | Generate a new secret, copy the `Value` immediately, and re-share with OneLens.                                                                |
| 4 | No export files appear in the container         | The export was scoped to the wrong subscription, or the first run hasn't completed.      | Verify the export Scope and destination; wait up to 24 hours for the first run.                                                                |
| 5 | OneLens cannot read export files                | `Storage Blob Data Reader` not assigned, or network default action is `Deny`.            | Assign `Storage Blob Data Reader` and run `az storage account update ... --default-action Allow`.                                              |
| 6 | Connected but no cost data after 24–48 hours    | Missing `Cost Management Reader` role or resource providers not registered.              | Confirm both `Reader` and `Cost Management Reader` are assigned and the four resource providers are registered.                                |
| 7 | AKS cost analysis command fails                 | Cluster is on the **Free** tier or required providers aren't registered.                 | Move the cluster to **Standard**/**Premium** and register `Microsoft.ContainerService`, `Microsoft.Insights`, `Microsoft.OperationalInsights`. |
| 8 | Costs not grouped by team/tag                   | Tag inheritance not enabled.                                                             | Enable tag inheritance.                                                                                                                        |

## Frequently Asked Questions

<details>

<summary>Can OneLens see our application data, VM contents, or database records?</summary>

No. OneLens reads cost/billing metadata, resource inventory metadata, and the Cost Management export files only. It has no access to the contents of your workloads.

</details>

<details>

<summary>Can OneLens modify or delete anything in our Azure environment?</summary>

No. Every role granted (`Reader`, `Cost Management Reader`, `Billing reader`/`Billing account reader`, `Storage Blob Data Reader`) is read-only. No write, modify, or delete permissions are assigned.

</details>

<details>

<summary>Why does OneLens need access via both an App Registration and an external user?</summary>

The App Registration (service principal) provides programmatic, automated access for ongoing data collection, while the invited external reader supports OneLens-side connection workflows. Both are read-only and scoped to the subscriptions you onboard.

</details>

<details>

<summary>Will this impact our Azure performance or bills?</summary>

No measurable performance impact. The only added cost is storing the daily export files (typically cents to a few dollars per month). OneLens runs no compute in your tenant.

</details>

<details>

<summary>Can I onboard multiple subscriptions?</summary>

Yes. For each additional subscription, follow [Path B](#path-b-existing-azure-integration) to extend `Reader` and `Cost Management Reader` access. A single export storage account can be reused.

</details>

<details>

<summary>How do I rotate the client secret?</summary>

In Entra ID → App registrations → `onelens-sa` → Certificates & secrets, create a new secret, copy its `Value`, share it with OneLens, then delete the old secret.

</details>

<details>

<summary>How do I disconnect OneLens?</summary>

Remove the role assignments for `onelens-sa` and the OneLens external user from each subscription and the storage account, delete the client secret (or the `onelens-sa` app registration entirely), and optionally delete the export and `onelens-rg` resource group. Notify OneLens so the connection is removed on their end.

</details>

<details>

<summary>Does enabling `--default-action Allow` make my storage account public?</summary>

No. It changes network-rule behavior only. Reading data still requires valid credentials and the `Storage Blob Data Reader` role.

</details>

## Need Help?

**OneLens Documentation:**

* [Connecting to Azure (overview)](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-azure)
* [Connect at Subscription Level (full step-by-step)](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-azure/at-subscription-level)
* [Automated integration using Terraform](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-azure/automated-using-terraform)
* [Connect at Management Group](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-azure/at-management-group)

**Azure Documentation:**

* [Create a Microsoft Entra application and service principal](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal)
* [Create exports with Cost Management](https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/tutorial-improved-exports)
* [Assign Azure roles using the portal](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal)
* [Enable tag inheritance](https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/enable-tag-inheritance)

**OneLens Support**: <support@astuto.ai>

***

*Reference sources:* [*OneLens — Connecting to Azure at Subscription Level*](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-azure/at-subscription-level) *·* [*OneLens — Connecting to Azure (overview)*](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-azure) *·* [*OneLens — Automated using Terraform*](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-azure/automated-using-terraform) *·* [*Azure Cost Management exports*](https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/tutorial-improved-exports) *·* [*Azure RBAC role assignments*](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal)


# Azure Foundry


# Claude Enterprise Integration

Customer Onboarding Guide — Claude Enterprise Analytics API

## TL;DR

* **What this does:** Connects OneLens to your Claude Enterprise organization to provide per-user cost attribution, token usage analytics, engagement tracking, and adoption insights across all Claude products — chat, Claude Code, Cowork, Office Agent, and Claude in Chrome — through a single API integration.
* **Time required:** \~10 minutes
* **Who you need:** A Primary Owner in your Claude Enterprise organization (to provision the Analytics API key).
* **What OneLens reads:** Aggregate per-user token counts, USD costs, engagement metrics, and adoption data via Anthropic's Enterprise Analytics API. Your prompts, conversations, and model outputs are never accessed.

## What You'll Get Once Connected

| Capability                          | What it does                                                                                                                                    |
| ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| Per-User Cost Attribution           | Ranks users by spend across all Claude surfaces, with discounted and list-price amounts.                                                        |
| Per-User Token Usage                | Breaks down token consumption per user by model, product surface, and context window tier.                                                      |
| Product Surface Breakdown           | Separates usage and cost across Claude chat, Claude Code, Cowork, Office Agent, and Claude in Chrome — all from a single API.                   |
| Per-Model Cost Analysis             | Breaks down cost by Claude model (Opus, Sonnet, Haiku) per user and per product surface.                                                        |
| Engagement Analytics                | Tracks daily/weekly/monthly active users, seat utilization, and adoption trends over time.                                                      |
| Project Adoption Tracking           | Monitors which Claude projects are used, by how many users, and how often.                                                                      |
| Skill & Connector Usage             | Identifies which skills and MCP connectors are adopted across your organization.                                                                |
| Fast Mode & Data Residency Tracking | Tracks fast mode usage (6x pricing for Opus 4.6/4.7) and data residency multiplier (1.1x for inference\_geo: "us") as separate cost dimensions. |
| Web Search & Code Execution Costs   | Monitors web search ($10/1K searches) and code execution costs as distinct line items.                                                          |
| Budget & Spend Alerts               | Tracks per-user and organization-level spend against configurable thresholds.                                                                   |
| Anomaly Detection                   | Flags unexpected cost or usage spikes by user, model, or product surface.                                                                       |
| Deleted User Handling               | Users who leave the organization appear as "Deleted User" in cost attribution with historical data preserved.                                   |

## Security at a Glance

| Question                                               | Answer                                                                                                                                                                                                                                        |
| ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Does OneLens read our prompts or model outputs?        | No. OneLens reads only aggregate usage metrics (token counts), cost data, and engagement counters. No prompt content, conversation text, or model responses are accessed.                                                                     |
| Does OneLens see conversation content or file uploads? | No. The Analytics API returns only counts (e.g., distinct\_files\_uploaded\_count), token totals, model identifiers, and dollar amounts — never content.                                                                                      |
| Is the API key read-only?                              | Yes. The analytics key with read:analytics scope is genuinely read-only. It cannot modify any resources in your organization.                                                                                                                 |
| What authentication is used?                           | An analytics API key with read:analytics scope, provisioned by a Primary Owner at claude.ai/analytics/api-keys. This is a long-lived bearer token passed in the x-api-key header. It does not expire automatically — see Key Lifecycle below. |
| How is data transmitted and stored?                    | All API calls use TLS 1.2+ in transit. Credentials are encrypted at rest using GCP KMS. API keys are stored securely in OneLens infrastructure, encrypted at rest, and access is strictly scoped.                                             |
| Can I restrict by IP?                                  | Anthropic does not currently offer IP allowlisting for the Analytics API. Access is controlled via API key scoping and Primary Owner provisioning.                                                                                            |

## Cost of the Integration

OneLens reads metadata via Anthropic's Enterprise Analytics REST API. There is no compute, storage, or egress cost on Anthropic's side.

| Item                    | What it is                                                        | Typical cost                        |
| ----------------------- | ----------------------------------------------------------------- | ----------------------------------- |
| API calls               | Daily polling: engagement (1 call/day) + cost/usage (4 calls/day) | $0 (no per-request charge)          |
| Data egress             | JSON metadata responses, <5 MB/day                                | $0                                  |
| Compute in your account | None — OneLens calls Anthropic's hosted API                       | $0                                  |
| Storage in your account | None                                                              | $0                                  |
| **Estimated total**     |                                                                   | **$0/month on your Anthropic bill** |

Anthropic does not charge for Analytics API requests. The only cost is your existing Claude Enterprise subscription and usage, which OneLens helps you optimize.

## How It Works

The Claude Enterprise Analytics API provides programmatic access to engagement, adoption, usage, and cost data across all Claude surfaces within your Enterprise organization through a single integration point. No per-product setup is needed — one API key covers everything.

The API is organized into two endpoint families:

**Engagement & Adoption:** Per-user daily engagement metrics across Claude chat, Claude Code, Cowork, Office Agent, and Claude in Chrome (message counts, session counts, project usage, file uploads, artifact creation, skill/connector usage, git activity). Organization-level DAU/WAU/MAU, seat utilization. Per-project and per-skill/connector adoption data.

**Cost & Usage:** Per-user token usage and USD cost (discounted and list-price), ranked by consumption or spend. Bucketed token usage and cost over time (1m, 1h, 1d), with grouping by product surface, model, context window, inference region, speed, cost type, and token type. All cost amounts are reported as decimal strings in cents (e.g., "41280.000000" = $412.80). OneLens parses these as arbitrary-precision decimals to avoid floating-point rounding errors on large values.

OneLens polls the Enterprise Analytics API once daily. All data is normalized into a unified cost model alongside your other AI providers.

## Prerequisites

* A Claude Enterprise plan (this API is not available on Team or individual plans)
* A user with the Primary Owner role in the Enterprise organization
* Access to claude.ai

{% hint style="info" %}
**Note on seat-based vs. usage-based plans:** The cost and usage endpoints apply to usage-based Enterprise plans. For seat-based Enterprise plans, these endpoints will reflect usage credits only, not seat-based subscription costs.
{% endhint %}

## What OneLens Will Access

| Endpoint                                            | Purpose                                                |
| --------------------------------------------------- | ------------------------------------------------------ |
| GET /v1/organizations/analytics/summaries           | DAU/WAU/MAU, seat utilization, pending invites         |
| GET /v1/organizations/analytics/users               | Per-user engagement metrics across all Claude surfaces |
| GET /v1/organizations/analytics/apps/chat/projects  | Per-project adoption data                              |
| GET /v1/organizations/analytics/skills              | Skill usage by surface                                 |
| GET /v1/organizations/analytics/connectors          | Connector usage by surface                             |
| GET /v1/organizations/analytics/user\_usage\_report | Per-user token usage ranked by consumption             |
| GET /v1/organizations/analytics/user\_cost\_report  | Per-user USD cost ranked by spend                      |
| GET /v1/organizations/analytics/usage\_report       | Bucketed token usage over time                         |
| GET /v1/organizations/analytics/cost\_report        | Bucketed USD cost over time                            |

## What OneLens Will NOT Access

* Messages or conversation content
* File uploads or artifact content
* User account management (create, update, delete)
* Organization settings or configuration
* Any write operations of any kind

{% stepper %}
{% step %}

## Enable the Analytics API

1. Sign in to claude.ai as a Primary Owner
2. Navigate to claude.ai/analytics/api-keys
3. Toggle the public API access switch to enabled

{% hint style="warning" %}
**WARNING:** If you disable this toggle later, all API requests will be denied immediately — including OneLens polling. You can re-enable it at any time.
{% endhint %}
{% endstep %}

{% step %}

## Create an Analytics API Key

1. On the same page (claude.ai/analytics/api-keys), click **Create Key**
2. Select the `read:analytics` scope
3. Name it **OneLens Integration**
4. Copy the key — store it securely

{% hint style="info" %}
**Note:** Rate limits apply at the organization level, not per key. You can create multiple keys, but they share a single rate limit pool.
{% endhint %}
{% endstep %}

{% step %}

## Verify the Key Works

Run this from your terminal to confirm the key is valid:

```bash
curl -X GET \
  "https://api.anthropic.com/v1/organizations/analytics/summaries?starting_date=2026-05-01" \
  --header "x-api-key: YOUR_ANALYTICS_KEY_HERE"
```

If you get back a JSON response with `daily_active_user_count`, the key is working. Adjust the date to at least 4 days in the past.
{% endstep %}

{% step %}

## Connect to OneLens

Provide the following in the OneLens integration setup:

| Field             | Value                                  | Example            |
| ----------------- | -------------------------------------- | ------------------ |
| Provider          | Anthropic                              | —                  |
| Analytics API Key | Your key with read:analytics scope     | sk-ant-xxxx...xxxx |
| Organization Name | Your Enterprise org name (for display) | Acme Corp          |

{% hint style="info" %}
**Secure key sharing:** Never share API keys over email or chat. Use a validated secure sharing tool like [Password.link](https://password.link/en) to transmit credentials safely.
{% endhint %}
{% endstep %}

{% step %}

## Verify the Connection

After connecting, OneLens runs a validation check:

1. Calls GET /v1/organizations/analytics/summaries with a recent date to confirm the key is valid
2. Calls GET /v1/organizations/analytics/users with the same date to confirm per-user data access
3. Calls GET /v1/organizations/analytics/user\_cost\_report to confirm cost data access

If all checks pass, data will begin populating within 24 hours. Historical data for up to 365 days will be backfilled automatically (subject to data freshness delays; cost data available from 2026-01-01 onward).
{% endstep %}
{% endstepper %}

## Data Refresh Schedule

| Data source                                                                         | Polling cadence | Source-side latency                                                  |
| ----------------------------------------------------------------------------------- | --------------- | -------------------------------------------------------------------- |
| Engagement & adoption (users, summaries, projects, skills, connectors)              | Once daily      | \~4-day delay from activity date                                     |
| Cost & usage (user\_usage\_report, user\_cost\_report, usage\_report, cost\_report) | Once daily      | Typically available within 4 hours of usage; may take up to 24 hours |

## Key Lifecycle

* Analytics API keys do not expire automatically. They remain valid until manually deleted or the public API toggle is disabled.
* Only Primary Owners can manage analytics keys at claude.ai/analytics/api-keys.
* If the Primary Owner who created the key leaves, another Primary Owner can revoke it. Ensure your organization has more than one Primary Owner for operational continuity.
* Disabling the public API toggle immediately blocks all analytics keys, regardless of who created them.
* **Rotation recommendation:** Rotate keys every 90 days as a best practice. Create a new key, update it in OneLens, then delete the old key. OneLens uses the new key on the next daily poll — no downtime.

## Data Privacy & Security

* No prompt or response content — only aggregate token counts, cost data, and engagement counters are accessed
* Genuinely read-only API key — scoped to read:analytics with no write capabilities
* TLS 1.2+ for all data in transit
* GCP KMS encryption for all credentials and data at rest
* API keys stored securely in OneLens infrastructure, encrypted at rest using GCP KMS
* No write operations — OneLens never calls POST, PUT, PATCH, or DELETE endpoints
* Deleted user handling — users who leave the organization appear as "Deleted User" in historical data; OneLens preserves historical attribution but does not surface PII for deleted users
* **Data retention** — 12-month default, configurable. Deletion within 30 days on request with confirmation.

## Frequently Asked Questions

<details>

<summary>Can OneLens see our conversations, prompts, or file uploads?</summary>

No. The Analytics API returns only aggregate counts (e.g., message\_count, distinct\_files\_uploaded\_count) and never exposes actual conversation text, prompt content, or uploaded file contents.

</details>

<details>

<summary>Can OneLens modify our Claude Enterprise organization?</summary>

No. The analytics API key with read:analytics scope is genuinely read-only. OneLens cannot modify users, projects, settings, or any organizational resources.

</details>

<details>

<summary>Will this integration impact our users' Claude experience?</summary>

No. The Analytics API is separate from Claude's production infrastructure. OneLens polls once daily, which does not affect response times, rate limits, or availability for your users.

</details>

<details>

<summary>Does one API key cover all Claude products?</summary>

Yes. A single analytics API key with read:analytics scope gives OneLens visibility across all Claude surfaces — chat, Claude Code, Cowork, Office Agent, and Claude in Chrome. No per-product setup is needed.

</details>

<details>

<summary>Can I connect multiple Claude Enterprise organizations?</summary>

Yes. Add each organization separately in OneLens with its own analytics API key. Each appears as a distinct source in your unified dashboard.

</details>

<details>

<summary>How do I disconnect OneLens?</summary>

Either disable the public API toggle at claude.ai/analytics/api-keys (immediately blocks all requests) or delete the specific analytics API key. All access is immediately revoked.

</details>

<details>

<summary>How do I rotate the API key?</summary>

Create a new analytics API key at claude.ai/analytics/api-keys, update it in OneLens, then delete the old key. There is no downtime — OneLens uses the new key on the next daily poll. We recommend rotating every 90 days.

</details>

<details>

<summary>What happens when the Primary Owner who created the key leaves?</summary>

Another Primary Owner can manage the key. The key remains functional until explicitly deleted or the public API toggle is disabled. Ensure your organization has more than one Primary Owner for operational continuity.

</details>

<details>

<summary>What about direct Anthropic API usage (console.anthropic.com)?</summary>

This integration covers Claude Enterprise (claude.ai) product surfaces. For direct Anthropic API usage billed through console.anthropic.com, a separate Admin API integration is available — contact OneLens support.

</details>

<details>

<summary>What about Anthropic usage via Amazon Bedrock or Google Vertex AI?</summary>

Bedrock and Vertex AI have their own billing and usage APIs managed by AWS and Google respectively. For Bedrock, connect OneLens via the AWS Bedrock integration. For Vertex AI, use the GCP integration.

</details>

<details>

<summary>Does OneLens see user email addresses?</summary>

Yes — the Analytics API returns user email addresses as part of per-user activity and cost data. OneLens uses these for per-user cost attribution dashboards. Users who have been deleted from the organization appear as "Deleted User" with a null email. Contact OneLens support to discuss anonymization options if your security policy restricts PII handling.

</details>

<details>

<summary>My organization uses Priority Tier. Will I see those costs?</summary>

Priority Tier costs are not included in the cost endpoint directly. OneLens tracks Priority Tier usage via token counts by service tier and applies list-price rates for cost estimation. For exact Priority Tier billing, refer to your Anthropic invoice.

</details>

<details>

<summary>My organization is on a seat-based Enterprise plan. Will cost endpoints work?</summary>

Yes, but cost/usage endpoints will reflect usage credits only, not seat-based subscription costs. Token usage data is still available and useful for understanding consumption patterns.

</details>

<details>

<summary>How far back can I pull historical data?</summary>

The Enterprise Analytics API supports querying up to 365 days in the past, with a maximum of 31 days per query window. No data is available prior to 2026-01-01. OneLens backfills the maximum available history on initial connection.

</details>

## Need Help?

**Anthropic Documentation:**

* [Enterprise Analytics API reference](https://docs.anthropic.com/)
* [Get started with the Enterprise Analytics API](https://docs.anthropic.com/)
* [View usage analytics for Team and Enterprise plans](https://docs.anthropic.com/)
* [Claude Enterprise consumption guide](https://docs.anthropic.com/)
* [Pricing](https://www.anthropic.com/pricing)

**OneLens Support:** <support@astuto.ai> · Security: <security@astuto.ai>


# Gemini Enterprise

Customer Onboarding Guide — Google Gemini Enterprise Integration

> Vertex AI Gemini is now called **Gemini Enterprise**. References to the Vertex AI API (`aiplatform.googleapis.com`) and Vertex AI IAM roles in this guide reflect the underlying Google Cloud service name, which remains unchanged.

### TL;DR

* **What this does**: Connects OneLens to your Google Cloud project to collect Gemini Enterprise cost, usage, and performance data — giving you model-level spend visibility, token consumption tracking, and AI cost optimization recommendations.
* **Time required**: \~10 minutes if your GCP cloud integration is already connected; \~25 minutes for a fresh setup.
* **Who you need**: A Google Cloud IAM administrator who can create service accounts and assign roles. One DevOps or platform engineer to run the setup.
* **What OneLens reads**: Read-only access to Cloud Billing export data (BigQuery), Gemini Enterprise API metadata, Cloud Monitoring metrics, and Cloud Audit Logs (caller identity only). Your prompts, completions, and application data are never accessed.

### What You'll Get Once Connected

| Capability                       | What it does for you                                                                                                                                        |
| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Unified AI Cost Explorer**     | See Gemini spend broken down by model, token type (input/output), project, and region — all in one view.                                                    |
| **Model-Level Cost Attribution** | Track costs per model (Gemini 2.5 Pro, Gemini 2.5 Flash, Gemini 3 Pro, etc.) using BigQuery billing export line items with project and label breakdowns.    |
| **Token Usage Analytics**        | Monitor input and output token consumption by model ID via Cloud Monitoring metrics. Spot which models and workloads consume the most tokens.               |
| **Cost Anomaly Detection**       | Get alerted when Gemini Enterprise spend deviates from historical patterns — catch runaway agent loops, unexpected model switches, or traffic spikes early. |
| **Budget Tracking**              | Set per-model or per-project budgets and track actuals against them, using billing labels and Google Cloud project-level attribution.                       |
| **Per-User Attribution**         | Attribute Gemini usage to individual users or service accounts via caller identity metadata from Cloud Audit Logs.                                          |
| **Idle Resource Detection**      | Flag provisioned throughput commitments with low utilization so you can rightsize or release capacity.                                                      |

### Security at a Glance

| Question                                         | Answer                                                                                                                                                                                                                                                                                                                                                                 |
| ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Does OneLens read my prompts or model responses? | **No.** OneLens reads only Cloud Monitoring metrics and BigQuery billing data. It has no access to Gemini request or response payloads.                                                                                                                                                                                                                                |
| Does OneLens see my application data?            | **No.** OneLens accesses only Gemini Enterprise usage metadata, Cloud Monitoring metrics, and billing reports. It has no access to your application databases, Cloud Storage buckets, or any Vertex AI datasets.                                                                                                                                                       |
| Is access read-only?                             | **Yes.** The service account is granted viewer-level roles at both organisation level (`Organisation Viewer`, `Cloud Asset Viewer`, `Browser`, `Billing Account Viewer`) and project/folder level (`Vertex AI Viewer`, `Monitoring Viewer`, `Logging Viewer`, and other standard GCP integration roles). No create, update, delete, or invoke permissions are granted. |
| What authentication is used?                     | Google Cloud service account with impersonation. OneLens accesses your environment via its backend service account (`onelens-customer-sa@astuto-prod-mum.iam.gserviceaccount.com`) and external user (`onelens.finops@astuto.ai`), which are granted `Service Account Token Creator` on your service account. No long-lived JSON keys are downloaded.                  |
| How is data transmitted and stored?              | TLS 1.2+ in transit. At rest, data is encrypted using GCP KMS in OneLens infrastructure with standard organizational policies meeting ISO 27001 and SOC 2 compliance.                                                                                                                                                                                                  |

***

### Cost of the Integration

OneLens does not create any new infrastructure in your Google Cloud environment. The only cost is the BigQuery storage and query processing for the billing export dataset, which Google Cloud provides at no charge for standard billing export tables.

| Item                            | What it is                                                                                        | Typical cost                                       |
| ------------------------------- | ------------------------------------------------------------------------------------------------- | -------------------------------------------------- |
| **BigQuery billing export**     | Standard billing export table (auto-populated by Google Cloud)                                    | $0 (included in Cloud Billing)                     |
| **BigQuery queries**            | OneLens queries the billing export table. First 1 TiB/month free under BigQuery on-demand pricing | $0 – $5/month (depends on query volume)            |
| **Cloud Monitoring API calls**  | Reads from `monitoring.googleapis.com` for Gemini Enterprise metrics                              | $0 (within free tier of 1M API calls/month)        |
| **Data egress**                 | Metadata transferred to OneLens (\~10–50 MB/day)                                                  | < $0.01/month                                      |
| **Cloud Audit Logs (optional)** | **Enables caller identity attribution. First 50 GB/month free (\~25M API calls)**                 | **$0 for most customers; $25/month at 50M+ calls** |
| **Estimated total**             | Sum of above                                                                                      | **$0 – $25/month**                                 |

> Queries beyond the free 1 TiB/month tier are billed at $6.25/TiB. For most organizations, OneLens billing queries stay well within the free tier.

***

### How It Works

Gemini Enterprise (formerly Vertex AI Gemini) provides access to Gemini models through a managed Google Cloud API. All usage — tokens consumed, latency, model ID, and caller identity — is captured via Cloud Monitoring metrics and Cloud Audit Logs. Cost data flows into BigQuery through Cloud Billing export, which Google auto-populates with line-item detail including SKU, project, labels, and pricing.

OneLens collects data from 3 sources:

1. **BigQuery Billing Export** — Line-item cost and usage data per SKU, model, project, and label.
2. **Cloud Monitoring Metrics** — Token counts, request counts, and latency by model and region (`aiplatform.googleapis.com/prediction` metrics).
3. **Cloud Audit Logs** — Caller identity (user or service account) from Gemini Enterprise `aiplatform.googleapis.com` Data Access logs, used for per-user attribution.

***

### Integration Steps

#### Prerequisites

* A Google Cloud project with the **Vertex AI API** enabled (`aiplatform.googleapis.com`).
* The user performing the integration must have **Owner** on the projects/folders to be onboarded and **Organisation Administrator** on the organisation.

> **Already have the GCP Cloud & Cost integration connected?** If you have already completed the [Manual GCP Integration](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-gcp/manual), the billing project, service account, billing export, and most IAM roles are already in place. Skip to [Verify Gemini-Specific Requirements](#verify-gemini-specific-requirements) below.

#### What OneLens Will Access

* `bigquery.tables.getData` on the billing export dataset — cost and usage line items
* `monitoring.timeSeries.list` — Gemini Enterprise prediction metrics (token counts, latency, request counts)
* `aiplatform.models.list`, `aiplatform.endpoints.list` — model and endpoint metadata
* `logging.entries.list` — caller identity from Gemini Enterprise audit logs (per-user attribution)
* `resourcemanager.projects.get` — project metadata for labeling

#### What OneLens Will NOT Access

* ❌ Gemini prompt or completion content
* ❌ Gemini Enterprise datasets, training data, or fine-tuned model weights
* ❌ Cloud Storage buckets or application databases
* ❌ Any write, invoke, or delete operations on Gemini Enterprise resources
* ❌ Secrets Manager, KMS keys, or IAM policy modifications

***

#### Path A: Fresh Setup (No Existing GCP Integration)

If you have not yet connected your GCP environment to OneLens, follow the full [Manual GCP Integration guide](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-gcp/manual). That guide covers:

1. Creating the billing project and enabling cost export to BigQuery
2. Creating the OneLens Reader service account with BigQuery roles on the billing project
3. Granting `Service Account Token Creator` to OneLens principals (`onelens-customer-sa@astuto-prod-mum.iam.gserviceaccount.com` and `onelens.finops@astuto.ai`)
4. Assigning organisation-level roles (`Organisation Viewer`, `Cloud Asset Viewer`, `Browser`, `Billing Account Viewer`)
5. Assigning project/folder-level roles (including `Vertex AI Viewer` and `Monitoring Viewer`)

Once the GCP integration is complete, the `Vertex AI Viewer` role is already in place. However, the standard GCP integration does **not** include `Logging Viewer` — you will need to grant this additional role for Gemini per-user attribution. Proceed to [Verify Gemini-Specific Requirements.](#verify-gemini-specific-requirements)

***

#### Path B: Existing GCP Integration

If your GCP cloud & cost integration is already connected, verify the following Gemini-specific requirements.

#### **Verify Gemini-Specific Requirements**

**1. Confirm the Vertex AI API is enabled on each project using Gemini.**

```bash
# Check if the Vertex AI API is enabled
gcloud services list --enabled --project=YOUR_PROJECT_ID \
  --filter="config.name=aiplatform.googleapis.com"

# If not listed, enable it
gcloud services enable aiplatform.googleapis.com --project=YOUR_PROJECT_ID
```

**2. Confirm `Vertex AI Viewer` is assigned to the OneLens Reader service account.**

The [Manual GCP Integration](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-gcp/manual) already grants this role at the project/folder level (Step 5). Verify it is in place:

```bash
# Check IAM bindings for the service account
gcloud projects get-iam-policy YOUR_PROJECT_ID \
  --flatten="bindings[].members" \
  --filter="bindings.members:YOUR_ONELENS_SA_EMAIL AND bindings.role:roles/aiplatform.viewer" \
  --format="table(bindings.role, bindings.members)"
```

If the role is missing, add it:

```bash
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:YOUR_ONELENS_SA_EMAIL" \
  --role="roles/aiplatform.viewer"
```

**3. Confirm `Monitoring Viewer` is assigned** (also part of the standard GCP integration, Step 5).

```bash
gcloud projects get-iam-policy YOUR_PROJECT_ID \
  --flatten="bindings[].members" \
  --filter="bindings.members:YOUR_ONELENS_SA_EMAIL AND bindings.role:roles/monitoring.viewer" \
  --format="table(bindings.role, bindings.members)"
```

**4. Grant `Logging Viewer` (Gemini-specific — not part of the standard GCP integration).**

This role is required for per-user attribution. It allows OneLens to read caller identity from Gemini Enterprise Data Access audit logs.

```bash
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:YOUR_ONELENS_SA_EMAIL" \
  --role="roles/logging.viewer"
```

> `roles/logging.viewer` is **not** included in the standard [GCP Cloud & Cost Integration](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-gcp/manual). It must be granted explicitly for the Gemini integration.

***

#### Connect to OneLens

Share the following information with the OneLens team (via email to <support@astuto.ai> or through the OneLens dashboard):

| Field                          | Where to find it                                                                   |
| ------------------------------ | ---------------------------------------------------------------------------------- |
| **Google Cloud Project ID(s)** | Google Cloud Console → Project selector (top bar) — list each project using Gemini |
| **Service Account email**      | IAM & Admin → Service Accounts → the OneLens Reader SA email                       |
| **Billing Project ID**         | The project containing the BigQuery billing export dataset                         |
| **BigQuery Dataset ID**        | Cloud Billing → Billing export → Dataset name (e.g., `billing_export`)             |

> **Verification**: After OneLens confirms the connection (typically within 24 hours), check the OneLens dashboard for:
>
> * Gemini model cost data appearing in the AI Cost Explorer
> * Token usage metrics populating per model
> * Project and label attribution visible in cost breakdowns

***

### Data Refresh Schedule

* **Billing data (BigQuery)**: Refreshed daily. Google Cloud billing export has an inherent delay of 12–24 hours, so polling more frequently does not surface fresher data.
* **Cloud Monitoring metrics**: Refreshed every 6 hours. Gemini Enterprise metrics are available with \~5 minute delay in Cloud Monitoring.
* **Cloud Audit Logs**: Refreshed every 6 hours. Used for per-user attribution of Gemini API calls.

> Current-period cost figures may shift until the billing period closes, as Google Cloud applies credits, sustained-use discounts, and committed-use discount adjustments retroactively.

***

### Data Privacy & Security

* ✅ **Read-only access** — OneLens cannot invoke models, create resources, or modify any configuration in your Google Cloud project.
* ✅ **No prompt/completion access** — OneLens never reads the content of your Gemini requests or responses.
* ✅ **Scoped IAM roles** — Only viewer-level roles are granted. No admin or editor roles.
* ✅ **No long-lived keys** — OneLens uses service account impersonation via `Service Account Token Creator`. No JSON keys are downloaded or stored.
* ✅ **TLS 1.2+ in transit** — All data transfers between Google Cloud and OneLens use TLS encryption.
* ✅ **Encrypted at rest** — Collected data is encrypted using GCP KMS in OneLens infrastructure.
* ✅ **VPC Service Controls compatible** — You can restrict the service account's access using VPC Service Controls perimeters and organization policies.
* ✅ **Revocable at any time** — Remove the `Service Account Token Creator` grant or delete the service account to immediately revoke OneLens access.

***

### Troubleshooting

#### `PERMISSION_DENIED` when OneLens queries BigQuery

**Cause:** Service account lacks `BigQuery Data Viewer` on the billing export dataset.

**Fix:** Grant `BigQuery Data Viewer` at the dataset or project level. See the [Manual GCP Integration](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-gcp/manual) Step 2.

***

#### No billing data after 48 hours

**Cause:** Cloud Billing export to BigQuery is not enabled, or the dataset is in a different project.

**Fix:** Verify export is enabled: Cloud Billing → Billing export. Confirm the dataset project matches what was shared with OneLens.

***

#### `INVALID_ARGUMENT` or `NOT_FOUND` on Cloud Monitoring calls

**Cause:** Gemini Enterprise API is not enabled in the project.

**Fix:** Enable the API:

```bash
gcloud services enable aiplatform.googleapis.com --project=YOUR_PROJECT_ID
```

***

#### Token metrics show zero values

**Cause:** No Gemini API calls have been made in the monitored project/region.

**Fix:** Confirm Gemini is being called in the project and region configured for OneLens.

***

#### `403 Forbidden` on service account impersonation

**Cause:** `Service Account Token Creator` not granted to OneLens principals on the service account.

**Fix:** Grant the role to `onelens-customer-sa@astuto-prod-mum.iam.gserviceaccount.com` and `onelens.finops@astuto.ai` on the service account.

***

#### Per-user attribution not showing

**Cause:** `Logging Viewer` role is not granted, or Data Access audit logs are not enabled for `aiplatform.googleapis.com`.

**Fix:** Grant `roles/logging.viewer` to the OneLens service account (see Step 4 above). Verify Data Access logging is enabled for the Gemini Enterprise API in your project's audit log configuration (IAM & Admin → Audit Logs → `aiplatform.googleapis.com` → enable Data Read).

***

#### VPC Service Controls blocking OneLens access

**Cause:** The service perimeter does not include the OneLens egress IP.

**Fix:** Add OneLens egress IPs (provided during onboarding) to the VPC Service Controls access level ingress policy.

***

#### Connected but cost data looks incomplete

**Cause:** Billing export only includes data from the date export was enabled — it does not backfill.

**Fix:** Expected behavior. Historical data will accumulate from the export start date. Use the [recommended dataset setup](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-gcp/manual) (US multi-region) to get retroactive data from the start of the previous month.

***

### Frequently Asked Questions

**Can OneLens see our prompts, completions, or application data?** No. OneLens reads only billing data (via BigQuery), Cloud Monitoring metrics (token counts, latency, request counts), and caller identity from Cloud Audit Logs. It never accesses the content of Gemini API requests or responses.

**Can OneLens modify our Gemini Enterprise configuration?** No. The service account has only viewer-level roles. It cannot invoke models, create endpoints, modify quotas, or change any Google Cloud resource.

**Will this impact our Gemini Enterprise performance?** No. OneLens reads asynchronous data sources (BigQuery billing export, Cloud Monitoring, Cloud Audit Logs). It does not intercept or proxy Gemini API calls. There is zero impact on API latency or throughput.

**Can I connect multiple Google Cloud projects?** Yes. Ensure the OneLens Reader service account has the required roles on each project (or grant roles at the organisation/folder level). Share each project ID with OneLens.

**How do I disconnect OneLens?** Remove the `Service Account Token Creator` grant from the OneLens principals on your service account. This immediately revokes all OneLens access. Alternatively, delete the service account entirely.

```bash
# Option 1: Revoke impersonation access
gcloud iam service-accounts remove-iam-policy-binding \
  YOUR_ONELENS_SA_EMAIL \
  --member="serviceAccount:onelens-customer-sa@astuto-prod-mum.iam.gserviceaccount.com" \
  --role="roles/iam.serviceAccountTokenCreator"

# Option 2: Delete the service account entirely
gcloud iam service-accounts delete YOUR_ONELENS_SA_EMAIL \
  --project=YOUR_PROJECT_ID
```

**Does OneLens support Gemini models accessed via AI Studio (not Gemini Enterprise)?** OneLens integrates with Gemini Enterprise (Google Cloud's enterprise API). If you use the Gemini Developer API via AI Studio, usage does not appear in Cloud Billing export or Cloud Monitoring under the `aiplatform.googleapis.com` service. Contact OneLens support for guidance on consolidating visibility across both access paths.

**What happens if Google changes Gemini Enterprise billing SKUs?** OneLens continuously updates its SKU mapping as Google Cloud releases new models and pricing tiers. If a new SKU appears, it will be categorized within 48 hours. No action is required on your side.

**Can I limit OneLens access to specific models or regions?** Yes. Use IAM Conditions to restrict the `Vertex AI Viewer` role to specific regions. For BigQuery, grant access at the dataset level rather than the project level to scope billing data access.

**Why does OneLens need `Logging Viewer`?** This role enables per-user attribution by reading caller identity (user or service account) from Gemini Enterprise Data Access audit logs. It is **not** part of the standard GCP integration — it is a Gemini-specific addition. The role grants read-only access to log entries; it cannot modify logs or any other resource.

**Why does OneLens need `Vertex AI Viewer`?** This role allows OneLens to list available models and endpoints in your project, which enables accurate model-level cost and usage attribution. It does not grant permission to invoke models or read training data. This is the same role already granted as part of the standard [GCP Cloud & Cost Integration](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-gcp/manual).

***

### Need Help?

**Google Cloud Documentation**:

* [Gemini Enterprise API Overview](https://cloud.google.com/vertex-ai/generative-ai/docs/overview)
* [Export Cloud Billing Data to BigQuery](https://cloud.google.com/billing/docs/how-to/export-data-bigquery)
* [Cloud Monitoring Metrics for Vertex AI](https://cloud.google.com/monitoring/api/metrics_vertex)
* [Creating Service Accounts](https://cloud.google.com/iam/docs/service-accounts-create)

**OneLens Support**: <support@astuto.ai>

***

*Reference sources:* [*Gemini Enterprise API Overview*](https://cloud.google.com/vertex-ai/generative-ai/docs/overview) *·* [*Cloud Billing Export to BigQuery*](https://cloud.google.com/billing/docs/how-to/export-data-bigquery) *·* [*Vertex AI IAM Roles*](https://cloud.google.com/vertex-ai/docs/general/access-control) *·* [*Cloud Monitoring Metrics*](https://cloud.google.com/monitoring/api/metrics_vertex) *·* [*Manual GCP Integration*](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-gcp/manual)


# LiteLLM Integration

Connecting LiteLLM Proxy spend and usage data to OneLens for unified AI cost management.

## TL;DR

* **What this does:** Pulls per-user, per-model token usage and cost data from your LiteLLM Proxy into OneLens — giving you unified cost visibility across every model and provider behind LiteLLM.
* **Time required:** \~10 minutes.
* **Who you need:** The LiteLLM Proxy admin (someone with access to LITELLM\_MASTER\_KEY). One engineer to validate the data.
* **What OneLens reads:** Read-only usage and cost metadata from the LiteLLM Proxy REST API (`/user/daily/activity`, `/user/info`, `/spend/logs`, `/team/list`). Your prompts, completions, and production data are never accessed.

## What You'll Get Once Connected

| Capability                           | What it does for you                                                                                                 |
| ------------------------------------ | -------------------------------------------------------------------------------------------------------------------- |
| **Unified AI Cost Explorer**         | View spend across every LLM provider behind LiteLLM (OpenAI, Anthropic, Azure, Bedrock, Groq, etc.) in one dashboard |
| **Per-User Cost Tracking**           | See exactly what each user spends, broken down by model and provider                                                 |
| **Per-Model Cost Breakdown**         | Compare spend across models to find the most cost-effective option for each use case                                 |
| **Per-Provider Spend**               | Track spend by provider (OpenAI vs. Anthropic vs. Azure, etc.) to inform contract and commitment decisions           |
| **Token Usage Analytics**            | Monitor prompt and completion token volumes per model, user, and API key                                             |
| **Multi-Provider Anomaly Detection** | Spot unexpected cost spikes across any provider routed through LiteLLM                                               |
| **Budget Tracking**                  | Set and monitor budgets at the user or team level with OneLens alerts                                                |

## Security at a Glance

| Question                                      | Answer                                                                                                                                                                         |
| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Does OneLens read our prompts or completions? | No. The endpoints returns only aggregated cost and token-count metadata. No prompt or completion content is included.                                                          |
| Does OneLens access our LiteLLM database?     | No. OneLens connects only via the LiteLLM Proxy REST API. No database credentials are shared.                                                                                  |
| Is the access read-only?                      | Yes. It cannot generate keys, modify configuration, create models, or invoke any write endpoint.                                                                               |
| What authentication is used?                  | The LITELLM\_MASTER\_KEY is used for API access. See the Connectivity Options section for two approaches to limit exposure.                                                    |
| Does OneLens see user identifiers?            | Yes. The endpoint returns `user_id` values (the internal LiteLLM user). If your users are identified by email or name, these will appear. Use opaque IDs if this is a concern. |
| How is data transmitted and stored?           | All API calls use HTTPS/TLS 1.2+. Credentials are encrypted at rest in OneLens using GCP KMS.                                                                                  |
| What is the data retention policy?            | OneLens retains ingested data for 12 months by default (configurable). On disconnection or deletion request, data is purged within 30 days with confirmation.                  |
| Can I restrict by IP?                         | Yes. If your proxy is behind a firewall, allowlist OneLens's egress IPs or use the push-based approach.                                                                        |
| Where does the data live?                     | OneLens infrastructure runs on GCP. See the OneLens Trust & Security page for region details, SOC 2 report, and DPA.                                                           |

## Cost of the Integration

OneLens does not create any infrastructure in your environment. All data is pulled via lightweight API calls to your existing LiteLLM Proxy.

| Item                    | What it is                                                                        | Typical cost |
| ----------------------- | --------------------------------------------------------------------------------- | ------------ |
| LiteLLM license         | Open-source (MIT) — free                                                          | $0           |
| Compute on your side    | OneLens calls the LiteLLM Proxy API; your proxy serves from its existing database | $0           |
| Data egress             | Daily activity responses are small JSON payloads — typically <100 KB/day          | <$0.01/month |
| Storage in your account | None — OneLens stores the data in its own infrastructure                          | $0           |
| **Estimated total**     |                                                                                   | **$0/month** |

## How It Works

LiteLLM Proxy sits between your applications and LLM providers. Every request is logged with cost, token counts, model, provider, user, and API key. LiteLLM computes cost per request using its model pricing map.

OneLens pulls from multiple read-only endpoints mentioned in [#what-onelens-will-access](#what-onelens-will-access "mention") on your proxy daily.

## Connectivity Options

Since you're running open-source LiteLLM, the scoped `get_spend_routes` virtual key (an Enterprise feature) is not available. OneLens authenticates using the LITELLM\_MASTER\_KEY. Here are two approaches to manage this securely:

### Option A: Master Key Direct (Recommended)

| Aspect               | Detail                                                                                                                                                                                    |
| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **How it works**     | Share the LITELLM\_MASTER\_KEY with OneLens. OneLens calls the apis mentioned in in [#what-onelens-will-access](#what-onelens-will-access "mention") on your proxy once per day.          |
| **Security**         | OneLens contractually commits to calling only read endpoints. An immutable audit log of every API call is maintained and available on request. OneLens never calls write/admin endpoints. |
| **Setup complexity** | Low — just provide the key and proxy URL. Done in 2 minutes.                                                                                                                              |
| **Best for**         | Most teams. Quickest path to value with contractual security controls.                                                                                                                    |

### Option B: API Gateway (For Additional Isolation)

| Aspect               | Detail                                                                                                                                                                                                                                    |
| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **How it works**     | Place nginx, Kong, or AWS ALB in front of your proxy. Allowlist only the apis mentioned in [#what-onelens-will-access](#what-onelens-will-access "mention")  for OneLens. The master key is injected server-side — OneLens never sees it. |
| **Security**         | Stronger. Master key never leaves your network. OneLens only reaches one whitelisted endpoint.                                                                                                                                            |
| **Setup complexity** | Moderate — requires API gateway config (see nginx example below).                                                                                                                                                                         |
| **Best for**         | Teams with existing API gateway infrastructure who want an extra layer of isolation.                                                                                                                                                      |

### Option B: Nginx Example

```nginx
# /etc/nginx/conf.d/litellm-onelens.conf
location ~ ^/(user/daily/activity|user/info|spend/logs|team/list) {
    allow 35.244.46.16/32;   # OneLens IP 1
    allow 34.120.137.88/32;  # OneLens IP 2
    allow 35.201.115.143/32; # OneLens IP 3
    deny all;
    limit_except GET { deny all; }
    proxy_pass http://localhost:4000;
    proxy_set_header Authorization "Bearer YOUR_LITELLM_MASTER_KEY_HERE";
}
```

With this setup, you share the nginx endpoint URL with OneLens (not the master key). OneLens authenticates to nginx via IP allowlist, and nginx injects the master key when forwarding to LiteLLM.

> ***Our recommendation:** Option A is the fastest path — provide the key, connect, and you're done. If your security team requires that the master key not leave your network, use Option B with the nginx config below.*

## What OneLens Will Access

| Endpoint                   | Purpose                                                                     | OSS / Enterprise    |
| -------------------------- | --------------------------------------------------------------------------- | ------------------- |
| *GET /user/daily/activity* | Per-user daily breakdown by model, provider, and API key (primary endpoint) | OSS                 |
| *GET /user/info*           | Total spend per user, their keys, and team memberships                      | OSS                 |
| *GET /team/list*           | List all teams with spend and budget data                                   | OSS                 |
| *GET /spend/logs*          | Individual transaction logs with model, tokens, cost per request            | OSS                 |
| *GET /global/spend/report* | Aggregated spend reports grouped by team, customer, or user                 | **Enterprise only** |

> **Note:** OneLens works fully with open-source LiteLLM using the OSS endpoints above. The `/global/spend/report` endpoint is only available on LiteLLM Enterprise — if your deployment uses OSS LiteLLM, OneLens will derive equivalent reports from `/user/daily/activity` and `/spend/logs`.

## What OneLens Will NOT Access

* `/chat/completions`, `/completions`, `/embeddings` — OneLens cannot invoke any model
* `/key/generate`, `/key/update`, `/key/delete` — OneLens cannot create, modify, or delete API keys
* `/model/new`, `/model/update`, `/model/delete` — OneLens cannot modify model configuration
* `/config/*` — OneLens cannot read or modify proxy configuration
* The LiteLLM PostgreSQL database — OneLens connects only via the REST API
* Any prompt or completion content — the endpoints above return only aggregated metadata

## Prerequisites

* LiteLLM Proxy running with a connected PostgreSQL database and spend tracking enabled.
* `LITELLM_MASTER_KEY` — needed for API access (or the nginx gateway URL if using Option A).
* Network access: OneLens must be able to reach your proxy (or gateway) over HTTPS.

**What OneLens will access:**

* `GET /user/daily/activity` — daily aggregated usage per user (cost, tokens, request count, broken down by model, provider, API key)

**What OneLens will NOT access:**

* Prompt or completion content
* The LiteLLM database directly
* Any write, mutate, or admin endpoint (`/key/generate`, `/model/new`, `/global/spend/reset`, etc.)
* Your LLM provider credentials

### Validate and Connect

{% stepper %}
{% step %}

#### Step 1: Validate the Endpoint

Run this from your terminal to confirm the endpoint works and returns useful data:

```bash
curl -X GET \
  'https://your-litellm-proxy:4000/user/daily/activity' \
  -G -d 'start_date=2025-01-01' \
     -d 'end_date=2025-01-07' \
  -H 'Authorization: Bearer YOUR_LITELLM_MASTER_KEY_HERE'
```

Expected response structure:

```json
{
  "results": [
    {
      "date": "2025-01-07",
      "metrics": {
        "spend": 0.0177,
        "prompt_tokens": 111,
        "completion_tokens": 1711,
        "total_tokens": 1822,
        "api_requests": 11
      },
      "breakdown": {
        "models": { "gpt-4o-mini": { "spend": 0.001, ... } },
        "providers": { "openai": { ... }, "anthropic": { ... } },
        "api_keys": { "3126b6ea...": { ... } }
      }
    }
  ],
  "metadata": {
    "total_spend": 0.727,
    "total_prompt_tokens": 280990,
    "total_completion_tokens": 376674,
    "total_api_requests": 14
  }
}
```

> **Tip:** If the response is empty, check that your proxy has recent LLM traffic and spend tracking is enabled (requires a connected PostgreSQL database). If this returns 401 or 403, verify your master key is correct. If it returns an empty results array, check that your proxy has recent LLM traffic with spend tracking enabled.
> {% endstep %}

{% step %}

#### Step 2: Validate Data Richness

Inspect the response from Step 1 for the following:

| Field              | What to check                                                                                                                                                |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Per-user data      | The response should show activity for individual users. If all activity is under one user, verify that API keys are being generated with `user_id` set.      |
| Model breakdown    | `breakdown.models` should show your active models (e.g., `gpt-4o`, `claude-sonnet-4-20250514`). If missing, check your `config.yaml` model list.             |
| Provider breakdown | `breakdown.providers` should show multiple providers if you route to more than one.                                                                          |
| Non-zero spend     | `metrics.spend` should be >0. If $0.00, the model may not be in LiteLLM's pricing map — add custom pricing or enable `sync_model_pricing_from_github: true`. |
| Token counts       | `prompt_tokens` and `completion_tokens` should be non-zero. If zero, check your LiteLLM version.                                                             |

If spend is $0 for known models: LiteLLM uses a community pricing map. Ensure it's current by adding `sync_model_pricing_from_github: true` under `litellm_settings` in your `config.yaml`. For negotiated rates, set `input_cost_per_token` and `output_cost_per_token` per model. See Custom LLM Pricing.
{% endstep %}

{% step %}

#### Step 3: Connect to OneLens

Provide the following to OneLens:

| Field                          | Value                                                          | Example                                   |
| ------------------------------ | -------------------------------------------------------------- | ----------------------------------------- |
| LiteLLM endpoint               | Your proxy URL (or nginx gateway URL if using Option A)        | `https://litellm-gateway.yourcompany.com` |
| Authentication                 | Master key (Option B/C) or none if nginx injects it (Option A) | `sk-your-master-key`                      |
| Polling interval               | How often OneLens should pull data (default: daily)            | `daily`                                   |
| Historical backfill start date | Earliest date to pull data from                                | `2025-01-01`                              |

OneLens will begin ingesting data on the next scheduled poll.

> **Secure key sharing:** Never share your LITELLM\_MASTER\_KEY over email or chat. Use a validated secure sharing tool like [Password.link](https://password.link/en) to transmit credentials safely.
> {% endstep %}
> {% endstepper %}

## Data Refresh Schedule

OneLens polls your LiteLLM Proxy once daily by default.

1. LiteLLM records spend in real-time as each LLM request completes — the `/user/daily/activity` endpoint reflects data aggregated by day.
2. Daily polling is sufficient because this endpoint provides daily aggregates — polling more frequently doesn't yield fresher data.
3. Current-day figures may shift as in-progress requests complete and provider-specific adjustments are applied.

## Data Privacy & Security

* **API-only** — no database credentials, no SSH, no agent installed in your environment.
* **No prompt/completion content** — the endpoint returns only aggregated cost and token metadata.
* **TLS in transit** — all API calls use HTTPS/TLS 1.2+.
* **Encrypted at rest** — credentials and ingested data are encrypted at rest using GCP KMS in OneLens.
* **Network policy support** — restrict access via API gateway (Option B) or allowlist OneLens egress IPs.
* **Data retention** — 12-month default, configurable. Deletion within 30 days on request with confirmation.
* **User ID exposure** — `user_id` values from LiteLLM are ingested when set on API keys. API keys without a `user_id` are still tracked at the key level but cannot be attributed to a specific user. To enable per-user attribution, ensure `user_id` is set when generating keys. Use opaque IDs if PII is a concern.

## Troubleshooting

| Symptom                             | Cause                                                                    | Fix                                                                                                                   |
| ----------------------------------- | ------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------- |
| 401 Unauthorized                    | Invalid master key                                                       | Verify `LITELLM_MASTER_KEY` value. Check `Authorization: Bearer` header format.                                       |
| Empty results array                 | No LLM traffic in the date range, or spend tracking not enabled          | Widen the date range. Verify your proxy has a connected PostgreSQL database.                                          |
| All activity under one user         | API keys not assigned to individual users                                | Generate keys with `user_id` parameter: `/key/generate -d '{"user_id": "jane"}'`.                                     |
| Spend is $0 for known models        | Model not in LiteLLM's pricing map                                       | > **If spend is $0 for known models:** Enable `sync_model_pricing_from_github: true` or set custom pricing per model. |
| Missing model in breakdown          | Model not in your `config.yaml` model list                               | Add the model to your LiteLLM `config.yaml` and restart the proxy.                                                    |
| Cost doesn't match provider invoice | LiteLLM uses community pricing; negotiated/committed rates not reflected | Configure actual rates via Custom LLM Pricing.                                                                        |
| No data in OneLens after 24 hours   | Proxy unreachable, key wrong, or firewall blocking                       | Run Step 1 manually. Check proxy access logs.                                                                         |
| Nginx gateway returns 502           | LiteLLM proxy is down or unreachable from nginx                          | Check proxy health: `curl http://localhost:4000/health`.                                                              |

## Frequently Asked Questions

<details>

<summary>Can OneLens see our prompts or completions?</summary>

No. The `/user/daily/activity` endpoint returns only aggregated daily metrics — spend, token counts, request counts — broken down by model, provider, and API key. No request or response content is included.

</details>

<details>

<summary>Is the master key safe to share?</summary>

> **Security note:** The master key has full admin access to your LiteLLM Proxy. For maximum isolation, use Option B (API gateway) so the key never leaves your network.

The master key has full admin access to your LiteLLM Proxy. OneLens contractually commits to read-only usage and maintains audit logs. If your security team requires the master key not leave your network, use Option B (API gateway) — the master key stays inside your network and OneLens only reaches a single whitelisted endpoint.

</details>

<details>

<summary>Will this impact our proxy's performance?</summary>

No. OneLens makes one GET request per day. The `/user/daily/activity` endpoint serves pre-aggregated data — it's a lightweight query.

</details>

<details>

<summary>Can I connect multiple LiteLLM Proxy instances?</summary>

Yes. Add each as a separate connection in OneLens with a source label (e.g., `prod`, `staging`).

</details>

<details>

<summary>How do I disconnect OneLens?</summary>

Rotate the master key (Option A) or delete the nginx gateway config (Option B). OneLens stops receiving data immediately. Historical data remains until you request deletion.

</details>

<details>

<summary>What if cost doesn't match my provider invoices?</summary>

LiteLLM computes cost using its community pricing map. If you have negotiated discounts or committed-use pricing (e.g., Bedrock Provisioned Throughput), configure your actual rates in LiteLLM via Custom LLM Pricing. Committed-capacity pricing is fundamentally per-hour, not per-token — OneLens shows the on-demand equivalent, which is useful for optimization but won't match the committed invoice.

</details>

<details>

<summary>Can we upgrade to scoped keys later?</summary>

Yes. If you move to LiteLLM Enterprise, you can generate a key with `permissions: {"get_spend_routes": true}` — this key can only read spend data and nothing else. The doc can be updated to use that approach at that point.

</details>

***

## Need Help?

**LiteLLM official docs:**

* [Spend Tracking — how LiteLLM tracks cost by key, user, team](https://docs.litellm.ai/docs/proxy/cost_tracking)
* [Virtual Keys & Authentication — key generation, permissions, database setup](https://docs.litellm.ai/docs/proxy/virtual_keys)
* [Custom LLM Pricing — configuring negotiated rates](https://docs.litellm.ai/docs/proxy/custom_pricing)
* [Daily Spend Breakdown API — Swagger reference](https://litellm-api.up.railway.app/#/Budget%20%26%20Spend%20Tracking/get_user_daily_activity_user_daily_act)

**OneLens support:** <support@astuto.ai>


# OpenAI Integration

Customer Onboarding Guide — OpenAI Organization Costs API

## TL;DR

* **What this does:** Connects OneLens to your OpenAI organization to pull per-user, per-model cost and usage data — giving you unified cost visibility, anomaly detection, and optimization insights across all OpenAI models (GPT-4o, GPT-4, GPT-3.5, o1, DALL·E, Whisper, Embeddings, etc.).
* **Time required:** \~5 minutes
* **Who you need:** An OpenAI organization **Owner** (to create an Admin API key).
* **What OneLens reads:** Read-only cost metadata from the OpenAI Organization Costs API (`/v1/organization/costs`), grouped by user. Your prompts, completions, and production data are never accessed.

## What You'll Get Once Connected

| Capability                | What it does for you                                                                                             |
| ------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| Per-User Cost Attribution | See exactly what each user in your OpenAI organization spends, broken down by model.                             |
| Per-Model Cost Breakdown  | Compare spend across GPT-4o, GPT-4, o1, GPT-3.5, DALL·E, Whisper, Embeddings, and other models.                  |
| Usage Type Breakdown      | Separate costs by usage type — input tokens, output tokens, cached tokens, image generation, audio minutes, etc. |
| Cost Anomaly Detection    | Get alerted when OpenAI spend deviates from historical patterns — catch unexpected usage spikes early.           |
| Budget Tracking           | Set and monitor budgets at the organization or user level with OneLens alerts.                                   |
| Multi-Provider Visibility | View OpenAI costs alongside Anthropic, AWS Bedrock, LiteLLM, and other providers in a single dashboard.          |

## Security at a Glance

| Question                                          | Answer                                                                                                                                                           |
| ------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Does OneLens read our prompts or completions?     | No. The `/v1/organization/costs` endpoint returns only aggregated cost amounts, model identifiers, and usage types. No prompt or completion content is included. |
| Does OneLens access our OpenAI projects or users? | No. OneLens does not call any user management, project management, or audit log endpoints.                                                                       |
| Is the access read-only?                          | Yes. OneLens only calls `GET /v1/organization/costs`. It cannot invoke models, manage users, create keys, or modify any organization resources.                  |
| What authentication is used?                      | An OpenAI Admin API key, created by an organization Owner at platform.openai.com. The key is passed as a Bearer token in the Authorization header.               |
| Does OneLens see user identifiers?                | Yes — the API returns `user_id` values from the `group_by=user_id` parameter. These are internal OpenAI user IDs used for per-user cost attribution.             |
| How is data transmitted and stored?               | All API calls use HTTPS/TLS 1.2+. Credentials are encrypted at rest using GCP KMS in OneLens infrastructure.                                                     |

## Cost of the Integration

OneLens reads cost metadata via the OpenAI Organization Costs API. There is no additional charge from OpenAI for API cost queries.

| Item                    | What it is                                                | Typical cost                     |
| ----------------------- | --------------------------------------------------------- | -------------------------------- |
| API calls               | Daily polling of `/v1/organization/costs` with pagination | $0 (no per-request charge)       |
| Data egress             | JSON cost metadata responses                              | $0                               |
| Compute in your account | None — OneLens calls OpenAI's hosted API                  | $0                               |
| **Estimated total**     |                                                           | **$0/month on your OpenAI bill** |

## How It Works

The OpenAI Organization Costs API provides programmatic access to cost data across your entire OpenAI organization. OneLens calls a single endpoint:

**GET /v1/organization/costs** — returns cost data grouped by user, with each record containing the model name, usage type (e.g., input tokens, output tokens, cached tokens, image generation), cost amount, and currency. OneLens queries day-by-day with `group_by=user_id` to build per-user, per-model cost attribution.

OneLens polls the Costs API daily. Each poll iterates over the date range day-by-day, handling pagination automatically (up to 180 records per page). All data is normalized into a unified cost model alongside your other AI providers.

> For financial reconciliation, the Costs endpoint is the recommended source — it reconciles back to your OpenAI billing invoice, unlike the Usage API which provides more granular but potentially less reconciled data.

## Prerequisites

* An OpenAI organization with API usage
* A user with the **Owner** role in the organization
* Access to [platform.openai.com](https://platform.openai.com/)

## What OneLens Will Access

| Endpoint                   | Purpose                                                 |
| -------------------------- | ------------------------------------------------------- |
| GET /v1/organization/costs | Per-user, per-model cost data with usage type breakdown |

**Parameters used:**

| Parameter   | Value          | Purpose                   |
| ----------- | -------------- | ------------------------- |
| start\_time | Unix timestamp | Start of the query window |
| end\_time   | Unix timestamp | End of the query window   |
| group\_by   | user\_id       | Per-user cost attribution |
| limit       | 180            | Pagination page size      |
| page        | cursor token   | Pagination                |

## What OneLens Will NOT Access

* `/v1/chat/completions`, `/v1/responses`, `/v1/embeddings` — OneLens cannot invoke any model
* `/v1/organization/users`, `/v1/organization/invites` — OneLens cannot manage users or send invitations
* `/v1/organization/projects` — OneLens cannot create or modify projects
* `/v1/organization/admin_api_keys` — OneLens cannot create or manage API keys
* `/v1/organization/audit_logs` — OneLens does not access audit logs
* `/v1/fine_tuning`, `/v1/files`, `/v1/images` — OneLens cannot access fine-tuning, file uploads, or image generation endpoints
* Any prompt, completion, or request/response content

> **Note:** Admin API keys cannot be used for non-administration endpoints. The key OneLens uses literally cannot invoke models even if misconfigured.

{% stepper %}
{% step %}

## Create an Admin API Key

1. Sign in to [platform.openai.com](https://platform.openai.com/) as an organization **Owner**
2. Navigate to **Settings → Organization → Admin API keys** ([direct link](https://platform.openai.com/settings/organization/admin-keys))
3. Click **Create admin key**
4. Name it **OneLens Integration**
5. Copy the key — store it securely

> **Secure key sharing:** Never share API keys over email or chat. Use a validated secure sharing tool like [Password.link](https://password.link/en) to transmit credentials safely.

> **Important:** Only organization Owners can create Admin API keys. Admin keys can only access administration endpoints — they cannot be used to call models.
> {% endstep %}

{% step %}

## Find Your Organization ID

1. In [platform.openai.com](https://platform.openai.com/), go to **Settings → Organization → General**
2. Copy your **Organization ID** (starts with `org-`)
   {% endstep %}

{% step %}

## Connect to OneLens

Provide the following in the OneLens integration setup:

| Field            | Value                              | Example              |
| ---------------- | ---------------------------------- | -------------------- |
| Integration Name | A display name for this connection | Acme Corp OpenAI     |
| Organization ID  | Your OpenAI organization ID        | org-xxxxxxxxxxxx     |
| API Key          | Your Admin API key                 | sk-admin-xxxx...xxxx |

OneLens will begin ingesting data on the next scheduled poll.
{% endstep %}

{% step %}

## Verify the Connection

After connecting, verify by checking the OneLens dashboard for:

1. OpenAI models appearing in the cost explorer
2. Per-user cost data populating
3. Historical cost data backfilling (up to the available date range)

If data doesn't appear within 24 hours, run this from your terminal to confirm the key works independently:

```bash
curl -X GET "https://api.openai.com/v1/organization/costs?start_time=1717200000&end_time=1717286400&group_by=user_id&limit=10" \
  -H "Authorization: Bearer YOUR_OPENAI_ADMIN_KEY_HERE"
```

{% endstep %}
{% endstepper %}

## Data Refresh Schedule

OneLens polls the OpenAI Costs API once daily, iterating day-by-day over the configured date range.

1. The Costs endpoint provides data that reconciles to your billing invoice.
2. Current-day figures may shift as in-progress requests complete.
3. Historical data is backfilled automatically on initial connection.

## Data Privacy & Security

* **Read-only access** — OneLens only calls `GET /v1/organization/costs`; no write or model invocation capability.
* **Admin key isolation** — Admin API keys cannot invoke models by design. The key OneLens uses is structurally limited to administration endpoints.
* **No prompt/completion content** — the Costs endpoint returns only aggregated cost amounts, model names, and usage types.
* **TLS in transit** — all API calls use HTTPS/TLS 1.2+.
* **Encrypted at rest** — credentials and ingested data are encrypted at rest using GCP KMS in OneLens.
* **Data retention** — 12-month default, configurable. Deletion within 30 days on request with confirmation.

## Frequently Asked Questions

<details>

<summary>Can OneLens see our prompts or completions?</summary>

No. The Costs endpoint returns only aggregated cost amounts, model names, and usage types (e.g., "input tokens", "output tokens"). No request or response content is included.

</details>

<details>

<summary>Can OneLens invoke models or run up our OpenAI bill?</summary>

No. Admin API keys cannot be used for model invocation by design. They are structurally limited to administration endpoints.

</details>

<details>

<summary>Will this impact our API latency or rate limits?</summary>

No. OneLens polls once daily using the Costs API, which is separate from the model inference path. It does not affect your production API calls.

</details>

<details>

<summary>Can I connect multiple OpenAI organizations?</summary>

Yes. Add each organization separately in OneLens with its own Admin API key and Organization ID.

</details>

<details>

<summary>How do I disconnect OneLens?</summary>

Delete the Admin API key at platform.openai.com → Settings → Organization → Admin API keys. All access is immediately revoked.

</details>

<details>

<summary>How do I rotate the API key?</summary>

Create a new Admin API key, update it in OneLens, then delete the old key. OneLens uses the new key on the next daily poll — no downtime.

</details>

<details>

<summary>What about OpenAI usage via Azure OpenAI Service?</summary>

Azure OpenAI has its own billing managed by Microsoft Azure. This integration covers direct OpenAI API usage only (platform.openai.com). For Azure OpenAI costs, use the Azure Cost Management integration.

</details>

<details>

<summary>Does OneLens see user email addresses?</summary>

No. The Costs API returns internal OpenAI `user_id` values, not email addresses. OneLens uses these for per-user cost attribution.

</details>

## Need Help?

**OpenAI Documentation:**

* [Admin APIs Guide](https://developers.openai.com/api/docs/guides/admin-apis)
* [Administration API Reference](https://developers.openai.com/api/reference/administration/overview)
* [Costs API Reference](https://platform.openai.com/docs/api-reference/usage/costs_object)
* [Assign API Key Permissions](https://help.openai.com/en/articles/8867743-assign-api-key-permissions)
* [OpenAI Pricing](https://platform.openai.com/docs/pricing)

**OneLens Support:** <support@astuto.ai>


# Cursor Integration

A Cursor Enterprise plan is required. The Admin API is only available for Enterprise accounts.

You need to be a Team Administrator to generate a team Admin API key in the Cursor console. A team key is required, not a user key. It’s best practice to use a dedicated key for OneLens and rotate it according to your security policy.

You must have a OneLens Admin role to add or remove this integration. See the Role-Based Access Control documentation for details.

### Create the Connection

1. Navigate to your Cursor dashboard.
2. In the left menu, click **API Keys**.
3. Select the **Team** tab.
4. Click **New API Key** and select the **Admin** scope.
5. Enter a key name, then click **Save**.

<figure><img src="/files/xMoz41snewt4JAhn4moX" alt=""><figcaption></figcaption></figure>

6. Copy the generated team Admin API key that's displayed.
7. From the left navigation in **OneLens**, click **Integrations**.
8. In the left navigation, select **Integrations > Cursor**.
9. The Cursor integrations page is displayed. Ensure you are on the **Connect** tab.
10. At the bottom of the page, click **Add API Key** and paste your previously generated Admin API key.
11. For **Account Name**, enter a name that will be used to differentiate this Cursor account from others you may add. This name will be displayed in Cost Report filters.
12. Click **Connect Account**.

After clicking **Connect Account**, you will see the status of your integration change to **Importing** within the **OneLens** console. This status indicates that **OneLens** is actively importing your Cursor cost data. The integration will fetch historical data up to your account's configured retention period. See the Integration Status documentation for details on integration statuses.

As soon as costs are processed, they will be available in your **All Resources Cost Report**. If you decide to remove your Cursor integration from **OneLens**, all costs associated with your Cursor Admin API key will be removed from the **OneLens** console.


# Cloud & Cost Sources

OneLens connects directly to your cloud accounts to provide real-time visibility into costs, usage, and optimization opportunities. OneLens supports the following cloud providers:

### Amazon Web Services (AWS)

Start by [**connecting your AWS account**](/integrations/cloud-and-cost-sources/connect-to-aws). This integration allows OneLens to securely ingest resource, usage metrics via AWS SDK calls and Cost and Usage Reports (CUR) from your AWS S3 bucket. Cost data is showcased through our unified Cost Atlas and other in-depth features.

### Azure (AZ)

Start by [**connecting your Azure**](/integrations/cloud-and-cost-sources/connecting-to-azure) Subscriptions, Management Groups or Resource Groups to OneLens. We use an App Registration with access to Microsoft's Cost Data Exports to provide insights into your spend. Cost data is showcased through our unified Cost Atlas.

### Google Cloud Platform (GCP)

**Start by** [**connecting your GCP**](/integrations/cloud-and-cost-sources/connecting-to-gcp) Projects, Folders or Organizations to OneLens. We use a Service Account with access to Google's BigQuery Detailed Usage exports to provide insights into your spend. Cost data is showcased through our unified Cost Atlas.

### Oracle Cloud Infrastructure (OCI)

**Start by** [**connecting your OCI**](/integrations/cloud-and-cost-sources/connecting-to-oci) Tenancies, Compartments or Resources to OneLens. We use an external user with access to the Cost Exports provided by Oracle to provide insights into your spend. Cost data is showcased through our unified Cost Atlas.

#### Databricks

Start by connecting your Databricks account to OneLens. This integration enables OneLens to securely ingest billing and usage data from Databricks system tables for cost analysis, anomaly detection, and optimization insights.

We use a **Service Principal with access to Unity Catalog system tables and a SQL Warehouse** to query usage and billing metadata. Data is retrieved from system tables such as `system.billing`, `system.compute`, and `system.access`.

Cost and usage data is showcased through our unified Cost Atlas and other in-depth optimization features.

{% hint style="info" %}
Once connected:

* Data is processed daily
* Insights are generated automatically
* No manual actions are required after setup
  {% endhint %}


# Connect to AWS

To begin using OneLens, you need to connect your AWS account by deploying **two** [**CloudFormation templates (CFTs)**](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html). These templates create the IAM roles required for OneLens to access your cost and resource data.

* The **Resource CFT** sets up the IAM role needed to access resource configuration and relevant CloudWatch metrics.
* The **CUR CFT** creates [Cost and Usage Report (CUR)](https://docs.aws.amazon.com/cur/latest/userguide/what-is-cur.html) along with its [S3 bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Welcome.html) and sets up the IAM role needed to access the CUR files stored in that S3 bucket.

{% hint style="warning" %}

#### Important

You **must deploy both CloudFormation templates (CFTs)** to successfully connect OneLens to your AWS environment.

You can review the contents of each CloudFormation template from here.

* [For Resource CFT](https://astuto-products.s3.ap-south-1.amazonaws.com/onelens/aws/cft/resource-role-v1-we.yaml)
* [For CUR CFT](https://astuto-products.s3.ap-south-1.amazonaws.com/onelens/aws/cft/cur-role-v1-we.yml)
  {% endhint %}

{% hint style="info" %}

### Access Scope and Permissions

OneLens connects to your AWS account using IAM roles created through two CloudFormation templates: one for accessing your Cost and Usage Reports (CUR) and another for explicit read-only access to your resources. These roles are deployed either via Stack or StackSet, depending on your setup.

The IAM roles created by these templates are limited in scope and grant only the permissions required for OneLens to function. No modifications are made to your infrastructure. Access is **read-only** and fully **reversible** — you may delete the roles at any time to revoke access. OneLens does not collect or alter any data outside the defined access permissions.
{% endhint %}

## OneLens in Your AWS Environment

<figure><img src="/files/wx9Ze5Tet95hYCxChyQR" alt=""><figcaption><p>OneLens Architecture Diagram</p></figcaption></figure>

#### **Following components are created in your AWS Environment:**

* **CloudFormation Templates (CFTs):**
  * One for Resource Role
  * One for CUR Role
* **StackSet / Stack Deployment:**
  * Executed from the management or individual account
  * Creates IAM roles in target accounts
* **IAM Roles:**
  * Provide read-only access to resources and metrics
  * Grant permission to read CUR files from your S3 bucket

#### **OneLens AWS Environment have 2 major components:**

* **Data Extraction & Transformation**:
  * Data is extracted assuming the IAM role created by you over TLS 1.3.
  * Process the raw data for detailed analysis
  * This process repeats daily or based on the agreed schedule with the you.
* **Data Storage**:
  * Ensures tenant-level separation (trial accounts may vary slightly).
  * Customers raw data is stored in GCS buckets which are KMS encrypted
  * Processed data is stored in PostgresSQL DB, ClickHouse and GCS; all secured by standard organizational policies meeting ISO and SOC 2 compliance

## AWS Environment Types

You likely operate your AWS accounts in one of two ways. The steps that you need to follow depend on which environment you’re using.

### Centralized Accounts (Master-Child Setup)

If you manage multiple AWS accounts from a master or admin account (using AWS Organizations), here’s what you’ll need to deploy:     &#x20;

* [CUR Template using Stack](#deploy-cur-role-using-stack) – Run this in the master/admin account. Ensure that the Stack is created in **us-east-1** region.&#x20;
* [Resource Template using Stack](#deploy-resource-role-using-stack) – Run this in the master/admin account.
* [Resource Template using StackSet](#deploy-resource-role-using-stackset) – Run this from the master/admin account to all child accounts for resource **read-only** access.

{% hint style="success" %}

## **NOTE**&#x20;

You do not need to deploy the CUR role in any child accounts. Since the master/payer account contains the **consolidated billing CUR**, OneLens fetches all required cost data directly from that account.
{% endhint %}

### Decentralized Accounts (Individually Managed Accounts)

If an AWS account needs to be configured independently, you’ll deploy:

* [CUR Template using Stack](#deploy-cur-role-using-stack) – In each account CUR needs to be configured individually. Ensure that the Stack is created in **us-east-1** region.&#x20;
* [Resource Template using Stack](#deploy-resource-role-using-stack) – In each account Resource role needs to be configured individually.

## **Onboarding Deployment Tasks**

### 1. Deploy CUR Role Using Stack

The step-by-step guide will help you deploy the Cost and Usage Report (CUR) role in AWS using a CloudFormation Stack.

{% hint style="success" %}

### Prerequisites

Before proceeding, ensure that the AWS region you select is **us-east-1**. The AWS billing service, which processes CUR, is internally hosted in this region by AWS, so the deployment of this role needs to be in the same region.
{% endhint %}

{% stepper %}
{% step %}

#### Create a CloudFormation Stack

In the AWS Management Console, go to the **CloudFormation** service.

Choose **Stack** from the sidebar.

Click on **Create Stack**.

Choose the option **With new Resources (standard)** when prompted.

<img src="/files/yBXYFsYdfEMx1JDZHUfw" alt="" width="563">

Go with **Choose an Existing Template**.

For the template source, select **Amazon S3 URL**.

In the **Amazon S3 URL** field, enter the following URL:

```
https://astuto-products.s3.ap-south-1.amazonaws.com/onelens/aws/cft/cur-role-v1-we.yml
```

<img src="/files/SrsqIBxhJFXoySLsexvT" alt="" width="563">

Click **Next** to proceed.
{% endstep %}

{% step %}

#### Specify Stack Details

Fill in the following parameters:

* **Stack Name**:
  * Enter a name for your stack. For example, `OneLens-CUR-Stack`, or use your naming convention.
* **S3 Bucket Name**:
  * Enter the name of your CUR S3 bucket, which stores the billing reports.
* **Role Name**:

  * Set your own role name following the format:

  `OneLens-<10-char-alphanumeric-unique-id-2>`

  where **<10-char-alphanumeric-unique-id-2>** is a 10-digit identifier, or

  * Contact the OneLens support team to provide the role name for your account&#x20;

  <div data-full-width="true"><figure><img src="/files/oAmJaDJkCDOxvaZw34j4" alt=""><figcaption></figcaption></figure></div>

Once all details are filled in, click **Next** to proceed.
{% endstep %}

{% step %}

#### Configure Stack Options

**Set Tags**

Click on **Add New Tag**.

Add a key-value pair:

* **Key**: `onelens:provider`
* **Value**: `onelens`

<img src="/files/vHE8q30BSmjOI8tVpQMS" alt="" width="563">

You can add any additional tags that you may use.

All other options should be left as the default settings unless you require specific changes.

{% hint style="warning" %}
A warning will appear indicating that the template will create a **ManagedPolicy**. This is normal since the template is designed to create a role with Managed Policies to grant access to OneLens.
{% endhint %}

<figure><img src="/files/2nwzkteK5iz8LSmTLESk" alt="" width="563"><figcaption></figcaption></figure>

Tick the checkbox to acknowledge the warning.

Once you're finished, click **Next** to proceed.
{% endstep %}

{% step %}

#### Review and Create the Stack

**Review** the stack configuration.

<img src="/files/R6nJuclWK4bcJmGbIbkE" alt="" width="563">

Click **Submit** to create the stack.
{% endstep %}

{% step %}

#### Stack Output

After the successful execution, the CUR Role ARN and the S3 bucket will be generated. You can view the output as follows:

<figure><img src="/files/No6FNCEpaAkLqLbhRAmL" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

### 2. Deploy Resource Role using Stack

Follow these steps to deploy the resource role for your OneLens integration. This guide is applicable for individual, external, or any other type of AWS account.

{% stepper %}
{% step %}

#### Create a CloudFormation Stack

In the AWS Management Console, go to the **CloudFormation** service.

Click on **Create Stack**.

Choose the option **With new Resources (standard)** when prompted.

<img src="/files/pWsgJk0chrS1IQ2WTY8Q" alt="" width="563">

Go with **Choose an Existing Template**.

For the template source, select **Amazon S3 URL**.

In the **Amazon S3 URL** field, enter the following URL:

```
https://astuto-products.s3.ap-south-1.amazonaws.com/onelens/aws/cft/resource-role-v1-we.yaml
```

Click **Next** to proceed.
{% endstep %}

{% step %}

#### Specify Stack Details

In this step, you'll provide the necessary details for your stack. Fill in the following parameters:

* **Stack Name**:
  * Enter a name for your stack. For example, `OneLens-Resource-Stack`, or use your naming convention.
* **Role Name**:

  * Set your own role name following the format:

    `OneLens-<10-char-alphanumeric-unique-id>`

    where **<10-char-alphanumeric-unique-id>** is a 10-digit identifier, or
  * Contact the OneLens support team to provide the role name for your account

  <figure><img src="/files/fpkkD3lBZSdTkbAONgHC" alt=""><figcaption></figcaption></figure>

Once all details are filled in, click **Next** to proceed.
{% endstep %}

{% step %}

#### Configure Stack Options

**Set Tags**

Click on **Add New Tag**.

Add a key-value pair:

* **Key**: `onelens: provider`
* **Value**: `onelens`

<img src="/files/67yF6i1wvvl4pcfJ2smg" alt="" width="563">

You can add any additional tags that you may use.

All other options should be left as the default settings unless you require specific changes.

{% hint style="warning" %}
A warning will appear indicating that the template will create a **ManagedPolicy**. This is normal since the template is designed to create a role with Managed Policies to grant access to OneLens.
{% endhint %}

<figure><img src="/files/5LZ9krNTsGuMJ8lOuYhf" alt="" width="563"><figcaption></figcaption></figure>

Tick the checkbox to acknowledge the warning.

Once you're finished, click **Next** to proceed.
{% endstep %}

{% step %}

#### Review and Create the Stack

**Review** the stack configuration.

<img src="/files/x6GdPAs83qNoJNSdqyMa" alt="" width="563">

Click **Submit** to create the stack.
{% endstep %}

{% step %}

#### Stack Output

After the successful execution, the Resource Role ARN will be generated. You can view the output as follows:

<figure><img src="/files/gR7p6uYFUhcW85NOHIj8" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

### 3. Deploy Resource Role using StackSet (in Master account only)

Here is how you can deploy CloudFormation Stacks across multiple AWS child accounts from a central location. The StackSet deployment process avoids the need to log into each account individually.

{% hint style="success" %}

### Prerequisites

* **Administrator/Management Account Access**: You must have access to the Administrator or Management account.
  {% endhint %}

{% stepper %}
{% step %}

#### Log in to the Administrator/Management Account

Log in to the appropriate AWS account based on your organization’s structure. This could be your Administrator or Management account, depending on your setup.
{% endstep %}

{% step %}

#### Create a StackSet

Go to the AWS Management Console and search for **CloudFormation**.

In the CloudFormation console, select **StackSets** from the left-hand menu.

Click on **Create StackSet**.

<img src="/files/OpdVrjljVnwwscGVAxy0" alt="" width="563">

Select **"Template is ready"** as the template type.

For the **template source**, choose **Amazon S3 URL**.

Enter the following S3 URL:

```
https://astuto-products.s3.ap-south-1.amazonaws.com/onelens/aws/cft/resource-role-v1-we.yaml
```

<img src="/files/uDELuCieg3VKcSsW7JRS" alt="" width="563">

Click **Next**.
{% endstep %}

{% step %}

#### Specify Stack Details

Enter a **stack name** following your organization’s naming conventions. Our recommendation is OneLens-Stack or something descriptive.

In the **RoleName** field, you can either:

* Set your own role name following the format:

`OneLens-<10-char-alphanumeric-unique-id>`

where **<10-char-alphanumeric-unique-id>** is a 10-digit identifier, or

* Contact the OneLens support team to provide the role name for your account

<figure><img src="/files/U21YF7p9ZB4EU68OH6eq" alt=""><figcaption></figcaption></figure>

Once these details are filled in, click **Next**.
{% endstep %}

{% step %}

#### Configure StackSet Options

Click on **Add New Tag** to add tags that help identify this stack. Add the following key-value pair:

* **Key:** `onelens: provider`
* **Value:** `onelens`

<img src="/files/caCq2pFWweRuBKmewLNw" alt="" width="563">

You can add any additional tags that your organization may use. Everything else should be left as default.

{% hint style="warning" %}
A warning will appear indicating that the template will create a **ManagedPolicy**. This is normal since the template is designed to create a role with Managed Policies to grant access to OneLens.
{% endhint %}

<figure><img src="/files/A2QoyaoDDyurL8bFjdRW" alt="" width="563"><figcaption></figcaption></figure>

Tick the checkbox to acknowledge the warning.

Once you've reviewed this step, click **Next**.
{% endstep %}

{% step %}

#### Set Deployment Options

**Specify Accounts or Organizational Units**

In the **Accounts** section, specify which AWS accounts or organizational units should be targeted for this stack deployment.

**Choose Regions**

Select the AWS region where you would like to deploy the stack. You can deploy to any region as internally IAM is a global service.

<figure><img src="/files/pbuk2CNWPMOjm0KJqRcz" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="warning" %}
Most settings can be left at their default values unless you require custom configurations. Feel free to adjust based on your preferences.
{% endhint %}

Click **Next** to proceed.
{% endstep %}

{% step %}

#### Review and Create

Review the configuration, including the stack name, role name, tags, deployment options, and selected accounts/regions.

<img src="/files/euJDDnceHuuT9qKDtFgt" alt="" width="563">

Click **Submit** to create the StackSet.
{% endstep %}

{% step %}

#### Verify StackSet

After submitting the StackSet, go to the **Operations** tab in the StackSets console to monitor the status of the deployment.

Once the StackSet execution is complete, check the **Detailed Status** for each child account.

The status should show as **SUCCEEDED** for all successfully deployed stacks.

{% hint style="warning" %}

## **IMPORTANT**

StackSets deploy the stack to child accounts within your organization, not the account where the StackSet is created. You need to execute a resource CFT stack in the same account, follow the instructions for [**Deploy Resource Role via Stack**](#id-2.-deploy-resource-role-using-stack)**.**
{% endhint %}
{% endstep %}
{% endstepper %}

## **Required Information to Finalize Onboarding**

Please share the following information over email at <support@astuto.ai>:

* **Master Account ID** or **list of individually integrated account IDs**
* **Resource Role ARN** generated as output of Stack
* **CUR Role ARN** generated as output of Stack
* **S3 Bucket Name** where your CUR files are stored
* **Stack Role Names and their unique identifiers** (only if role names were customized by you during deployment)

## Additional Setup (Optional)

OneLens provides additional insights to your Kubernetes clusters. In order to enable same folllow the instructions provided [here](/integrations/kubernetes/enable-split-cost-allocation-for-eks).


# Setting Up Cost Reports Manually

OneLens prefers the IAM role and CUR bucket to be created in us-east-1 region if you have multiple regions active. However if you wish to setup the Role and CUR bucket in a specific region, this document will guide you with the setup process.&#x20;

Its is a two step process:

1. [Setting up the CUR 2.0 report](#setting-up-the-cur-2.0-report)
2. [Creating IAM role for access](#creating-iam-role-for-access)

## Setting up the CUR 2.0 report

Billing service is a global service, which internally served by AWS in `us-east-1` region. We will configure the export via this global service to deliver reports in the S3 bucket created in choice of your region

{% stepper %}
{% step %}

### Initiate Data export

Go to Billing Service and click on[ Data Export](https://us-east-1.console.aws.amazon.com/costmanagement/home?region=ap-south-1#/bcm-data-exports).&#x20;

<figure><img src="/files/3sMNKKbGzMMtm5CVHIZ1" alt=""><figcaption></figcaption></figure>

{% endstep %}

{% step %}

### Create new report

Click on the `Create` button. Provide the Export Name as `OneLens-Standard-CUR-Export` and data export type should be the default, i.e. Standard Data Export.

<figure><img src="/files/XLUkPw7DYn8okSkzoryp" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Configure Table content setting

Select

1. Select report format as `CUR 2.0`
2. In addiotional settings, select both the check boxes
   1. Include Resource Id
   2. Split Cost Allocation Data

<figure><img src="/files/Z42028qePuhfj8lVS50s" alt=""><figcaption></figcaption></figure>

You should see the selection of 125 Columns
{% endstep %}

{% step %}
Configure Storage Settings and Finalize

Configure the S3 setting as per your need. In below screenshots we you see we selected \`ap-south-1\`as preferred region

<figure><img src="/files/Q0pC3IJ1xcI9cuxWHqnx" alt=""><figcaption></figcaption></figure>

Provide the Bucket Name and the region in which you want the bucket to be created

<figure><img src="/files/bEKlAjLwzUZHp9VTZeLb" alt=""><figcaption></figcaption></figure>

Provide the CUR Path as `cur` and hit the Create Button

<figure><img src="/files/YO0QcVdyR0RT1lM0EWub" alt=""><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

> Note - AWS will take 24-48 Hours to generate the first report.

## Creating IAM role for access

Once the S3 bucket is configured, lets create the IAM Role in the same region where you created the CUR bucket

{% stepper %}
{% step %}

### Create Cloudformation Stack

Go to CFT Service and upload the Stack. You can find the yml file below

{% file src="/files/aISV8co3cUEePFGogVGw" %}

{% endstep %}

{% step %}

### Specify Stack Details

Provide the details as

1. Stack Name - `onelens-cur-role-stack`
2. Role Name - get the unique ID from OneLens Team for your Account.
3. S3 Bucket Name - your S3 bucket name created in previous step

<figure><img src="/files/ShuSaqeptyRWuAP4GsG6" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Configure Stack Options

Click on Next and provide Tags as per your company norms (optional)

<figure><img src="/files/IptFUOPLWIW53OUV1PQj" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Review and create

Acknowledge that you are creating an IAM Role and create the role

<figure><img src="/files/B2bBdt03zEV8mAq9Ehzh" alt=""><figcaption></figcaption></figure>

Click on `Next` and then `Submit`

<figure><img src="/files/1dFhPeWAkKazWPLO2SXn" alt=""><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

After successful execution, please share the following details with OneLens team

* Your Account ID in which you have run the Stack
* S3 CUR Bucket Name


# Frequently Asked Questions (FAQ)

Answers to common questions regarding the architecture, security, and implementation of the OneLens Amazon Web Services (AWS) integration.

## What do I need before I can connect OneLens to AWS?

You need two things in place before starting:

* An active AWS account with permissions to create CloudFormation Stacks and StackSets.
* An S3 bucket that stores your Cost and Usage Report (CUR). If you haven't set one up yet, see [Setting Up Cost Reports Manually](/integrations/cloud-and-cost-sources/connect-to-aws/setting-up-cost-reports-manually).

{% hint style="info" %}
Both the Resource Role CFT and the CUR Role CFT must be deployed for OneLens to function correctly. Deploying only one will result in incomplete data ingestion.
{% endhint %}

## Does OneLens modify any of my AWS resources?

**No.** OneLens uses read-only IAM roles created by the CloudFormation templates. It only collects resource metadata, CloudWatch metrics, and Cost and Usage Report (CUR) data. No changes are made to your infrastructure at any point.

The roles are also fully reversible - you can delete them at any time to revoke OneLens access to your account.

Our Scheduler setup involves some permissions that can modify resources, but this is optional and not included in the default setup.

## Why must the CUR Stack be deployed in us-east-1?

AWS Billing services, which generate and host the Cost and Usage Report, are internally hosted in the us-east-1 region. The CloudFormation stack that creates the CUR access role must be deployed in the same region to function correctly.

The Resource Role stack, on the other hand, can be deployed in any region since IAM is a global AWS service.

{% hint style="danger" %}
If you accidentally deploy the CUR Stack in a region other than us-east-1, delete it and redeploy in the correct region before proceeding.
{% endhint %}

## What is the difference between a Stack and a StackSet?

Both deploy CloudFormation templates, but they serve different purposes:

* Stack: Deploys resources into a single AWS account. Used for the CUR Role (master account only) and the Resource Role (individual accounts).
* StackSet: Deploys resources across multiple AWS accounts from a central management account. Used to push the Resource Role into all child accounts simultaneously.

If you manage accounts centrally via AWS Organizations, use the StackSet approach for the Resource Role in child accounts. You still need to run a Stack in the management account itself.

## Do I need to deploy the CUR Role in my child accounts?

No. You only need to deploy the CUR Role in your master/payer account. AWS Consolidated Billing means the master account holds all cost data for every linked account, so OneLens only needs CUR access from that one account.

{% hint style="warning" %}
If you have decentralised accounts (not part of AWS Organizations), you will need to deploy the CUR Role separately in each account you want to connect.
{% endhint %}

## What does the Role Name format mean, and do I have to follow it?

The recommended format for role names is:

```
OneLens-<10-char-alphanumeric-unique-id>
```

The unique identifier helps OneLens associate each role with the correct account during onboarding. You can either:

* Define your own name following this format, or
* Contact the OneLens support team at <support@astuto.ai> and they will provide the exact role name for your account.

## I see a ManagedPolicy warning during Stack creation. Should I be concerned?

No, this is expected. The CloudFormation templates are designed to create IAM roles with Managed Policies that grant OneLens its scoped, read-only access. AWS surfaces this warning any time a template creates an IAM policy.

Simply tick the acknowledgement checkbox and continue. The permissions are strictly limited to what OneLens needs - no broad or administrative access is granted.

{% hint style="info" %}
You can review the full contents of each CloudFormation template before deploying by opening the S3 URL in your browser.
{% endhint %}

## What information do I need to send to OneLens after deployment?

Once both CFTs are deployed successfully, email the following details to <support@astuto.ai>:

* Master Account ID or the list of individually integrated account IDs
* Resource Role ARN (from the Stack Output tab)
* CUR Role ARN (from the Stack Output tab)
* S3 Bucket Name where your CUR files are stored
* Stack Role Names and unique identifiers (only if you customised the role names during deployment)

{% hint style="success" %}
The Role ARNs are visible under the Outputs tab of each completed CloudFormation Stack in the AWS console.
{% endhint %}

## How long does it take for data to appear in OneLens after connecting?

Once OneLens receives your account details and configures the connection, the initial data ingestion begins. Depending on the size of your CUR and the number of resources, the first data may take a few hours to appear in the dashboards.

After the initial load, OneLens processes data daily (or on the agreed schedule), so your insights stay up to date automatically.

## Can I revoke OneLens access to my AWS account?

Yes. To revoke access, simply delete the IAM roles created by the CloudFormation Stacks from your AWS account. You can do this by deleting the stacks themselves from the CloudFormation console, which will automatically remove all associated resources.

Once deleted, OneLens will no longer be able to access your account data.

{% hint style="warning" %}
Deleting the stacks is irreversible. If you want to reconnect OneLens later, you will need to redeploy the CFTs and go through the onboarding process again.
{% endhint %}

## What happens if my StackSet deployment shows a FAILED status for some accounts?

A failed StackSet deployment usually means one of the following:

* The target account does not have the required permissions to create IAM roles.
* The management account does not have StackSet administration permissions enabled.
* There is a naming conflict with an existing role in the target account.

Check the Detailed Status in the StackSet Operations tab for the specific error message. Fix the underlying issue and re-deploy or update the StackSet for the affected accounts.

{% hint style="info" %}
Accounts with a SUCCEEDED status are connected and working even if other accounts in the same StackSet failed. You do not need to re-run the entire StackSet.
{% endhint %}

## Can I connect Kubernetes clusters alongside my AWS accounts?

Yes. After connecting your AWS account, you can optionally integrate your EKS or AKS Kubernetes clusters for deeper cost and usage insights. This gives you pod-level visibility alongside your standard cloud cost data.

See the [Kubernetes Integration](/integrations/kubernetes) section for setup instructions, and [Enable Split Cost Allocation for EKS](/integrations/kubernetes/enable-split-cost-allocation-for-eks) if you want workload-level cost attribution in your Cost and Usage Report.


# Connecting to Azure

At a high-level, OneLens uses an **App Registration** created in your environment with the appropriate **read-only IAM roles** for resource visibility and cost/usage metrics. An **External User** is also created with similar IAM roles in your environment to enable our FinOps experts to manually analyze and identify potential savings.

{% hint style="info" %}
For a full list of IAM roles provisioned to the App Registration and External User, please refer to the [IAM roles](https://app.gitbook.com/o/8dBRgoxJiJRD1R7c7gwr/s/iyNGpqVYfmDF6qt7Lzar/~/edit/~/changes/326/integrations/cloud-services/connecting-to-azure#iam-roles) section.
{% endhint %}

{% hint style="warning" %}
The IAM roles created are limited in scope and grant only the permissions required for OneLens to function. No modifications are made to your infrastructure. Access is **read-only** and fully **reversible** - you may delete the individual roles or the App Registration/External User at any time to revoke access. OneLens does not collect or alter any data outside the defined access permissions.
{% endhint %}

### Architecture

Below is the architecture on our end to support ingestion and analysis of your Azure data:

<figure><img src="/files/BdtsvXvPKP9ebflzfW74" alt=""><figcaption></figcaption></figure>

### Integration flow

Below is a step-by-step flow of the integration process for your Azure environment:

<figure><img src="/files/zQUgDjN9qMCikJj8dRQw" alt=""><figcaption></figcaption></figure>

### Components created in your environment

* **Identity:**
  * App Registration
  * Client Secret for App Registration
  * Guest User as external user
* **Infrastructure:**
  * Resource Group, for hosting all OneLens resources
* **Storage:**
  * Storage Account, for storing cost export data
  * Blob Container, for storing cost export data
* **Cost Management Export**
  * Actual Cost export
  * Amortized Cost export

### IAM roles

<table><thead><tr><th width="163">IAM Role</th><th width="177">Scope</th><th width="163">Assignee</th><th width="206">Purpose</th></tr></thead><tbody><tr><td>Reader</td><td><em><strong>*</strong>Target scope</em></td><td>App Registration, External User</td><td>Read resources metadata.</td></tr><tr><td>Cost Management Reader</td><td><em><strong>*</strong>Target scope</em></td><td>App Registration, External User</td><td>Read cost analysis data.</td></tr><tr><td>Billing Reader</td><td>Management Group or Subscription</td><td>App Registration</td><td>Read invoice and billing data (for EA)</td></tr><tr><td>Billing Account Reader</td><td>Billing account</td><td>App Registration</td><td>Read billing data (for MCA/MOSP)</td></tr><tr><td>Storage Blob Data Reader </td><td>Storage account</td><td>App Registration, External User</td><td>Read exported cost report data.</td></tr></tbody></table>

**\*** *- Target scope can be a Resource Group, Subscription or a Management Group, as per your desired setup.*

### Resource providers enabled

For OneLens to be able to call the relevant Azure APIs for cost analysis, we enable the following Resource Providers on your subscription(s):

* `Microsoft.CostManagementExports`
* `Microsoft.CostManagement`
* `Microsoft.Billing`
* `Microsoft.Storage`
* `Microsoft.ContainerService` *(if AKS analysis enabled)*
* `Microsoft.Insights` *(if AKS analysis enabled)*
* `Microsoft.OperationalInsights` *(if AKS analysis enabled)*

### Integration steps

OneLens supports seamless integration across all Azure organizational structures. You can configure the platform to monitor an entire Management Group hierarchy, individual subscriptions with separate billing, or granular Resource Groups.

To get started, follow the below guide to integrate your Azure account with OneLens using a seamless automated setup powered by Terraform:

{% content-ref url="/pages/hHNDnae7utyi1S8eG4OS" %}
[Automated using Terraform](/integrations/cloud-and-cost-sources/connecting-to-azure/automated-using-terraform)
{% endcontent-ref %}

***

If you prefer to integrate manually using the Azure Portal console, follow the appropriate guide below as per your desired scope:

* **Management Groups:** For organizations with multiple subscriptions.

{% content-ref url="/pages/7gEa2bW1SCoL9MZwOx7L" %}
[At Management Group](/integrations/cloud-and-cost-sources/connecting-to-azure/at-management-group)
{% endcontent-ref %}

* **Subscriptions:** For single or multiple subscriptions with individual billing.

{% content-ref url="/pages/jvB5jn5H5fTyF2K6ezjr" %}
[At Subscription Level](/integrations/cloud-and-cost-sources/connecting-to-azure/at-subscription-level)
{% endcontent-ref %}

* **Resource Groups:** For granular, isolated integration.

{% content-ref url="/pages/XePhmozDoj7lxkn0IN6E" %}
[At Resource Group](/integrations/cloud-and-cost-sources/connecting-to-azure/at-resource-group)
{% endcontent-ref %}


# Automated using Terraform

This guide details the integration process and introduces a unified Terraform solution to fully automate onboarding, including App Registration, Cost Exports, and IAM role assignments.

{% hint style="warning" %}
The user executing the script must hold specific roles based on the target integration scope:\
\
**Management Group:** `Owner` or `User Access Administrator` at the Management Group level

**Subscription:** `Owner` at the Subscription level

**Resource Group:** `Owner` at the Resource Group level
{% endhint %}

OneLens is designed to adapt to your specific Azure organizational hierarchy. Whether your governance model relies on complex Management Groups, standalone Subscriptions with individual billing, or isolated Resource Groups, OneLens supports integration at the scope that best fits your needs.

To accelerate this process, we provide a **unified Terraform solution** that automates the complete onboarding workflow for all three scopes. This automation handles the end-to-end setup, including:

* **Infrastructure Setup:** Creates the App Registration (Service Principal), Storage Accounts, and Blob Containers.
* **Data Configuration:** Configures Cost Exports in Parquet format with Snappy compression and enables file partitioning.
* **Access Management:** Assigns required IAM roles and manages external user invitations.

{% hint style="warning" %}
The following prerequisites must be met before deploying the Terraform onboarding script:

* **Azure CLI:** Must be installed and authenticated (`az login`).
* **Terraform version:** Version 1.0 or greater is required
* **Optional:** `jq` is recommended for better JSON output formatting.\
  \
  **Note:** If you are using **Azure Cloud Shell (recommended)**, the above prerequisites will already be satisfied.
  {% endhint %}

{% stepper %}
{% step %}

### Uploading the Script

* Login to the Azure Portal.
* From the Azure homepage, click the **Cloud Shell icon** on the top navigation bar to launch `Azure Cloud Shell`.

<figure><img src="/files/t5DUX71sVy2QxpChZjJ7" alt=""><figcaption></figcaption></figure>

* The Azure Cloud Shell window would now be open. Authenticate your user if prompted.
* Use the following command to set the working subscription in the Cloud Shell session. The cost export used by OneLens will be created in this subscription (applicable for all scopes).

```
az account set --subscription <subscription_ID>
```

<figure><img src="/files/xLEZhzTkzmIRiKTHDTXL" alt=""><figcaption></figcaption></figure>

* Create a new folder using the following command:

```
mkdir onelens_onboarding_azure
```

* Navigate into the newly created folder using the following command:

```
cd ./onelens_onboarding_azure/
```

<figure><img src="/files/onh9DR8rJcDVzy82STbh" alt=""><figcaption></figcaption></figure>

* Use the **Manage files** **> Upload** option to upload the Terraform script folder to Azure Cloud Shell.

{% hint style="info" %}
The script would have been provided to you in a **ZIP** format by the OneLens team. Please unzip the file into a folder and proceed to upload the files.
{% endhint %}

<figure><img src="/files/ayq0518XrNqWsSQb3Gf9" alt=""><figcaption></figcaption></figure>

* Select all **9** files from the unzipped folder to upload.
* The Azure Cloud Shell window should display a successfully uploaded message.

<figure><img src="/files/FACyv2iBPbU01HqmunL7" alt=""><figcaption></figcaption></figure>

* Move all the files into the newly created folder using the following commands (for easier maintenance).

```
cd ..
mv backend.tf data.tf deploy.sh locals.tf main.tf outputs.tf provider.tf README.md variables.tf ./onelens_onboarding_azure/
cd onelens_onboarding_azure
```

<figure><img src="/files/2c6biTSfBhvMkUY3H1F3" alt=""><figcaption></figcaption></figure>

{% endstep %}

{% step %}

### Setting variables for Terraform

* Use the following commands to make the deploy.sh script executable and execute it:

```
chmod +x ./deploy.sh
./deploy,sh
```

This will initiate the deployment script and run pre-flight permission checks.

<figure><img src="/files/QAjflVNLc65Oe6o2iwrU" alt=""><figcaption></figcaption></figure>

* Choose the scope of deployment by entering:
  * **1** for *Management Group*
  * **2** for *Subscription(s)*
  * **3** for *Resource Group(s)*

<figure><img src="/files/MNmQMSR4sbx9Vv0HIn5K" alt=""><figcaption></figcaption></figure>

In this guide, we are onboarding a single Subscription as an example.<br>

* The script will prompt you for your company name (use lowercase characters and hyphens only).

<figure><img src="/files/cuehCrfmr4wjmA1NVnNX" alt=""><figcaption></figcaption></figure>

* Next, enter the Subscription ID(s) separated by commas, or type "ALL" to onboard all available subscriptions.

{% hint style="info" %}
Depending on your scope of onboarding, the script will prompt you for the Management Group (tenant) ID(s) or the Resource Group ID(s).
{% endhint %}

* Using the entered value, the script determines your **Billing Account type** (MOSP, MCA, EA) and the **Billing Account ID** and prints the same for your verification. Type **yes** to use the value.

<figure><img src="/files/4v6EBLaWk6v3vPdDs5LM" alt=""><figcaption></figcaption></figure>

* Next, the script will prompt you to enter the **External User email ID** (unless explicitly provided by the OneLens team, you can hit **Enter** to use the default value).
* Next, the script will prompt you to specify an **Azure region** where the new storage account (for storing the Cost export) is to be created. To use the default value (Central India), hit **Enter**.&#x20;

{% hint style="warning" %}
You can specify any region by using the **programmatic name** from the below list.\
\
[Azure regions list](https://learn.microsoft.com/en-us/azure/reliability/regions-list#azure-regions-list-1)
{% endhint %}

<figure><img src="/files/9B3YuxXExXxp2sahYYPs" alt=""><figcaption></figcaption></figure>

* Next, the script will prompt you to enable **AKS Cost Analysis** for detailed usage and cost metrics for Azure Kubernetes clusters. If you do not use AKS in the selected scope, you can enter **no.**\
  \
  If yes, the script will check for available clusters in your scope and enable AKS cost analysis.

{% hint style="info" %}
For more details on how and why we enable AKS cost analysis, please refer to the below documentation from Microsoft:\
\
[AKS Cost Analysis](https://learn.microsoft.com/en-us/azure/aks/cost-analysis)
{% endhint %}

<figure><img src="/files/NmoE7RWQYEE5MApEMaXb" alt=""><figcaption></figcaption></figure>

* Next, the script will prompt you to **enable Tag Inheritance**. It is **recommended to enable** it for better tagged visibility on OneLens.

{% hint style="info" %}
For more details on how and why we enable Tag Inheritance, please refer to the below documentation from Microsoft:\
\
[Enable Tag Inheritance](https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/enable-tag-inheritance)
{% endhint %}

<figure><img src="/files/xXw8OuyrMKlHY4WMYoGs" alt=""><figcaption></figcaption></figure>

* Next, the script will prompt you to enter the client ID of the **App Registration** to enable integration with OneLens. It is recommended to create a new App Registration by pressing **Enter**.
* Subsequently, the script prompts you to enter the name of the **Storage Account** to use for cost exports. It is recommended to create a new Storage Account by pressing **Enter**.

<figure><img src="/files/bWBSu61jvEeAik1cN8Rw" alt=""><figcaption></figcaption></figure>

* To keep the OneLens resources organized in your environment, the script creates a Resource Group called **onelens-rg**. \
  \
  If a resource group with that name is already present, press **1** to use it, or press **2** to create a new Resource Group with a custom name. By default, the script will create a new Resource Group.

<figure><img src="/files/HId6UYBZjd4IGGvNNla0" alt=""><figcaption></figcaption></figure>

* The script will then prompt you for a **Container name** to be created in the Storage Account.\
  \
  By default, the script will use the value **onelens-cost-usage-reports** on pressing **Enter**.

<figure><img src="/files/QdqmmVUQ4dj32tyyjbfw" alt=""><figcaption></figcaption></figure>

{% endstep %}

{% step %}

### Executing the script

* After validating all inputs, the script runs the `terraform init` and `terraform plan` commands, then prints a **summary** of the resources to be created for your reference.\
  \
  Upon entering **yes**, the script proceeds to run the `terraform apply` command.

<figure><img src="/files/5jJxICOrVwZPjRvD92f0" alt=""><figcaption></figcaption></figure>

* On successful execution, the script saves the outputs into a Terraform statefile and outputs a summary.

{% hint style="success" %}
**You have now&#x20;**<mark style="color:$success;">**successfully**</mark>**&#x20;integrated your Azure environment with OneLens.**

\
**Please share the following values to the OneLens team to facilitate the connection on our end:**

* *App Registration Tenant (Directory) ID*
* *App Registration Client (Application) ID*
* *App Registration Client Secret Value*
* *App Registration Client Secret ID*
* *Storage Account name*
* *Container name*
* *Subscription ID(s) / Resource Group ID(s) / Management Group ID(s)*
  {% endhint %}

{% endstep %}

{% step %}

### Optional: Backup the state file to Azure Storage (recommended)

* As a final step, the script prompts you to backup the Terraform state file to the storage account used. \
  \
  It is recommended to enter **yes**, to streamline the process for deleting the OneLens resources in case of a future offboarding activity.
  {% endstep %}
  {% endstepper %}


# At Management Group

Customers who have configured multiple subscriptions in their account can follow the below guide to integrate all subscriptions with minimal effort.

{% hint style="info" %}
User performing the integration should have **Owner** role on the management groups being integrated.

Make sure the following resource providers are enabled on the subscriptions in the management groups being onboarded:

1. Microsoft.CostManagementExports
2. Microsoft.CostManagement
3. Microsoft.Billing
4. Microsoft.Storage \</aside>
   {% endhint %}

To begin using OneLens, you need to connect your Azure account by creating an App Registration (Service Principal) and assigning the required permissions for FinOps assessment.

The following guide allows to onboard a management group containing one (or multiple) subscriptions to OneLens.

3 types of Azure billing accounts are currently supported:

* *Microsoft Online Services Program / Pay-as-you-go (MOSP),*
* *Microsoft Customer Agreement (MCA) and*
* *Microsoft Enterprise Agreement (EA).*

Only the IAM permissions tied to the App Registration slightly differ according to the type of billing setup you have. To integrate, follow the below steps:<br>

{% stepper %}
{% step %}

### Create a new App Registration (Service Principal)

* From the home page of the Azure portal, search for and open `Microsoft Entra ID`.
* In the left navigation menu, under `Manage`, select `App registrations`.
* Click `+ New Registration`<br>

  <figure><img src="/files/R1zOZu3vC1Po7VK5G85p" alt=""><figcaption></figcaption></figure>
* In the open Register an application page, under **Name**, enter “*onelens-sa*”.
* All other settings can be left as default (as below).

  <figure><img src="/files/vMPesjT9baW7CsjScKR9" alt="" width="563"><figcaption></figcaption></figure>
* Click `Register`\
  &#x20;
* The App Registration details should now be displayed.<br>

  <figure><img src="/files/gurK6X5CKLCxMZLK8l25" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="danger" %}
**Copy the Application `Client ID` and `Directory (tenant) ID` values to a safe location. You will need these values later.**
{% endhint %}
{% endstep %}

{% step %}

### Generate a Client Secret

* In the **App registration** page, in the left navigation menu under **Manage**, click `Certificates & secrets`.
* Under the **Client secrets** tab, click `+ New client secret`.<br>

  <figure><img src="/files/m8taNwovRJ3KkSBKdwjQ" alt="" width="563"><figcaption></figcaption></figure>
* The **Add a client secret** window is opened. For description, enter the value “*onelens-secret*”.<br>

  <figure><img src="/files/OUhs2IL9WJgUp2TThk8G" alt="" width="563"><figcaption></figcaption></figure>
* Click `Add`.
* The newly created secret is now displayed.

<figure><img src="/files/JaggF9GRuhhs3VsocoGD" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="info" %}
**Copy the secret’s `Value` and `ID` to a safe location. You will need these values later.**
{% endhint %}

{% endstep %}

{% step %}

### Assign billing permissions to the App Registration

#### For MCA/MOSP/PayGo accounts:

* From the Azure homepage, go to `Cost Management + Billing` and select your `Billing Scope`.

  <figure><img src="/files/fn2PtiWUDE4mTe5a1Ycd" alt="" width="563"><figcaption></figcaption></figure>
* From the left navigation menu, select `Access Control (IAM)`
* Click `+ Add`
* Under Role, select `Billing account reader`. In the Users, groups or apps section, search for and add the **App registration** created earlier (“*onelens-sa*”).<br>

  <figure><img src="/files/OM6AmhPHtBDwWvchvNUU" alt="" width="295"><figcaption></figcaption></figure>
* Click `Add`.

#### For EA accounts:

* From the Azure homepage, search for go to `Management groups`. Select your management group to be integrated.
* From the left navigation menu, select `Access Control (IAM)`.
* Click `+ Add`, and select `Add role assignment`.
* In the opened Add role assignment screen, under `Job function roles`, search for and select `Billing reader`.<br>

  <figure><img src="/files/5dHbC3GAzUZZkgc8yE2z" alt="" width="563"><figcaption></figcaption></figure>
* Click `Next`. Under **Members,** click `+ Select members`, and select the `App registration` created earlier ("*onelens-sa"*)<br>

  <figure><img src="/files/Y4fyEm4cMhVPk9rT3NhV" alt="" width="563"><figcaption></figcaption></figure>
* Click `Review + assign`

{% endstep %}

{% step %}

### Create a storage account and enable exports

* From the Azure homepage, search for and open `Storage accounts`.
* Click `+ Create`. The **Create a storage account** window is opened.
* Under the **Basics** tab, add the following values:
  * **Subscription**: Select a subscription in the management group being onboarded.
  * **Resource group**: Create a new resource group with the name as `onelens-rg`.
  * **Storage account name**: Enter a globally unique, lowercase name like `onelens-<customername>-billing`.
  * **Region**: Choose your desired Azure region e.g. **(Asia Pacific) South India**.
  * **Performance**: **Standard**
  * **Redundancy**: Select **Locally-redundant storage (LRS)**.
  * Click **Next**.<br>

    <figure><img src="/files/HdqhrgwoPEgfBsMND0rX" alt="" width="563"><figcaption></figcaption></figure>
* Under the `Advanced` tab, configure the following:
  * Set **Default to Microsoft Entra authorization in the Azure portal** to Enabled

    <figure><img src="/files/MH1L9jJupgd3cgrhPQ9h" alt="" width="563"><figcaption></figcaption></figure>
* All other options can be left in their default state.
* Click `Review + Create`. Wait for the deployment to complete.
* Once created, open the newly created storage account.
* In the left navigation pane, under `Data Storage`, select **Containers**.<br>

  <figure><img src="/files/thTI0DwjuenSwoFB4BOD" alt="" width="563"><figcaption></figcaption></figure>
* Click on `+ Add Container`, and add the following values:
  * Under **Name**, enter the value `onelens-cost-usage-reports`**.**
  * Leave the **Anonymous access level** option as default: **Private (no anonymous access)**.<br>

    <figure><img src="/files/QDpWN00QNKaUv2mGOaOW" alt="" width="326"><figcaption></figcaption></figure>
* Click `Create`.
* Using the Azure Portal search bar, search for an open `Cost Management + Billing`**.**
* Under **Scope**, make sure the right **Billing account** is selected.
* In the left navigation pane, under `Settings`, select `Exports`.
* Click `+ Create`.<br>

  <figure><img src="/files/I7qlXrP5VlTO81zFteId" alt="" width="563"><figcaption></figcaption></figure>
* In the opened **New export** window, under the **Basics** tab, select **Cost and usage (actual + amortized)**.<br>

  <figure><img src="/files/mJnSUNbwdcwjOxaO4dFs" alt="" width="563"><figcaption></figcaption></figure>
* Under the **Datasets** tab, in the **Export prefix** field, enter the value: **onelens.**
* In the **Datasets** tab, now two exports should be visible:
  * onelens-actual-cost
  * onelens-amortized-cost<br>

    <figure><img src="/files/cT4h3NsplWQul9TGIMxG" alt="" width="563"><figcaption></figcaption></figure>
* Click `Next`.
* Under the `Destination` tab, enter the following values:
  * **Storage type:** **Azure blob storage**
  * **Destination and storage**: **Use existing**
  * **Subscription:** Select the **subscription** containing the new storage account.
  * **Storage account:** Select the storage account created earlier (**onelens-\<customername>-billing**).
  * **Container:** Enter the name of the container created earlier (**onelens-cost-usage-reports**).
  * **Directory:** Enter a new directory name like **reports**.
  * **Format:** **Parquet**
  * **Compression type:** **Snappy** (default)
  * **File partitioning:** **enabled** (default)
  * **Overwrite data:** **enabled** (default)<br>

    <figure><img src="/files/8Cw4cQkACwhPejmZBvGh" alt="" width="563"><figcaption></figcaption></figure>
* Click `Review + Create`. The first set of exports should run within \~24 hours.

{% endstep %}

{% step %}

### Assign Azure RBAC roles to the App Registration

* From the Azure homepage, search for and open `Management groups`.
* Select your **management group** to be integrated.
* From the left navigation menu, select `Access Control (IAM)`.
* Click `+ Add` and select `Add role assignment`.
* In the opened `Add a role assignment` window, under the **Job function roles** tab, search for and select `Reader`. Click `Next`.<br>

  <figure><img src="/files/jNj3XiwlPCdu1vmOuhjK" alt="" width="563"><figcaption></figcaption></figure>
* Under the **Members** tab, click **+ Select members**, and select the App registration created earlier (*”onelens-sa”*).<br>

  <figure><img src="/files/m9ljIFKslrANAhrQZBYe" alt="" width="563"><figcaption></figcaption></figure>
* Click `Review + assign`.
* Similarly, add `Cost Management Reader` role.
* Using the Azure search bar on the top, search for and select `Storage Accounts`.
* Navigate to the **storage account** created in step 4.
* In the left navigation pane, select `Access Control (IAM)`.
* Click `+ Add` and select `Add role assignment`.
* In the `Role` tab, search for and select `Storage Blob Data Reader`. Click `Next`.<br>

  <figure><img src="/files/sqqtcerf18jTyFXd2IdJ" alt="" width="563"><figcaption></figcaption></figure>
* In the `Members` tab, enter the following:
  * Assign access to: **User, group, or service principal**
  * Members: click `+ Select members`, search for and select the App registration created earlier ("onelens-sa").<br>

    <figure><img src="/files/AuOJ0y6I7qes46asGDbD" alt="" width="563"><figcaption></figcaption></figure>
* Click `Review + assign`.

{% endstep %}

{% step %}

### Assign Azure RBAC roles to external user

* Login to the homepage of the Azure Portal, search for and open `Microsoft Entra ID`.
* In the left navigation menu, select `Access Control (IAM).`
* Click `+ Add` > **User** > **Invite external user**.<br>

  <figure><img src="/files/auzozT0uWvQdFwqu6HuJ" alt="" width="563"><figcaption></figcaption></figure>
* In the opened Invite external user window, enter the following details:
  * **Email**: paste the unique email provided to you by the OneLens team (**onelens.finops+\<customername>@astuto.ai**)
  * **Display Name**: enter the value **OneLens External Reader.**
  * Other options can be left as default.
  * Click `Review + invite`.<br>

    <figure><img src="/files/qGYcfBhklyITyvAbDDXK" alt="" width="563"><figcaption></figcaption></figure>
* From the Azure homepage, search for and open `Management groups`.
* Select your **management group** to be integrated.
* From the left navigation menu, select `Access Control (IAM)`.
* Click `+ Add` and select `Add role assignment`.
* In the opened **Add a role assignment** window, under the **Job function roles** tab, search for and select `Reader`. Click `Next`.<br>

  <figure><img src="/files/5kdkIQU3qFwzAT2VjRk6" alt="" width="563"><figcaption></figcaption></figure>
* Under the **Members** tab, click `+ Select members`, paste the unique email provided to you by the OneLens team (**onelens.finops+\<customername>@astuto.ai**).
* Click `Review + assign`.
* Similarly, add `Cost Management Reader` role.
* Using the Azure search bar on the top, search for and select `Storage Accounts`.
* Navigate to the storage account created in step 4.
* In the left navigation pane, select `Access Control (IAM)`.
* Click `+ Add` and select `Add role assignment`.
* In the **Role** tab, search for and select `Storage Blob Data Reader`**.** Click `Next`.
* In the **Members** tab, enter the following:
  * Assign access to: **User, group, or service principal**
  * Members: click `+ Select members`, paste the unique email provided to you by the OneLens team (**onelens.finops+\<customername>@astuto.ai**).
* Click `Review + assign`.

{% endstep %}

{% step %}

### **Update storage account network default action**

Using the Azure CLI, run the following command to set the storage account’s network default action:

```bash
az storage account update \\
  --name onelens-<customername>-billing \\
  --resource-group onelens-rg \\
  --default-action Allow
```

This command updates the storage account’s network rules so that requests which do not match any explicit network rule are **allowed** (instead of denied). It controls **network access behavior**, not authentication.

{% hint style="info" %}
Public or network-level access being permitted by `--default-action Allow` **does not bypass RBAC**. Entities still require valid credentials, role assignments or SAS to read/write data.
{% endhint %}

{% endstep %}

{% step %}

### Enable cost analysis for AKS (Kubernetes) clusters

{% hint style="info" %}
User enabling cost analysis should have **Owner** or atleast **Contributor** role on the resource groups containing the AKS clusters being onboarded.

Make sure the following resource providers are enabled on the subscriptions in which the AKS clusters being onboarded are present:

1. Microsoft.ContainerService
2. Microsoft.Insights
3. Microsoft.OperationalInsights
   {% endhint %}

#### Enabling Cost Analysis on Multiple Cluster Together

For enabling cost analysis on multiple clusters within a resource group, run the following command using Azure CLI:

{% code overflow="wrap" %}

```powershell
for cluster in $(az aks list -g <resourceGroup> --query "[].name" -o tsv); do
  az aks update --resource-group <resourceGroup> --name $cluster --enable-cost-analysis
done
```

{% endcode %}

where, **\<resourceGroup>** is to be replaced with the name of the resource group in which your AKS cluster is.

#### Enabling Cost Analysis on Single Cluster

For enabling cost analysis on a single cluster, run the following command using Azure CLI:

{% code overflow="wrap" %}

```sh
az aks update --resource-group <resourceGroup> --name <clusterName> --enable-cost-analysis
```

{% endcode %}

where, **\<resourceGroup>** is to be replaced with the name of the resource group in which your AKS cluster is, and **\<clusterName>** is to be replaced with the name of your AKS cluster.

{% hint style="info" %}

AKS cost analysis can only be enabled for clusters on **Standard** or **Premium** pricing tiers. It is not available on the Free tier.

You can check an AKS cluster’s tier with the below command (using Azure CLI):

{% code overflow="wrap" %}

```sh
az aks show --resource-group <resourceGroup> --name <clusterName> --query "sku.tier"
```

{% endcode %}
{% endhint %}
{% endstep %}

{% step %}

### Enable Tag Inheritance

Tags are widely used to group costs to align with different business units, engineering environments, cost departments, and so on. Tags provide the visibility needed for businesses to manage and allocate costs across the different groups. When Tag inheritance is enabled, it applies billing, resource group, and subscription tags to child resource usage records.

Follow the below guide from Microsoft to enable Tag inheritance for MCA/MOSP/EA accounts at billing account or subscription-level

{% embed url="<https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/enable-tag-inheritance>" %}
{% endstep %}
{% endstepper %}

{% hint style="success" %}
**You have now&#x20;**<mark style="color:$success;">**successfully**</mark>**&#x20;integrated your Azure environment with OneLens.**

\
**Please share the following values to the OneLens team to facilitate the connection on our end:**

* *App Registration Tenant (Directory) ID*
* *App Registration Client (Application) ID*
* *App Registration Client Secret Value*
* *App Registration Client Secret ID*
* *Storage Account name*
* *Container name*
* *Subscription ID(s) / Resource Group ID(s) / Management Group ID(s)*
  {% endhint %}


# At Subscription Level

Customers who have configured single/multiple individual subscriptions in their account can follow the below guide to for integration.

{% hint style="info" %}
User performing the integration should have **Owner** role on the **Subscriptions** being integrated.

Make sure the following resource providers are enabled on the subscriptions in the management groups being onboarded:

1. Microsoft.CostManagementExports
2. Microsoft.CostManagement
3. Microsoft.Billing
4. Microsoft.Storage&#x20;
   {% endhint %}

To begin using OneLens, you need to connect your Azure account by creating an App Registration (Service Principal) and assigning the required permissions for FinOps assessment.

The following guide allows to onboard a management group containing one (or multiple) subscriptions to OneLens.

3 types of Azure billing accounts are currently supported:

* *Microsoft Online Services Program / Pay-as-you-go (MOSP),*
* *Microsoft Customer Agreement (MCA) and*
* *Microsoft Enterprise Agreement (EA).*

Only the IAM permissions tied to the App Registration slightly differ according to the type of billing setup you have. To integrate, follow the below steps:<br>

{% stepper %}
{% step %}

### Create a new App Registration (Service Principal)

* From the home page of the Azure portal, search for and open `Microsoft Entra ID`.
* In the left navigation menu, under `Manage`, select `App registrations`.
* Click `+ New Registration`<br>

  <figure><img src="/files/R1zOZu3vC1Po7VK5G85p" alt=""><figcaption></figcaption></figure>
* In the open Register an application page, under **Name**, enter “*onelens-sa*”.
* All other settings can be left as default (as below).

  <figure><img src="/files/vMPesjT9baW7CsjScKR9" alt="" width="563"><figcaption></figcaption></figure>
* Click `Register`\
  &#x20;
* The App Registration details should now be displayed.<br>

  <figure><img src="/files/gurK6X5CKLCxMZLK8l25" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="info" %}
**Copy the Application `Client ID` and `Directory (tenant) ID` values to a safe location. You will need these values later.**
{% endhint %}
{% endstep %}

{% step %}

### Generate a Client Secret

* In the **App registration** page, in the left navigation menu under **Manage**, click `Certificates & secrets`.
* Under the **Client secrets** tab, click `+ New client secret`.<br>

  <figure><img src="/files/m8taNwovRJ3KkSBKdwjQ" alt="" width="563"><figcaption></figcaption></figure>
* The **Add a client secret** window is opened. For description, enter the value “*onelens-secret*”.<br>

  <figure><img src="/files/OUhs2IL9WJgUp2TThk8G" alt="" width="563"><figcaption></figcaption></figure>
* Click `Add`.
* The newly created secret is now displayed.

<figure><img src="/files/JaggF9GRuhhs3VsocoGD" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="danger" %}
**Copy the secret’s `Value` and `ID` to a safe location. You will need these values later.**
{% endhint %}

{% endstep %}

{% step %}

### Assign billing permissions to the App Registration

#### For MCA/MOSP/PayGo accounts:

* From the Azure homepage, go to `Cost Management + Billing` and select your `Billing Scope`.

  <figure><img src="/files/fn2PtiWUDE4mTe5a1Ycd" alt="" width="563"><figcaption></figcaption></figure>
* From the left navigation menu, select `Access Control (IAM)`
* Click `+ Add`
* Under Role, select `Billing account reader`. In the Users, groups or apps section, search for and add the **App registration** created earlier (“*onelens-sa*”).<br>

  <figure><img src="/files/OM6AmhPHtBDwWvchvNUU" alt="" width="295"><figcaption></figcaption></figure>
* Click `Add`.

#### For EA accounts:

* From the Azure homepage, search for go to `Subscriptions`. Select your management group to be integrated.
* From the left navigation menu, select `Access Control (IAM)`.
* Click `+ Add`, and select `Add role assignment`.
* In the opened Add role assignment screen, under `Job function roles`, search for and select `Billing reader`.\ <br>

  <figure><img src="/files/N5qgQuSgTX6KdeE1M4X5" alt="" width="563"><figcaption></figcaption></figure>
* Click `Next`. Under **Members,** click `+ Select members`, and select the `App registration` created earlier ("*onelens-sa*")<br>

  <figure><img src="/files/33haT6BRAOeNDsKtiLtM" alt="" width="563"><figcaption></figcaption></figure>
* Click `Review + assign`

{% endstep %}

{% step %}

### Create a storage account and enable exports

* From the Azure homepage, search for and open `Storage accounts`.
* Click `+ Create`. The **Create a storage account** window is opened.
* Under the **Basics** tab, add the following values:
  * **Subscription**: Select a subscription in the management group being onboarded.
  * **Resource group**: Create a new resource group with the name as `onelens-rg`.
  * **Storage account name**: Enter a globally unique, lowercase name like `onelens-<customername>-billing`.
  * **Region**: Choose your desired Azure region e.g. **(Asia Pacific) South India**.
  * **Performance**: **Standard**
  * **Redundancy**: Select **Locally-redundant storage (LRS)**.
  * Click **Next**.<br>

    <figure><img src="/files/HdqhrgwoPEgfBsMND0rX" alt="" width="563"><figcaption></figcaption></figure>
* Under the `Advanced` tab, configure the following:
  * Set **Default to Microsoft Entra authorization in the Azure portal** to Enabled

    <figure><img src="/files/MH1L9jJupgd3cgrhPQ9h" alt="" width="563"><figcaption></figcaption></figure>
* All other options can be left in their default state.
* Click `Review + Create`. Wait for the deployment to complete.
* Once created, open the newly created storage account.
* In the left navigation pane, under `Data Storage`, select **Containers**.<br>

  <figure><img src="/files/thTI0DwjuenSwoFB4BOD" alt="" width="563"><figcaption></figcaption></figure>
* Click on `+ Add Container`, and add the following values:
  * Under **Name**, enter the value `onelens-cost-usage-reports`**.**
  * Leave the **Anonymous access level** option as default: **Private (no anonymous access)**.<br>

    <figure><img src="/files/QDpWN00QNKaUv2mGOaOW" alt="" width="326"><figcaption></figcaption></figure>
* Click `Create`.
* Using the Azure Portal search bar, search for an open `Cost Management + Billing`**.**
* In the left navigation pane, under `Settings`, select `Exports`.
* Change the Scope (under Create) to your **subscription** to be integrated

<figure><img src="/files/MfL5iFuPkARCQz7ZmhpG" alt="" width="563"><figcaption></figcaption></figure>

* Click `+ Create`.

  <figure><img src="/files/JHrLWdsLum92Lcwn4cXg" alt="" width="563"><figcaption></figcaption></figure>
* In the opened **New export** window, under the **Basics** tab, select **Cost and usage (actual + amortized)**.<br>

  <figure><img src="/files/mJnSUNbwdcwjOxaO4dFs" alt="" width="563"><figcaption></figcaption></figure>
* Under the **Datasets** tab, in the **Export prefix** field, enter the value: **onelens.**
* In the **Datasets** tab, now two exports should be visible:
  * onelens-actual-cost
  * onelens-amortized-cost<br>

    <figure><img src="/files/cT4h3NsplWQul9TGIMxG" alt="" width="563"><figcaption></figcaption></figure>
* Click `Next`.
* Under the `Destination` tab, enter the following values:
  * **Storage type:** **Azure blob storage**
  * **Destination and storage**: **Use existing**
  * **Subscription:** Select the **subscription** containing the new storage account.
  * **Storage account:** Select the storage account created earlier (**onelens-\<customername>-billing**).
  * **Container:** Enter the name of the container created earlier (**onelens-cost-usage-reports**).
  * **Directory:** Enter a new directory name like **reports**.
  * **Format:** **Parquet**
  * **Compression type:** **Snappy** (default)
  * **File partitioning:** **enabled** (default)
  * **Overwrite data:** **enabled** (default)<br>

    <figure><img src="/files/8Cw4cQkACwhPejmZBvGh" alt="" width="563"><figcaption></figcaption></figure>
* Click `Review + Create`. The first set of exports should run within \~24 hours.

{% endstep %}

{% step %}

### Assign Azure RBAC roles to the App Registration

* From the Azure homepage, search for and open `Subscriptions`.
* Select your **Subscription** to be integrated.
* From the left navigation menu, select `Access Control (IAM)`.
* Click `+ Add` and select `Add role assignment`.
* In the opened `Add a role assignment` window, under the **Job function roles** tab, search for and select `Reader`. Click `Next`.<br>

  <figure><img src="/files/ykfeHdW4fIMNm6sBGBDZ" alt="" width="563"><figcaption></figcaption></figure>
* Under the **Members** tab, click **+ Select members**, and select the App registration created earlier (*"onelens-sa"*).<br>

  <figure><img src="/files/zz9yv2pp4gbPIuVhnj6B" alt="" width="563"><figcaption></figcaption></figure>
* Click `Review + assign`.
* Similarly, add `Cost Management Reader` role.
* All the above steps must be repeated for each subscription to be onboarded.
* Using the Azure search bar on the top, search for and select `Storage Accounts`.
* Navigate to the **storage account** created in step 4.
* In the left navigation pane, select `Access Control (IAM)`.
* Click `+ Add` and select `Add role assignment`.
* In the `Role` tab, search for and select `Storage Blob Data Reader`. Click `Next`.<br>

  <figure><img src="/files/sqqtcerf18jTyFXd2IdJ" alt="" width="563"><figcaption></figcaption></figure>
* In the `Members` tab, enter the following:
  * Assign access to: **User, group, or service principal**
  * Members: click `+ Select members`, search for and select the App registration created earlier ("onelens-sa").<br>

    <figure><img src="/files/AuOJ0y6I7qes46asGDbD" alt="" width="563"><figcaption></figcaption></figure>
* Click `Review + assign`.

{% endstep %}

{% step %}

### Assign Azure RBAC roles to external user

* Login to the homepage of the Azure Portal, search for and open `Microsoft Entra ID`.
* In the left navigation menu, select `Access Control (IAM).`
* Click `+ Add` > **User** > **Invite external user**.<br>

  <figure><img src="/files/auzozT0uWvQdFwqu6HuJ" alt="" width="563"><figcaption></figcaption></figure>
* In the opened Invite external user window, enter the following details:
  * **Email**: paste the unique email provided to you by the OneLens team (**onelens.finops+\<customername>@astuto.ai**)
  * **Display Name**: enter the value **OneLens External Reader.**
  * Other options can be left as default.
  * Click `Review + invite`.<br>

    <figure><img src="/files/qGYcfBhklyITyvAbDDXK" alt="" width="563"><figcaption></figcaption></figure>
* From the Azure homepage, search for and open `Subscriptions`.
* Select your **subscription** to be integrated.
* From the left navigation menu, select `Access Control (IAM)`.
* Click `+ Add` and select `Add role assignment`.
* In the opened **Add a role assignment** window, under the **Job function roles** tab, search for and select `Reader`. Click `Next`.<br>

  <figure><img src="/files/y3xZ0iQwq4aBQ0FdNWk3" alt="" width="563"><figcaption></figcaption></figure>
* Under the **Members** tab, click `+ Select members`, paste the unique email provided to you by the OneLens team (**onelens.finops+\<customername>@astuto.ai**).
* Click `Review + assign`.
* Similarly, add `Cost Management Reader` role.
* The above steps must be repeated for each **subscription** to be onboarded.
* Using the Azure search bar on the top, search for and select `Storage Accounts`.
* Navigate to the storage account created in step 4.
* In the left navigation pane, select `Access Control (IAM)`.
* Click `+ Add` and select `Add role assignment`.
* In the **Role** tab, search for and select `Storage Blob Data Reader`**.** Click `Next`.
* In the **Members** tab, enter the following:
  * Assign access to: **User, group, or service principal**
  * Members: click `+ Select members`, paste the unique email provided to you by the OneLens team (**onelens.finops+\<customername>@astuto.ai**).
* Click `Review + assign`.

{% endstep %}

{% step %}

### **Update storage account network default action**

Using the Azure CLI, run the following command to set the storage account’s network default action:

```bash
az storage account update \\
  --name onelens-<customername>-billing \\
  --resource-group onelens-rg \\
  --default-action Allow
```

This command updates the storage account’s network rules so that requests which do not match any explicit network rule are **allowed** (instead of denied). It controls **network access behavior**, not authentication.

{% hint style="info" %}
Public or network-level access being permitted by `--default-action Allow` **does not bypass RBAC**. Entities still require valid credentials, role assignments or SAS to read/write data.
{% endhint %}

{% endstep %}

{% step %}

### Enable cost analysis for AKS (Kubernetes) clusters

{% hint style="info" %}
User enabling cost analysis should have **Owner** or atleast **Contributor** role on the resource groups containing the AKS clusters being onboarded.

Make sure the following resource providers are enabled on the subscriptions in which the AKS clusters being onboarded are present:

1. Microsoft.ContainerService
2. Microsoft.Insights
3. Microsoft.OperationalInsights
   {% endhint %}

#### Enabling Cost Analysis on Multiple Cluster Together

For enabling cost analysis on multiple clusters within a resource group, run the following command using Azure CLI:

{% code overflow="wrap" %}

```powershell
for cluster in $(az aks list -g <resourceGroup> --query "[].name" -o tsv); do
  az aks update --resource-group <resourceGroup> --name $cluster --enable-cost-analysis
done
```

{% endcode %}

where, **\<resourceGroup>** is to be replaced with the name of the resource group in which your AKS cluster is.

#### Enabling Cost Analysis on Single Cluster

For enabling cost analysis on a single cluster, run the following command using Azure CLI:

{% code overflow="wrap" %}

```sh
az aks update --resource-group <resourceGroup> --name <clusterName> --enable-cost-analysis
```

{% endcode %}

where, **\<resourceGroup>** is to be replaced with the name of the resource group in which your AKS cluster is, and **\<clusterName>** is to be replaced with the name of your AKS cluster.

{% hint style="info" %}

AKS cost analysis can only be enabled for clusters on **Standard** or **Premium** pricing tiers. It is not available on the Free tier.

You can check an AKS cluster’s tier with the below command (using Azure CLI):

{% code overflow="wrap" %}

```sh
az aks show --resource-group <resourceGroup> --name <clusterName> --query "sku.tier"
```

{% endcode %}
{% endhint %}

{% endstep %}

{% step %}

### Enable Tag Inheritance

Tags are widely used to group costs to align with different business units, engineering environments, cost departments, and so on. Tags provide the visibility needed for businesses to manage and allocate costs across the different groups. When Tag inheritance is enabled, it applies billing, resource group, and subscription tags to child resource usage records.

Follow the below guide from Microsoft to enable Tag inheritance for MCA/MOSP/EA accounts at billing account or subscription-level

{% embed url="<https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/enable-tag-inheritance>" %}
{% endstep %}
{% endstepper %}

{% hint style="success" %}
**You have now&#x20;**<mark style="color:$success;">**successfully**</mark>**&#x20;integrated your Azure environment with OneLens.**

\
**Please share the following values to the OneLens team to facilitate the connection on our end:**

* *App Registration Tenant (Directory) ID*
* *App Registration Client (Application) ID*
* *App Registration Client Secret Value*
* *App Registration Client Secret ID*
* *Storage Account name*
* *Container name*
* *Subscription ID(s) / Resource Group ID(s) / Management Group ID(s)*
  {% endhint %}


# At Resource Group

Customers who wish to integrate OneLens just with single or multiple resource groups their account can follow the below guide for integration.

{% hint style="info" %}
User performing the integration should have **Owner** role on the **resource groups** being integrated.

Make sure the following resource providers are enabled on the subscriptions in the management groups being onboarded:

1. Microsoft.CostManagementExports
2. Microsoft.CostManagement
3. Microsoft.Billing
4. Microsoft.Storage&#x20;
   {% endhint %}

To begin using OneLens, you need to connect your Azure account by creating an App Registration (Service Principal) and assigning the required permissions for FinOps assessment.

The following guide allows to onboard one (or more) resource groups to OneLens.

3 types of Azure billing accounts are currently supported:

* *Microsoft Online Services Program / Pay-as-you-go (MOSP),*
* *Microsoft Customer Agreement (MCA) and*
* *Microsoft Enterprise Agreement (EA).*

Only the IAM permissions tied to the App Registration slightly differ according to the type of billing setup you have. To integrate, follow the below steps:<br>

{% stepper %}
{% step %}

### Create a new App Registration (Service Principal)

* From the home page of the Azure portal, search for and open `Microsoft Entra ID`.
* In the left navigation menu, under `Manage`, select `App registrations`.
* Click `+ New Registration`<br>

  <figure><img src="/files/R1zOZu3vC1Po7VK5G85p" alt=""><figcaption></figcaption></figure>
* In the open Register an application page, under **Name**, enter “*onelens-sa*”.
* All other settings can be left as default (as below).

  <figure><img src="/files/vMPesjT9baW7CsjScKR9" alt="" width="563"><figcaption></figcaption></figure>
* Click `Register`\
  &#x20;
* The App Registration details should now be displayed.<br>

  <figure><img src="/files/gurK6X5CKLCxMZLK8l25" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="success" %}
**Copy the Application `Client ID` and `Directory (tenant) ID` values to a safe location. You will need these values later.**
{% endhint %}

{% endstep %}

{% step %}

### Generate a Client Secret

* In the **App registration** page, in the left navigation menu under **Manage**, click `Certificates & secrets`.
* Under the **Client secrets** tab, click `+ New client secret`.<br>

  <figure><img src="/files/m8taNwovRJ3KkSBKdwjQ" alt="" width="563"><figcaption></figcaption></figure>
* The **Add a client secret** window is opened. For description, enter the value “*onelens-secret*”.<br>

  <figure><img src="/files/OUhs2IL9WJgUp2TThk8G" alt="" width="563"><figcaption></figcaption></figure>
* Click `Add`.
* The newly created secret is now displayed.

<figure><img src="/files/JaggF9GRuhhs3VsocoGD" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="danger" %}
**Copy the secret’s `Value` and `ID` to a safe location. You will need these values later.**
{% endhint %}

{% endstep %}

{% step %}

### Assign billing permissions to the App Registration

#### For MCA/MOSP/PayGo accounts:

* From the Azure homepage, go to `Cost Management + Billing` and select your `Billing Scope`.

  <figure><img src="/files/fn2PtiWUDE4mTe5a1Ycd" alt="" width="563"><figcaption></figcaption></figure>
* From the left navigation menu, select `Access Control (IAM)`
* Click `+ Add`
* Under Role, select `Billing account reader`. In the Users, groups or apps section, search for and add the **App registration** created earlier (“*onelens-sa*”).<br>

  <figure><img src="/files/OM6AmhPHtBDwWvchvNUU" alt="" width="295"><figcaption></figcaption></figure>
* Click `Add`.

#### For EA accounts:

* From the Azure homepage, search for go to `Resource groups`. Select your resource group to be integrated.
* From the left navigation menu, select `Access Control (IAM)`.
* Click `+ Add`, and select `Add role assignment`.
* In the opened Add role assignment screen, under `Job function roles`, search for and select `Billing reader`.

  <figure><img src="/files/931SzIaWkDLln7iPspCD" alt="" width="563"><figcaption></figcaption></figure>
* Click `Next`. Under **Members,** click `+ Select members`, and select the `App registration` created earlier ("*onelens-sa*")

  <figure><img src="/files/Zf1rQo8SJ7B6A4rDG3jH" alt="" width="563"><figcaption></figcaption></figure>
* Click `Review + assign`

{% endstep %}

{% step %}

### Create a storage account and enable exports

* From the Azure homepage, search for and open `Storage accounts`.
* Click `+ Create`. The **Create a storage account** window is opened.
* Under the **Basics** tab, add the following values:
  * **Subscription**: Select a subscription in the management group being onboarded.
  * **Resource group**: Create a new resource group with the name as `onelens-rg`.
  * **Storage account name**: Enter a globally unique, lowercase name like `onelens-<customername>-billing`.
  * **Region**: Choose your desired Azure region e.g. **(Asia Pacific) South India**.
  * **Performance**: **Standard**
  * **Redundancy**: Select **Locally-redundant storage (LRS)**.
  * Click **Next**.<br>

    <figure><img src="/files/HdqhrgwoPEgfBsMND0rX" alt="" width="563"><figcaption></figcaption></figure>
* Under the `Advanced` tab, configure the following:
  * Set **Default to Microsoft Entra authorization in the Azure portal** to Enabled

    <figure><img src="/files/MH1L9jJupgd3cgrhPQ9h" alt="" width="563"><figcaption></figcaption></figure>
* All other options can be left in their default state.
* Click `Review + Create`. Wait for the deployment to complete.
* Once created, open the newly created storage account.
* In the left navigation pane, under `Data Storage`, select **Containers**.<br>

  <figure><img src="/files/thTI0DwjuenSwoFB4BOD" alt="" width="563"><figcaption></figcaption></figure>
* Click on `+ Add Container`, and add the following values:
  * Under **Name**, enter the value `onelens-cost-usage-reports`**.**
  * Leave the **Anonymous access level** option as default: **Private (no anonymous access)**.<br>

    <figure><img src="/files/QDpWN00QNKaUv2mGOaOW" alt="" width="326"><figcaption></figcaption></figure>
* Click `Create`.
* Using the Azure Portal search bar, search for an open `Cost Management + Billing`**.**
* In the left navigation pane, under `Settings`, select `Exports`.
* Change the Scope (under Create) to your **subscription** to be integrated<br>

  <figure><img src="/files/IPMc9iOthTCj6fhcJPNE" alt="" width="563"><figcaption></figcaption></figure>
* Click `+ Create`.<br>

  <figure><img src="/files/MypehJqjqiByNoed9VKL" alt="" width="563"><figcaption></figcaption></figure>
* In the opened **New export** window, under the **Basics** tab, select **Cost and usage (actual + amortized)**.<br>

  <figure><img src="/files/mJnSUNbwdcwjOxaO4dFs" alt="" width="563"><figcaption></figcaption></figure>
* Under the **Datasets** tab, in the **Export prefix** field, enter the value: **onelens.**
* In the **Datasets** tab, now two exports should be visible:
  * onelens-actual-cost
  * onelens-amortized-cost<br>

    <figure><img src="/files/cT4h3NsplWQul9TGIMxG" alt="" width="563"><figcaption></figcaption></figure>
* Click `Next`.
* Under the `Destination` tab, enter the following values:
  * **Storage type:** **Azure blob storage**
  * **Destination and storage**: **Use existing**
  * **Subscription:** Select the **subscription** containing the new storage account.
  * **Storage account:** Select the storage account created earlier (**onelens-\<customername>-billing**).
  * **Container:** Enter the name of the container created earlier (**onelens-cost-usage-reports**).
  * **Directory:** Enter a new directory name like **reports**.
  * **Format:** **Parquet**
  * **Compression type:** **Snappy** (default)
  * **File partitioning:** **enabled** (default)
  * **Overwrite data:** **enabled** (default)<br>

    <figure><img src="/files/8Cw4cQkACwhPejmZBvGh" alt="" width="563"><figcaption></figcaption></figure>
* Click `Review + Create`. The first set of exports should run within \~24 hours.

{% endstep %}

{% step %}

### Assign Azure RBAC roles to the App Registration

* From the Azure homepage, search for and open `Resource groups`.
* Select your **Resource Group** to be integrated.
* From the left navigation menu, select `Access Control (IAM)`.
* Click `+ Add` and select `Add role assignment`.
* In the opened `Add a role assignment` window, under the **Job function roles** tab, search for and select `Reader`. Click `Next`.<br>

  <figure><img src="/files/KMvrpMQQqoqgwZNnLjdY" alt="" width="563"><figcaption></figcaption></figure>
* Under the **Members** tab, click `+ Select members` and select the App registration created earlier (*"onelens-sa"*).<br>

  <figure><img src="/files/hxTDqCEJPUD6u8ftVlBN" alt="" width="563"><figcaption></figcaption></figure>
* Click `Review + assign`.
* Similarly, add `Cost Management Reader` role.
* All the above steps must be repeated for each resource group to be onboarded.
* Using the Azure search bar on the top, search for and select `Storage Accounts`.
* Navigate to the **storage account** created in step 4.
* In the left navigation pane, select `Access Control (IAM)`.
* Click `+ Add` and select `Add role assignment`.
* In the `Role` tab, search for and select `Storage Blob Data Reader`. Click `Next`.<br>

  <figure><img src="/files/sqqtcerf18jTyFXd2IdJ" alt="" width="563"><figcaption></figcaption></figure>
* In the `Members` tab, enter the following:
  * Assign access to: **User, group, or service principal**
  * Members: click `+ Select members`, search for and select the App registration created earlier ("onelens-sa").<br>

    <figure><img src="/files/AuOJ0y6I7qes46asGDbD" alt="" width="563"><figcaption></figcaption></figure>
* Click `Review + assign`.

{% endstep %}

{% step %}

### Assign Azure RBAC roles to external user

* Login to the homepage of the Azure Portal, search for and open `Microsoft Entra ID`.
* In the left navigation menu, select `Access Control (IAM).`
* Click `+ Add` > **User** > **Invite external user**.<br>

  <figure><img src="/files/auzozT0uWvQdFwqu6HuJ" alt="" width="563"><figcaption></figcaption></figure>
* In the opened Invite external user window, enter the following details:
  * **Email**: paste the unique email provided to you by the OneLens team (**onelens.finops+\<customername>@astuto.ai**)
  * **Display Name**: enter the value **OneLens External Reader.**
  * Other options can be left as default.
  * Click `Review + invite`.<br>

    <figure><img src="/files/qGYcfBhklyITyvAbDDXK" alt="" width="563"><figcaption></figcaption></figure>
* From the Azure homepage, search for and open `Resource groups`.
* Select your **resource group** to be integrated.
* From the left navigation menu, select `Access Control (IAM)`.
* Click `+ Add` and select `Add role assignment`.
* In the opened **Add a role assignment** window, under the **Job function roles** tab, search for and select `Reader`. Click `Next`.<br>

  <figure><img src="/files/es83uDSQnN4PW6Ac4grG" alt="" width="563"><figcaption></figcaption></figure>
* Under the **Members** tab, click `+ Select members`, paste the unique email provided to you by the OneLens team (**onelens.finops+\<customername>@astuto.ai**).
* Click `Review + assign`.
* Similarly, add `Cost Management Reader` role.
* The above steps must be repeated for each **resource group** to be onboarded.
* Using the Azure search bar on the top, search for and select `Storage Accounts`.
* Navigate to the storage account created in step 4.
* In the left navigation pane, select `Access Control (IAM)`.
* Click `+ Add` and select `Add role assignment`.
* In the **Role** tab, search for and select `Storage Blob Data Reader`**.** Click `Next`.
* In the **Members** tab, enter the following:
  * Assign access to: **User, group, or service principal**
  * Members: click `+ Select members`, paste the unique email provided to you by the OneLens team (**onelens.finops+\<customername>@astuto.ai**).
* Click `Review + assign`.

{% endstep %}

{% step %}

### **Update storage account network default action**

Using the Azure CLI, run the following command to set the storage account’s network default action:

```bash
az storage account update \\
  --name onelens-<customername>-billing \\
  --resource-group onelens-rg \\
  --default-action Allow
```

This command updates the storage account’s network rules so that requests which do not match any explicit network rule are **allowed** (instead of denied). It controls **network access behavior**, not authentication.

{% hint style="info" %}
Public or network-level access being permitted by `--default-action Allow` **does not bypass RBAC**. Entities still require valid credentials, role assignments or SAS to read/write data.
{% endhint %}

{% endstep %}

{% step %}

### Enable cost analysis for AKS (Kubernetes) clusters

{% hint style="info" %}
User enabling cost analysis should have **Owner** or atleast **Contributor** role on the resource groups containing the AKS clusters being onboarded.

Make sure the following resource providers are enabled on the subscriptions in which the AKS clusters being onboarded are present:

1. Microsoft.ContainerService
2. Microsoft.Insights
3. Microsoft.OperationalInsights
   {% endhint %}

#### Enabling Cost Analysis on Multiple Cluster Together

For enabling cost analysis on multiple clusters within a resource group, run the following command using Azure CLI:

{% code overflow="wrap" %}

```powershell
for cluster in $(az aks list -g <resourceGroup> --query "[].name" -o tsv); do
  az aks update --resource-group <resourceGroup> --name $cluster --enable-cost-analysis
done
```

{% endcode %}

where, **\<resourceGroup>** is to be replaced with the name of the resource group in which your AKS cluster is.

#### Enabling Cost Analysis on Single Cluster

For enabling cost analysis on a single cluster, run the following command using Azure CLI:

{% code overflow="wrap" %}

```sh
az aks update --resource-group <resourceGroup> --name <clusterName> --enable-cost-analysis
```

{% endcode %}

where, **\<resourceGroup>** is to be replaced with the name of the resource group in which your AKS cluster is, and **\<clusterName>** is to be replaced with the name of your AKS cluster.

{% hint style="info" %}

AKS cost analysis can only be enabled for clusters on **Standard** or **Premium** pricing tiers. It is not available on the Free tier.

You can check an AKS cluster’s tier with the below command (using Azure CLI):

{% code overflow="wrap" %}

```sh
az aks show --resource-group <resourceGroup> --name <clusterName> --query "sku.tier"
```

{% endcode %}
{% endhint %}

{% endstep %}

{% step %}

### Enable Tag Inheritance

Tags are widely used to group costs to align with different business units, engineering environments, cost departments, and so on. Tags provide the visibility needed for businesses to manage and allocate costs across the different groups. When Tag inheritance is enabled, it applies billing, resource group, and subscription tags to child resource usage records.

Follow the below guide from Microsoft to enable Tag inheritance for MCA/MOSP/EA accounts at billing account or subscription-level

{% embed url="<https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/enable-tag-inheritance>" %}
{% endstep %}
{% endstepper %}

{% hint style="success" %}
**You have now&#x20;**<mark style="color:$success;">**successfully**</mark>**&#x20;integrated your Azure environment with OneLens.**

\
**Please share the following values to the OneLens team to facilitate the connection on our end:**

* *App Registration Tenant (Directory) ID*
* *App Registration Client (Application) ID*
* *App Registration Client Secret Value*
* *App Registration Client Secret ID*
* *Storage Account name*
* *Container name*
* *Subscription ID(s) / Resource Group ID(s) / Management Group ID(s)*
  {% endhint %}


# Frequently Asked Questions (FAQ)

Answers to common questions regarding the architecture, security, and implementation of the OneLens Azure integration.

## What Azure scopes do you support for onboarding?

We support onboarding at the **Management Group**, **Subscription**, and **Resource Group** levels.

* **Documentation:** Please select the specific onboarding guide for your chosen scope (Management Group, Subscription, or Resource Group) available in this documentation section, as the RBAC inheritance and specific steps vary slightly for each.
* **Recommendation:** For organizations with multiple subscriptions, we strongly recommend the Management Group level to centralize exports and simplify permission management.

## What is the high-level architecture of this integration?

The integration follows a **passive, read-only architecture** using Azure Cost Management Exports.

* **Data Flow:** Azure writes billing data (Parquet format) to a Storage Account in your tenant. OneLens ingests this data securely.
* **Resource Impact:** *Zero*. The integration operates asynchronously on billing data and does not touch your production compute or databases.

## What specific permissions does OneLens require?

We adhere to **Least Privilege**. We do not require `Contributor` or `Owner` access for the integration at any scope.

<table><thead><tr><th width="163">IAM Role</th><th width="177">Scope</th><th width="163">Assignee</th><th width="206">Purpose</th></tr></thead><tbody><tr><td>Reader</td><td><em><strong>*</strong>Target scope</em></td><td>App Registration, External User</td><td>Read resources metadata.</td></tr><tr><td>Cost Management Reader</td><td><em><strong>*</strong>Target scope</em></td><td>App Registration, External User</td><td>Read cost analysis data.</td></tr><tr><td>Billing Reader</td><td>Management Group or Subscription</td><td>App Registration</td><td>Read invoice and billing data (for EA)</td></tr><tr><td>Billing Account Reader</td><td>Billing account</td><td>App Registration</td><td>Read billing data (for MCA/MOSP)</td></tr><tr><td>Storage Blob Data Reader </td><td>Storage account</td><td>App Registration, External User</td><td>Read exported cost report data.</td></tr></tbody></table>

## Can we use a Managed Identity instead of a App Registration?

Currently, the integration requires an **App Registration with a Client Secret** because the OneLens platform resides outside your Azure Tenant (multi-tenant SaaS).

* **Security Note:** Managed Identities are typically restricted to Azure-to-Azure resources within the same tenant. For cross-tenant access, an App Registration is the standard secure pattern, recommended by Microsoft. We set a safe rotation policy for the Client Secret (every 90 days).

## What if we have a third-party billing partner (CSP) and do not have the `Billing Account Owner` role?

If you purchase Azure through a CSP or MSP, you likely do not have permissions at the Billing Account scope.

* **Action:** You can ask your billing partner to assign your user the `Billing Account Owner` role, to perform the integration. Or, the billing partner can directly assign the `Billing Account Viewer` roles to our App Registration and External User at the decided scope.

## With the **Reader** role, are you able to access sensitive data?

**No.** The Reader role is strictly a **Control Plane** permission.

* **What it allows:** Viewing resource metadata (e.g., *"There is a VM named 'production-db' with 4 vCPUs"*). This is essential for us to map costs to specific resources and generate rightsizing recommendations.
* **What it does NOT allow:** It does not grant access to the **Data Plane**. We **cannot** read the files inside your Storage Accounts (except the specific billing container), we **cannot** view rows in your SQL databases, and we **cannot** access secrets in your Key Vaults.

## Why do we need to invite an external user?

The external user (***<onelens.finops@astuto.ai>**) allows ou*r support and engineering team to debug ingestion issues and validate configuration without requiring shared credentials. This user is assigned strictly read-only roles (`Reader`, `Cost Management Reader`, `Storage Blob Data Reader`).

## Does the "Allow" network rule on the Storage Account expose our data?

**No.** The command `az storage account update --default-action Allow` permits network connectivity **but does not bypass authentication**.

* **Security Layer:** Access is still strictly controlled via RBAC (Identity). Only entities with the `Storage Blob Data Reader` role (like our App Registration) can read the data. Anonymous access is explicitly disabled on the container.

## Why is "Overwrite data" enabled in the cost export?

Azure Cost Management data is cumulative for the current month and can change daily (due to reservation applications or late-arriving usage).

* **Reason:** Enabling "Overwrite" ensures that the daily export updates the existing file for the current month (e.g., 2023-10-01\_2023-10-31) rather than creating dozens of fragmented files (e.g., \_v1, \_v2) for the same period.
* **Benefit:** This ensures data consistency, prevents duplicate processing, and significantly reduces storage costs in your account.

## Why are we creating two exports (actual and amortized)?

* **Actual Cost:** Reconciles with your invoice.
* **Amortized Cost:** Smooths out Reservation (RI) and Savings Plan purchases to show daily effective burn rates.
* **OneLens Requirement:** We require the combined dataset Cost and usage (actual + amortized) to provide accurate recommendations.

## Which Resource Providers must be registered before starting the integration?

Before starting, ensure the following are registered on the target subscriptions:

1. `Microsoft.CostManagementExports`
2. `Microsoft.CostManagement`
3. `Microsoft.Billing`
4. `Microsoft.Storage`
5. `Microsoft.ContainerService` (if onboarding AKS)
6. `Microsoft.Insights` (if onboarding AKS)

## How do we handle Kubernetes (AKS) cost visibility?

Azure does not break down AKS costs by default. You must enable **Cost Analysis** on your clusters.

* **Requirement:** Clusters must be on Standard or Premium tier (Free tier is not supported).
* **Command:**\
  `az aks update --resource-group <rg_name> --name <cluster_name> --enable-cost-analysis`
* **Bulk Enable:** We provide a loop script to enable this for **all clusters** in a resource group. You can find the same in the relevant section in the documentation.

## How are tags handled?

We rely on Azure's **Tag Inheritance** to ensure costs are properly attributed. You should **enable Tag Inheritance** at the Billing Account or Subscription level so that resource group tags automatically flow down to the child resources and usage records.

## How do we rotate credentials for the App Registration?

1. Generate a new Client Secret in the `onelens-sa` App Registration.
2. Share the new Client Secret ID and Value to the OneLens integration team over a secure encrypted channel like email.
3. Delete the old secret `onelens-secret` from Azure.

Our team will reach out to you for routine secret rotation as well as in the scenario of secret exposure.

## What is the cost incurred for this setup?

The below analysis provides approximate costs for the setup in **South India** region.

<table data-full-width="false"><thead><tr><th>Component</th><th width="150">$5K/month spend</th><th width="159">$50K/month spend</th><th width="169.5">$500K/month spend</th><th width="158">$5M/month spend</th></tr></thead><tbody><tr><td>Storage</td><td>~$0.01</td><td>~$0.06</td><td>~$0.65</td><td>~$6.50</td></tr><tr><td>Write Operations</td><td>~$0.01</td><td>~$0.05</td><td>~$0.50</td><td>~$5.00</td></tr><tr><td>Read Operations</td><td>~$0.01</td><td>~$0.01</td><td>~$0.10</td><td>~$1.00</td></tr><tr><td>Cost Management Export</td><td>Free</td><td>Free</td><td>Free</td><td>Free</td></tr><tr><td>Total cost per month</td><td><strong>~$0.03</strong></td><td><strong>~$0.12</strong></td><td><strong>~$1.25</strong></td><td><strong>~$12.50</strong></td></tr></tbody></table>

Rates and references:

<table data-full-width="false"><thead><tr><th>Metric</th><th width="260">South India Region Rate (in USD)</th><th width="195">Reference</th></tr></thead><tbody><tr><td>Standard Hot LRS Capacity</td><td>$0.019 per GB/month</td><td><a href="https://azure.microsoft.com/pricing/details/storage/blobs/">Azure Blob pricing</a></td></tr><tr><td>Write Operations</td><td>$0.05 per 10,000</td><td><a href="https://azure.microsoft.com/pricing/details/storage/blobs/">Azure Blob pricing</a></td></tr><tr><td>Read Operations</td><td>$0.004 per 10,000</td><td><a href="https://azure.microsoft.com/pricing/details/storage/blobs/">Azure Blob pricing</a></td></tr><tr><td>Cost Management Export</td><td>$0.00 (Free service)</td><td><a href="https://azure.microsoft.com/en-us/pricing/details/cost-management/">Cost Management pricing</a></td></tr><tr><td>Intra-region transfer</td><td>$0.00</td><td>Free, since regions are South India.</td></tr></tbody></table>


# Connecting to GCP

At a high-level, OneLens uses a **Service Account** created in your environment with the appropriate **read-only IAM roles** for resource visibility and cost/usage metrics. An **External User** is also created with similar IAM roles in your environment to enable our FinOps experts to manually analyze and identify potential savings.

{% hint style="info" %}
For a full list of IAM roles provisioned to the Service Account and External User, please refer to the [IAM roles](/integrations/cloud-and-cost-sources/connecting-to-gcp/frequently-asked-questions-faq#what-specific-permissions-does-onelens-require) section.
{% endhint %}

{% hint style="warning" %}
The IAM roles created are limited in scope and grant only the permissions required for OneLens to function. No modifications are made to your infrastructure. Access is **read-only** and fully **reversible** - you may delete the individual roles or the App Registration/External User at any time to revoke access. OneLens does not collect or alter any data outside the defined access permissions.
{% endhint %}

### Architecture

Below is the architecture on our end to support ingestion and analysis of your Google Cloud data:

<figure><img src="/files/Y0A5OLclQi2zxq0CtIEY" alt=""><figcaption></figcaption></figure>

### Integration flow

Below is a step-by-step flow of the integration process for your Google Cloud environment:

{% columns %}
{% column %}

{% endcolumn %}

{% column %}
{% @mermaid/diagram content="flowchart TD
A\["1. Select/Create Project & Service Account<br/><i>(Validates existing or creates new)</i>"]
\--> B\["2. Create BigQuery Dataset<br/><i>('billing\_export' for cost data)</i>"]
\--> C\["3. Enable APIs & Link Billing<br/><i>(On Billing & Target Projects)</i>"]
\--> D\["4. Assign IAM Roles<br/><i>(BigQuery, Viewer, & Billing roles)</i>"]
\--> E\["5. Configure Daily Cost Exports<br/><i>(Manual Step in Console)</i>"]

" fullWidth="false" %}

{% endcolumn %}

{% column %}

{% endcolumn %}
{% endcolumns %}

### Components created in your environment

* **Identity:**
  * Service Account
  * External user
* **Project:**
  * Billing project *(if opted to create new)*
* **Dataset:**
  * BigQuery dataset
* **Billing export**
  * Detailed Usage Cost export

### IAM roles

| IAM Role                        | Scope            | Assignee                       | Purpose                                            |
| ------------------------------- | ---------------- | ------------------------------ | -------------------------------------------------- |
| Organization Viewer             | Organization     | Service Account, External user | Read organization hierarchy.                       |
| Billing Viewer                  | Billing account  | Service Account, External user | Read billing account metadata.                     |
| BigQuery Data Viewer            | Billing project  | Service Account, External user | Read data from BigQuery export dataset.            |
| BigQuery Job User               | Billing project  | Service Account, External user | Run queries on the billing data.                   |
| **\***&#x53;ervice Viewer roles | \*\*Target scope | Service Account                | Read metadata for services like Compute, GKE, etc. |
| Viewer                          | \*\*Target scope | External user                  | Read-only access to console.                       |

**\****Service Viewer roles include* *`roles/compute.viewer`, `roles/container.viewer`, `roles/cloudsql.viewer`, `roles/aiplatform.viewer`, etc. For a full list, please refer to the <> section.*

*\*\*Target scope can be a Project, a Folder or an Organization, as per your desired setup.*

### APIs enabled

For OneLens to be able to call the relevant GCP APIs for cost analysis, we enable the following on your project(s):

* `Vertex AI API` *(aiplatform.googleapis.com)*
* `Cloud Functions API` *(cloudfunctions.googleapis.com)*
* `Cloud SQL Admin API` *(sqladmin.googleapis.com)*
* `Compute Engine API` *(compute.googleapis.com)*
* `Kubernetes Engine API` *(container.googleapis.com)*
* `Dataflow API` *(dataflow\.googleapis.com)*
* `Cloud Dataproc API` *(dataproc.googleapis.com)*
* `Cloud Filestore API` *(file.googleapis.com)*
* `Cloud Monitoring API` *(monitoring.googleapis.com)*
* `Network Management API` *(networkmanagement.googleapis.com)*
* `Recommender API` *(recommender.googleapis.com)*
* `Google Cloud Memorystore for Redis API` *(redis.googleapis.com)*
* `Service Usage API` *(serviceusage.googleapis.com)*
* `Cloud Asset API` *(cloudasset.googleapis.com)*
* `BigQuery API` *(bigquery.googleapis.com)*

### Integration steps

OneLens supports seamless integration across all Google Cloud Platform organizational structures. You can configure the platform to monitor an entire Organization hierarchy, individual Folders or Projects.

To get started, follow the below guide to integrate your Google Cloud account with OneLens using a seamless automated setup powered by Terraform:

{% content-ref url="/pages/q7yaojn4rInIjbSXa0Xe" %}
[Automated using Terraform](/integrations/cloud-and-cost-sources/connecting-to-gcp/automated-using-terraform)
{% endcontent-ref %}

If you prefer to integrate manually using the Google Cloud console, follow the below guide:

{% content-ref url="/pages/Ea3XQCQo9SCgZYab1HAt" %}
[Manual](/integrations/cloud-and-cost-sources/connecting-to-gcp/manual)
{% endcontent-ref %}


# Automated using Terraform

{% hint style="info" %}
The user performing the integration must have the following roles assigned:

1. **Organisation Administrator** on your organisation
2. **Billing Account Administrator** on your organisation/billing account
3. **Service Usage Administrator** on your organisation<br>

**Why this is needed?**

Organisation Administrator role is used to create a new billing project and assign the organisation level roles.

Billing Account Administrator role is used to assign Billing account viewer role for the Service Account and the external user.

Service Usage Administrator role is used to check if the required APIs are enabled.
{% endhint %}

{% hint style="warning" %}
Below APIs are enabled as part of the script on your projects for OneLens to be able to read usage data on the respective services:

1. `Vertex AI API` *(aiplatform.googleapis.com)*
2. `Cloud Functions API` *(cloudfunctions.googleapis.com)*
3. `Cloud SQL Admin API` *(sqladmin.googleapis.com)*
4. `Compute Engine API` *(compute.googleapis.com)*
5. `Kubernetes Engine API` *(container.googleapis.com)*
6. `Dataflow API` *(dataflow\.googleapis.com)*
7. `Cloud Dataproc API` *(dataproc.googleapis.com)*
8. `Cloud Filestore API` *(file.googleapis.com)*
9. `Cloud Monitoring API` *(monitoring.googleapis.com)*
10. `Network Management API` *(networkmanagement.googleapis.com)*
11. `Recommender API` *(recommender.googleapis.com)*
12. `Google Cloud Memorystore for Redis API` *(redis.googleapis.com)*
13. `Service Usage API` *(serviceusage.googleapis.com)*
14. `Cloud Asset API` *(cloudasset.googleapis.com)*
15. `BigQuery API` *(bigquery.googleapis.com)*
    {% endhint %}

{% stepper %}
{% step %}

### Uploading the Terraform code

* Login to the Google Cloud Platform console.

* In the top bar, click the `Cloud Shell` button to launch Google Cloud's interactive shell.<br>

  <figure><img src="/files/H6Hm10lvP5tv2LI9InDt" alt=""><figcaption></figcaption></figure>

* In the opened pop-up window, authorize Cloud Shell to use the logged in user's credentials.<br>

  <figure><img src="/files/AVUwk95QQtXhkZ8drt5W" alt=""><figcaption></figcaption></figure>

* After your credentials are verified, you will be greeted with the opened Cloud Shell terminal.

  <figure><img src="/files/1smwMOuvEmhz4nh22nR8" alt=""><figcaption></figcaption></figure>

* Click the `3 dots` on the top right of the terminal window, and select `Upload`.

  <figure><img src="/files/kl54G251cWSRQl3OU5tu" alt=""><figcaption></figcaption></figure>

* Select the `Folder` option, and use the `Choose Folder` button to navigate to and select the **GCP Deployment Script folder** shared to you by the OneLens team.

  <figure><img src="/files/fQISE2Jpa6CkeSBoRs2w" alt=""><figcaption></figcaption></figure>

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>The Terraform script would have been shared to you in a <strong>ZIP</strong> format. Please make sure to uncompress the archive into the folder named <strong>onelens-gcp-onboarding</strong>.</p></div>

* The window displays the files that are going to be uploaded to your Cloud Shell terminal instance for your confirmation. Click `Upload`.\
  \
  For more details on what each file contains, please navigate to the Appendix section at the end of this guide.<br>

  <figure><img src="/files/5G2D1O75aEAcbGK7BOjB" alt=""><figcaption></figcaption></figure>

* Cloud Shell provides a confirmation that the files are successfully uploaded.<br>

  <figure><img src="/files/aGB4b11A4ANicWzwHVdx" alt=""><figcaption></figcaption></figure>

* Enter the following command to navigate to the folder that was uploaded:\
  \
  `cd onelens-gcp-onboarding` <br>

  <figure><img src="/files/lZTnFP1OZ4Z6rU9bbnJz" alt=""><figcaption></figcaption></figure>

* Enter the following command to make the .SH script file executable:\
  \
  `chmod +x deploy.sh`<br>

  <figure><img src="/files/kE3HAbxnRw7J7LHHJbqg" alt=""><figcaption></figcaption></figure>

* Enter the following command to run the script:\
  \
  `./deploy.sh`<br>

  <figure><img src="/files/5gHkumvqPjdZk3AL6E9l" alt=""><figcaption></figcaption></figure>

{% endstep %}

{% step %}

### Configuring your settings

* The script greets the user and proceeds to the first step of checking your permissions. The logged in user's ID is displayed for confirmation.\
  \
  As prompted, enter your Organisation ID.<br>

  <figure><img src="/files/EMAvwmBCJ3QZhaGEPj9q" alt=""><figcaption></figcaption></figure>

* Next, enter your Billing Account ID.<br>

  <figure><img src="/files/G8RxCdt8h4ZJVsGSNFCB" alt=""><figcaption></figcaption></figure>

  <div data-gb-custom-block data-tag="hint" data-style="success" class="hint hint-success"><p><strong>To find your Organisation ID:</strong></p><p>Go to <code>Organisations,</code> then <code>Organisation details</code>:</p></div>

  <figure><img src="/files/gxYpmWTLEyTO4NflSYAg" alt=""><figcaption></figcaption></figure>

  <div data-gb-custom-block data-tag="hint" data-style="success" class="hint hint-success"><p><strong>To find your Billing account ID:</strong></p><p>Search for and open <code>Account management</code>, and select your Billing account in the dropdown on the left.</p></div>

  <figure><img src="/files/ptYgVyCSK47xAlLeubYu" alt=""><figcaption></figcaption></figure>

* The script will check your permissions against the provided organisation and the billing account. It checks for the below roles and displays a confirmation if they are present:
  * `Organisation Administrator` (*roles/resourcemanager.organisationAdmin*)
  * `Billing Account Administrator` (*roles/billing.admin*)
  * `Service Usage Administrator` (*roles/serviceusage.serviceUsageAdmin*)<br>

    <figure><img src="/files/gtnSN2iqQ32tTefGf2iu" alt=""><figcaption></figcaption></figure>

* In case the required roles are not assigned, the script will prompt you to attempt to assign the `Billing Account Administrator` and `Service Usage Administrator` roles for you *automatically*.\
  \
  **Note:** `Organisation Administrator` role is required to attempt role assignment.<br>

  <figure><img src="/files/tcOoGoFivHOUl8leJPEn" alt=""><figcaption></figcaption></figure>

* On proceeding, the script will prompt you for your `company name`, to be entered in small characters. This is used to optionally create a unique billing project name.<br>

  <figure><img src="/files/1gybMBOzrdmXdX6ddrb4" alt=""><figcaption></figcaption></figure>

* Previously provided **Organisation ID** and the **Billing Account ID** values are displayed to be used. The script prompts you to enter the `External User email ID`. On pressing enter, the **default value** `onelens.finops@astuto.ai` is used. \
  \
  **Note:** If another value is provided to you by the OneLens team during onboarding, please enter the same.<br>

  <figure><img src="/files/M7ogknXxyizrfn4KLEfK" alt=""><figcaption></figcaption></figure>

* Similarly, the script prompts you to enter the name of the Service Account ID to be created. On pressing enter, the **default value** `onelens-reader-sa` is used.\
  \
  **Note:** If another value is provided to you by the OneLens team during onboarding, please enter the same.<br>

  <figure><img src="/files/lj6vv7U6Kzu3XlHrx8qo" alt=""><figcaption></figcaption></figure>

* The next step involves configuring the Billing project:
  * If you have an existing project set up to host Billing data through BigQuery, you can enter the full ID of the project.<br>

    <div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p>It is recommended to create a new project to ensure your existing resource hierarchy is unaffected by resources created by OneLens. Please check the next step on how to use the script to do so.</p></div>

    <figure><img src="/files/U5ahaKIkeQjzFTNt4Q1Y" alt=""><figcaption></figcaption></figure>

  * **Recommended:** If you want to create a new BigQuery project and dataset to export your billing data to, then press enter without entering a value. You can press enter again to use the default generated name.<br>

    <figure><img src="/files/BVymvIfatA7exnM5PtAb" alt=""><figcaption></figcaption></figure>

* In the next step, you can choose to onboard folders or projects:
  * **Folders**\
    Onboard all projects in a folder by providing a folder ID. You can provide multiple folder IDs if needed.<br>

    <figure><img src="/files/2ChGoC3fac8LnfFnEUwR" alt=""><figcaption></figcaption></figure>

    \
    When prompted to enter projects, you can provide any project that is not in the provided folder(s) to be added. If no additional projects are to be onboarded, simply press enter without entering a value.\
    \
    A summary will be displayed of all entered values.<br>

    <figure><img src="/files/MaDSNPrWOjg8NzctDCgw" alt=""><figcaption></figcaption></figure>

  * **Projects**\
    Onboard one or multiple projects.\
    \
    When prompted to enter folders, simply press enter without entering a value. The script will then prompt you to enter project IDs.<br>

    <figure><img src="/files/4ElnSrFqwIUpuctrP2td" alt=""><figcaption></figcaption></figure>

    \
    A summary will be displayed of all entered values.<br>

    <figure><img src="/files/IYb2HpQd3Sy9vRWtP2Lu" alt=""><figcaption></figcaption></figure>

* On proceeding, the script runs the `terraform init` and `terraform plan` commands. Then, a summary of the resources to be created is displayed for your reference.<br>

  <figure><img src="/files/wVRobpgxvcLmeDmFu5cB" alt=""><figcaption></figcaption></figure>

* Type **yes** and hit enter to apply the Terraform plan. This runs the `terraform apply` command.<br>

  <figure><img src="/files/yRw8jEQPF0WC0DHlEBma" alt=""><figcaption></figcaption></figure>

{% endstep %}

{% step %}

### Completing the onboarding

Wait **\~2 minutes** for the script to finish enabling the required APIs, create the billing export project and assign the required roles on selected resources.

<figure><img src="/files/O9t09cHQYTF2x4ZnUC3q" alt=""><figcaption></figcaption></figure>

\
\
After successfully completing, the script will display a <mark style="color:$success;">**confirmation**</mark> and the following values:

* New `billing project ID`
* New `service account email`
* New `BigQuery dataset ID`

{% hint style="success" %}
**You have now&#x20;**<mark style="color:$success;">**successfully**</mark>**&#x20;integrated your Google Cloud Platform environment with OneLens.**

\
**Please share the following values to the OneLens team to facilitate the connection on our end:**

* *Billing project ID*
* *Service Account email ID*
* *BigQuery dataset ID*
  {% endhint %}

{% endstep %}

{% step %}

### Appendix

In the below section, an overview of what the code does and what each files contain is provided at a high-level:<br>

* **deploy.sh (Bash script)**
  * This is a user-facing shell wrapper script that orchestrates the entire deployment.
  * It interactively prompts the user for required inputs, performs gcloud permission pre-checks, auto-generates the `terraform.tfvars` file, and then executes the `terraform init`, `plan`, and `apply` commands in sequence.<br>
* **`main.tf` (Terraform Configuration)**
  * This is the core file containing the declarative infrastructure-as-code (IaC) logic.

  * *Core Logic*
    * **Project:** Creates a new GCP project *or* uses/validates `var.existing_billing_export_project_id` if provided. All subsequent resources depend on this project being available.

  * *Billing Export Project & Config*
    * `google_project.billing_export`: Creates a new project if `var.existing_billing_export_project_id` is empty.
    * &#x20;`data.external.check_existing_billing_project`: Validates an existing project's accessibility.
    * `google_project_service.billing_export_apis`: Enables `serviceusage`, `cloudresourcemanager`, `billingbudgets`, `bigquery`, `cloudbilling`, and `cloudasset` APIs on the billing project.
    * `google_bigquery_dataset.billing_export_dataset`: Creates the `billing_export` dataset (in `US`) if it doesn't exist.
    * `data.external.check_billing_export_dataset`: Checks if `billing_export` dataset already exists.
    * `null_resource.configure_*_export`: Logs instructions to manually configure billing exports. **No exports are automated.**

  * *FinOps Service Account (SA)*
    * `google_service_account.finops_sa`: Creates the FinOps SA (from `var.finops_service_account_id`) in the billing project if it doesn't exist.
    * `data.external.check_existing_finops_sa`: Checks if the FinOps SA already exists.<br>

  * *Target Project Onboarding*
    * `data.google_projects.*`: Discovers all target projects (from `var.target_project_ids`, `var.target_folder_ids`, or entire Org if both are empty).
    * `null_resource.enable_billing_on_projects`: Links all target projects to `var.billing_account_id` if not already billed.
    * `google_project_service.target_project_apis_*`: Enables required APIs on all target projects.

      * **Billing Required APIs:** `compute.googleapis.com`, `container.googleapis.com`, `dataflow.googleapis.com`, `dataproc.googleapis.com`, `file.googleapis.com`, `redis.googleapis.com`
      * **No-Billing APIs:** `aiplatform.googleapis.com`, `cloudfunctions.googleapis.com`, `sqladmin.googleapis.com`, `monitoring.googleapis.com`, `networkmanagement.googleapis.com`, `recommender.googleapis.com`, `serviceusage.googleapis.com`, `cloudasset.googleapis.com`, `bigquery.googleapis.com`

  * *IAM Bindings: FinOps SA* (`serviceAccount:${local.finops_sa_email}`)
    * **Scope: Organization**
      * `roles/resourcemanager.organizationViewer`
      * `roles/cloudasset.viewer`
      * `roles/browser`
    * **Scope: Billing Account**
      * `roles/billing.viewer`
    * **Scope: Billing Export Project**
      * `roles/bigquery.dataViewer`
      * `roles/bigquery.metadataViewer`
      * &#x20;`roles/bigquery.jobUser`
      * `roles/bigquery.readSessionUser`
    * **Scope: All Target Projects & Folders**
      * `roles/aiplatform.viewer`
      * `roles/cloudfunctions.viewer`
      * `roles/cloudsql.viewer`
      * `roles/compute.viewer`
      * `roles/container.viewer`
      * `roles/dataflow.viewer`
      * `roles/dataproc.viewer`
      * `roles/file.viewer`
      * `roles/monitoring.viewer`
      * `roles/networkmanagement.viewer`
      * `roles/recommender.viewer`
      * `roles/redis.viewer`
      * `roles/serviceusage.serviceUsageViewer`
      * `roles/bigquery.metadataViewer`
      * `roles/bigquery.jobUser`
      * `roles/bigquery.resourceViewer`

  * *IAM Bindings: OneLens Backend SA* (`serviceAccount:onelens-customer-sa@astuto-prod-mum.iam.gserviceaccount.com`)
    * **Scope: FinOps SA**
      * `roles/iam.serviceAccountTokenCreator` (Allows platform to impersonate FinOps SA)

  * *IAM Bindings: External User* (`user:${var.external_user_email}`)

    * **Scope: FinOps SA**
      * `roles/iam.serviceAccountTokenCreator` (Allows user to impersonate FinOps SA)
    * **Scope: Organization**
      * `roles/resourcemanager.organizationViewer`
      * `roles/cloudasset.viewer`
      * `roles/browser`
    * **Scope: Billing Account**
      * `roles/billing.viewer`
    * **Scope: Billing Export Project**
      * `roles/bigquery.jobUser`
      * `roles/bigquery.dataViewer`
      * `roles/bigquery.metadataViewer`
    * **Scope: All Target Projects**
      * `roles/viewer`
      * `roles/bigquery.resourceViewer`
      * `roles/bigquery.metadataViewer`
      * `roles/bigquery.jobUser`
    * **Scope: All Target Folders**
      * `roles/viewer`
      * `roles/bigquery.resourceViewer`
      * `roles/bigquery.metadataViewer`
      * `roles/bigquery.jobUser`

    &#x20;
* **`provider.tf` (Terraform Configuration)**
  * This is a **mandatory** Terraform file that specifies the required providers for this configuration (e.g., `hashicorp/google`).
  * It defines provider version constraints and the basic provider configuration block, telling Terraform how to interact with the target GCP APIs.<br>
* **`variables.tf` (Terraform Configuration)**
  * This is a **mandatory** Terraform file that defines the input API for the configuration.
  * It declares all variables the module accepts (e.g., `organization_id`, `target_project_ids`), along with their types, descriptions, and default values.<br>
* **`outputs.tf` (Terraform Configuration)**
  * This is a **mandatory** Terraform file that declares values to be exported after the configuration is applied.
  * It makes key resource attributes, like the newly created `service_account_email` or `billing_project_id`, available on the command line for validation or use in other scripts.<br>
* **`terraform.tfvars` (Terraform Data)**
  * This is a **mandatory** Terraform file (or must be supplied via CLI flags) that provides the actual values for the variables defined in `variables.tf`.
  * This specific file is auto-generated by the `deploy.sh` script to separate user-specific data (like project IDs) from the resource logic in `main.tf`.
    {% endstep %}
    {% endstepper %}


# Manual

{% hint style="info" %}
The user performing the integration must have the following roles assigned:

1\. **Owner** on your projects/folders to be onboarded\
2\. **Organisation Administrator** on your organisation\
\
**Why this is needed?**\
Owner role is used to assign IAM roles to the service account & external user. Organisation Administrator role is used to create a new billing project.
{% endhint %}

{% hint style="warning" %}
Below APIs must be enabled on your projects for OneLens to be able to read usage data on the respective services:

1. `Vertex AI API` *(aiplatform.googleapis.com)*
2. `Cloud Functions API` *(cloudfunctions.googleapis.com)*
3. `Cloud SQL Admin API` *(sqladmin.googleapis.com)*
4. `Compute Engine API` *(compute.googleapis.com)*
5. `Kubernetes Engine API` *(container.googleapis.com)*
6. `Dataflow API` *(dataflow\.googleapis.com)*
7. `Cloud Dataproc API` *(dataproc.googleapis.com)*
8. `Cloud Filestore API` *(file.googleapis.com)*
9. `Cloud Monitoring API` *(monitoring.googleapis.com)*
10. `Network Management API` *(networkmanagement.googleapis.com)*
11. `Recommender API` *(recommender.googleapis.com)*
12. `Google Cloud Memorystore for Redis API` *(redis.googleapis.com)*
13. `Service Usage API` *(serviceusage.googleapis.com)*
14. `Cloud Asset API` *(cloudasset.googleapis.com)*
15. `BigQuery API` *(bigquery.googleapis.com)*

\
The above APIs must be enabled for ***each*** project to be onboarded.

For steps on how to enable APIs, please follow this link to Google’s [documentation](https://cloud.google.com/apis/docs/getting-started#enabling_apis).
{% endhint %}

{% stepper %}
{% step %}

### Create the Billing project and enable cost export

* Login to the Google Cloud Platform console.

* In the `Project Picker` menu on top, create a project with the name “*OneLens Billing Project*”.

  <figure><img src="/files/TsqD9hgtgXSicPYRnUZa" alt=""><figcaption></figcaption></figure>

* Using the `Project Picker` menu on top, open the newly created project "*OneLens Billing Project*".

* In the left menu, open `BigQuery Studio`.

* In the `BigQuery Explorer` pane, click the `3 dots` to the right of the billing project ID, and click `Create dataset`.<br>

  <figure><img src="/files/mcEyGlranfbXnOV2Qj7W" alt=""><figcaption></figcaption></figure>

* In the opened `Create dataset` menu, enter the following data:

  * Under `Dataset ID`, enter “*billing\_export*”.

  * Under `Location type`, select *Multi-region*.

  * Under `Multi-region`, select *US (multiple regions in the United States)*<br>

    <figure><img src="/files/YV8dW9h1UeQ6lvGwfGMw" alt=""><figcaption></figcaption></figure>

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>The dataset location is set to US (multiple regions in the United States) to export cost data retroactively from the start of the previous month during the initial setup.</p><p><br><a href="https://cloud.google.com/billing/docs/how-to/export-data-bigquery-tables#data-availability">https://cloud.google.com/billing/docs/how-to/export-data-bigquery-tables#data-availability</a></p></div>

  * Under `Advanced options`, make sure the `Enable table expiry` option is *unchecked*.

    <figure><img src="/files/oRattLBTytWkP6ZowtGg" alt=""><figcaption></figcaption></figure>

  * <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>By disabling the table expiry for the BigQuery dataset, we ensure that the Single Source of Truth for your cloud costs remains intact indefinitely, enabling deep historical analysis, accurate forecasting, and audit compliance.<br><br><a href="https://docs.cloud.google.com/billing/docs/how-to/export-data-bigquery?authuser=1">https://docs.cloud.google.com/billing/docs/how-to/export-data-bigquery</a></p></div>

  * Click `Create data set`.

* Go to `Billing` on the left menu.

* Under `Cost management`, select `Billing export` in the left menu.

* Enable `Detailed usage cost` with the following options:
  * Under `Projects`, select the billing project created (*OneLens Billing Project)*.
  * Under `Dataset`, select the dataset created (*billing\_export*).
  * Click `Save`.<br>

    <figure><img src="/files/JVP521yzi3yW68lGCjsI" alt=""><figcaption></figcaption></figure>

* Similarly, enable `Pricing` with the following options:
  * Under `Projects`, select the billing project created (*OneLens Billing Project*).
  * Under `Dataset`, select the dataset created (*billing\_export*).
  * Click `Save`.

    <figure><img src="/files/Qp87tGNIWagpRy7vXQhG" alt=""><figcaption></figcaption></figure>

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Pricing data includes custom pricing data for your resources, if you have custom contracts with Google.<br></p><p><a href="https://docs.cloud.google.com/billing/docs/how-to/export-data-bigquery-tables/pricing-data#pricing-data-schema">https://docs.cloud.google.com/billing/docs/how-to/export-data-bigquery-tables/pricing-data#pricing-data-schema</a></p></div>

* Using the search bar on top, search for and enable the `Cloud Billing API` on this project.<br>

  <figure><img src="/files/Z0dk6Yqy21rE75l7oJQp" alt=""><figcaption></figcaption></figure>

{% endstep %}

{% step %}

### Create the Service Account and assign permissions on the Billing project

* In the `Project Picker` menu on top, select the new billing project created just now (i.e., *OneLens Billing Project*)
* Go to `IAM and admin` on the left bar.
* Go to `Service accounts` and click on `+ Create service account`.
  * Enter the `Service account name` as “*OneLens Reader SA*”
  * `Service account ID` should be automatically generated.
  * Enter the `Service account description` as: *SA used by OneLens with read-only roles for FinOps analysis*.
  * Click `Create and continue`.<br>

    <figure><img src="/files/JdgYRG1sCxEQQ2EuHRQ4" alt=""><figcaption></figcaption></figure>
* Under `Permissions`, search for and select the following roles:
  * `BigQuery Data Viewer`
  * `BigQuery Metadata Viewer`
  * `BigQuery Job User`
  * `BigQuery Read Session User`
* Click `Continue`

  <figure><img src="/files/pIsF1Xd8x5CjRtLkJbil" alt=""><figcaption></figcaption></figure>
* Click `Done`
* On the left, under `IAM and admin`, select `Service Accounts`
* Select the service account that was created just now (i.e., *OneLens Reader SA*).
* Under the `Principals with access` tab, click `+ Grant access`.
* Under `Add principals`, enter the following values
  * `onelens-customer-sa@astuto-prod-mum.iam.gserviceaccount.com` (our backend Service Account)
  * `onelens.finops@astuto.ai` (our external user email)
* Under `Assign Roles`, add the following role:
  * `Service Account Token Creator`
* Click `Save`.

  <figure><img src="/files/303jCbICX9FgzokbSTjT" alt=""><figcaption></figcaption></figure>

{% endstep %}

{% step %}

### Assign Billing project roles to the External User

* In the `Project Picker` menu on top, select the new billing project created just now (i.e., *OneLens Billing Project*)
* Go to `IAM and admin` and click `+ Grant access`.
* Under `Add principals`, enter the value of the `external user email ID` provided to you by the OneLens team: `onelens.finops@astuto.ai`
* Under Assign Roles, add the following roles and click Save:
  * `BigQuery Data Viewer`
  * `BigQuery Metadata Viewer`
  * `BigQuery Job User`<br>

    <figure><img src="/files/6YHQpVOhSVg7BiGrJgmV" alt=""><figcaption></figcaption></figure>

{% endstep %}

{% step %}

### Assign Organisation-level roles for Service Account and External User

* Open the `Project Picker` menu and select your `organisation`.
* Go to `IAM and admin` and click `+ Grant access`.
* Under `Add principals`, search for and select the `service account` that was created (i.e., *OneLens Reader SA*) and the external user email (i.e., `onelens.finops@astuto.ai`)
* Under `Assign Roles`, add the following roles and click `Save`:
  * `Organisation Viewer`
  * `Cloud Asset Viewer`
  * `Browser`
  * `Billing Account Viewer`<br>

    <figure><img src="/files/dIIIi0TlB3NJKWSMFbMt" alt=""><figcaption></figcaption></figure>

{% endstep %}

{% step %}

### Assign Project/Folder-level roles to the Service Account

* Open the `Project Picker` menu and select a `project/folder` to be onboarded.
* Go to `IAM and admin` and click `+ Grant access`.
* Under `Assign Roles`, add the following roles:
  * `Vertex AI Viewer`
  * `Cloud Functions Viewer`
  * `Cloud SQL Viewer`
  * `Compute Viewer`
  * `Kubernetes Engine Viewer`
  * `Dataflow Viewer`
  * `Dataproc Viewer`
  * `Cloud Filestore Viewer`
  * `Monitoring Viewer`
  * `Network Management Viewer`
  * `Recommender Viewer`
  * `Cloud Memorystore Redis Viewer`
  * `Service Usage Viewer`
  * `BigQuery Job User`
  * `BigQuery Metadata Viewer`
  * `BigQuery Resource Viewer`
* Click `Save`.<br>

  <figure><img src="/files/rY9J9MfJ6im7StXxlccP" alt=""><figcaption></figcaption></figure>

  <figure><img src="/files/3o7jS50sXjWvpQAGIDSi" alt=""><figcaption></figcaption></figure>

  <div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p>Repeat the above steps for <strong>all</strong> projects/folders to be onboarded.</p></div>

  <br>

{% endstep %}

{% step %}

### Assign Project/Folder-level roles to the External User

* Open the `Project Picker` menu and select a `project/folder` to be onboarded.
* Go to `IAM and admin` and click `+ Grant access`.
* Under `Add principals`, enter and select the external user email (i.e., `onelens.finops@astuto.ai`).
* Under `Assign Roles`, add the following roles:
  * `Viewer`
  * `BigQuery Resource Viewer`
  * `BigQuery Metadata Viewer`
  * `BigQuery Job User`
* Click `Save`.<br>

  <figure><img src="/files/xhD0ijeqFjOZoSlDqiL8" alt=""><figcaption></figcaption></figure>

  <div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p>Repeat the above steps for <strong>all</strong> projects/folders to be onboarded.</p></div>

{% endstep %}
{% endstepper %}

{% hint style="success" %}
**You have now&#x20;**<mark style="color:$success;">**successfully**</mark>**&#x20;integrated your Google Cloud Platform environment with OneLens.**

\
**Please share the following values to the OneLens team to facilitate the connection on our end:**

* *Billing project ID*
* *Service Account email ID*
* *BigQuery dataset ID*
  {% endhint %}


# Frequently Asked Questions (FAQ)

Answers to common questions regarding the architecture, security, and implementation of the OneLens Google Cloud Platform (GCP) integration.

## What is the high-level architecture of this integration?

The integration utilizes **GCP Billing Exports to BigQuery**.

* **Data Flow:** GCP exports detailed billing and pricing data into a BigQuery dataset (`billing_export`) within a dedicated project in your organization. OneLens queries this BigQuery dataset securely to generate insights.
* **Resource Impact:** Minimal. The integration runs read-only queries against your billing data and reads metadata from your projects. It does not deploy agents to your VMs or clusters.

## What GCP scopes do you support for onboarding?

We support onboarding at the **Organization**, **Folder**, and **Project** levels.

* **Automation Support:** Our Terraform script (`deploy.sh`) accepts a list of specific `Target Folder IDs` or `Target Project IDs`.
* **Default Behavior:** If no specific targets are provided, the script defaults to onboarding the entire Organization (all active projects).

## How is authentication handled?

We do **not** require (and do not recommend) sharing long-lived Service Account JSON keys.

* **Method:** We utilize **Service Account Impersonation**.
* **Mechanism:** You grant the role `Service Account Token Creator` to our external identity (`onelens-customer-sa@astuto-prod-mum.iam.gserviceaccount.com`). This allows our platform to generate short-lived credentials to access *only* the specific `OneLens Reader SA` service account you create in your environment.
* **Benefit:** This is a zero-trust aligned pattern that eliminates the risk of key leakage and allows you to revoke access instantly by removing the IAM binding.

## What specific permissions does OneLens require?

We adhere to a read-only posture using a dedicated Service Account (`onelens-reader-sa`).

* **Billing Access:** `BigQuery Data Viewer` and `BigQuery Job User` on the billing project to read cost data.
* **Resource Access:** Detailed "Viewer" roles on the target projects (e.g., `Compute Viewer`, `Kubernetes Engine Viewer`, `Vertex AI Viewer`) to map costs to resources and generate rightsizing recommendations.
* **Organization Access:** `Organization Viewer` and `Billing Account Viewer` to visualize hierarchy and subscription mapping.

| IAM Role                        | Scope            | Assignee                       | Purpose                                            |
| ------------------------------- | ---------------- | ------------------------------ | -------------------------------------------------- |
| Organization Viewer             | Organization     | Service Account, External user | Read organization hierarchy.                       |
| Billing Viewer                  | Billing account  | Service Account, External user | Read billing account metadata.                     |
| BigQuery Data Viewer            | Billing project  | Service Account, External user | Read data from BigQuery export dataset.            |
| BigQuery Job User               | Billing project  | Service Account, External user | Run queries on the billing data.                   |
| **\***&#x53;ervice Viewer roles | \*\*Target scope | Service Account                | Read metadata for services like Compute, GKE, etc. |
| Viewer                          | \*\*Target scope | External user                  | Read-only access to console.                       |

## Which APIs need to be enabled?

To provide accurate recommendations and map costs effectively, the following 15 APIs must be enabled on all target projects:

1. `aiplatform.googleapis.com` (Vertex AI API)
2. `cloudfunctions.googleapis.com` (Cloud Functions API)
3. `sqladmin.googleapis.com` (Cloud SQL Admin API)
4. `compute.googleapis.com` (Compute Engine API)
5. `container.googleapis.com` (Kubernetes Engine API)
6. `dataflow.googleapis.com` (Dataflow API)
7. `dataproc.googleapis.com` (Cloud Dataproc API)
8. `file.googleapis.com` (Cloud Filestore API)
9. `monitoring.googleapis.com` (Cloud Monitoring API)
10. `networkmanagement.googleapis.com` (Network Management API)
11. `recommender.googleapis.com` (Recommender API)
12. `redis.googleapis.com` (Google Cloud Memorystore for Redis API)
13. `serviceusage.googleapis.com` (Service Usage API)
14. `cloudasset.googleapis.com` (Cloud Asset API)
15. `bigquery.googleapis.com` (BigQuery API)

## Is there any cost for enabling all these APIs?

No.

* **Explanation:** Enabling an API (like `compute.googleapis.com`) acts as a "gateway" allowing interaction with the service. It does not incur a fee by itself. Costs are incurred when you *provision resources* (like running a VM) or make high-volume API calls (Data Plane operations).
* **OneLens Usage:** Our platform performs low-volume "metadata read" operations (e.g., "List Instances", "Get Disk Type") which typically fall well within the Google Cloud Free Tier limits for API requests. You are not charged simply for having the API enabled in your projects.

## Can we automate this setup?

Yes. We provide a pre-packaged Terraform module wrapper (`deploy.sh`).

* **Workflow:** You upload the provided `onelens-gcp-onboarding` folder to your Google Cloud Shell.
* **Script Actions:** The script automatically enables the required 15+ APIs, creates the dedicated billing project (`astuto-<company>-billing`), configures the BigQuery dataset, and applies the necessary IAM bindings.
* **Prerequisites:** The user running the script needs `Organisation Administrator`, `Billing Account Administrator`, and `Service Usage Administrator`.

## Why does OneLens need "Viewer" role for the External User?

The "Viewer" role (`roles/viewer`) is assigned to the **External User** (`onelens.finops@astuto.ai`), which represents our support/engineering team, *not* the automated platform.

* **Reason:** This facilitates rapid troubleshooting of permission issues or data discrepancies during the onboarding phase without requiring back-and-forth granular permission grants.
* **Least Privilege:** The *automated platform* (the Service Account) uses strictly granular roles (e.g., `roles/compute.viewer`, `roles/cloudsql.viewer`) defined in the Terraform/Manual guide, ensuring your daily data ingestion is scoped tightly.

## What if we have a third-party billing partner (CSP) and do not have access to enable the BigQuery cost export?

This is a common scenario with billing CSP partners.

* **Action:** You cannot create the export yourself if you do not own the Billing Account. You must request the vendor to **share** the existing BigQuery dataset containing your billing data.
* **Procedure:** Ask your partner to grant `BigQuery Data Viewer` and `BigQuery Job User` roles on *their* export dataset to the `OneLens Reader SA` service account email we provide during onboarding. You will then point OneLens to that Partner Project/Dataset ID instead of creating a new one.

## Why must the BigQuery Dataset be in the "US (multiple regions)" location?

This is a critical GCP constraint for **historical data**.

* **Reason:** When you enable GCP Billing Exports, setting the dataset location to Multi-region US allows GCP to potentially back-fill billing data from the **start of the previous month**.
* **Impact:** If you select a different region, the export will likely only contain data starting from the *moment* you enable it, resulting in a gap in your initial reporting.

## Why is "Table Expiry" disabled on the dataset?

By default, BigQuery may set tables to expire (auto-delete) after 60 days.

* **Requirement:** We explicitly require this to be **unchecked (disabled)**.
* **Reason:** FinOps requires long-term trend analysis (year-over-year, month-over-month). If the data partitions are auto-deleted, we lose the historical audit trail required for forecasting and anomaly detection.

## I already have a billing export. Do I need to create a new one?

You can reuse an existing billing export, but we strongly recommend a dedicated setup.

* **Existing Project:** Our script supports an input `Existing Billing Export Project ID`.
* **Recommendation:** Creating a dedicated project `OneLens Billing Project` isolates our access. It ensures we don't accidentally query unrelated tables and prevents our `BigQuery Job User` queries from consuming quotas meant for or creating noise in your production analytics.

## Why do you require BigQuery roles (`Job User`, `Metadata Viewer`) on the *target* projects?

This is separate from the *billing export* access.

* **Reason:** Many organizations run significant BigQuery workloads (queries) within their application projects. These roles allow OneLens to analyze the query history, slot usage, and job performance in those specific projects.
* **Benefit:** This enables us to perform BigQuery optimization, which often uncovers substantial savings by identifying inefficient queries and underutilized slot commitments. This is purely for workload optimization, not for reading the data *inside* your application tables.

## What is the cost incurred for this setup?

The below analysis provides approximate costs for two scenarios:

#### Scenario 1: Same Region (our standard setup)

*(Example: Customer's BigQuery in US Multi-region, OneLens processing in US Multi-region)*

<table><thead><tr><th>Component</th><th width="149.5">$5K/month spend</th><th width="164">$50K/month spend</th><th width="167.5">$500K/month spend</th><th width="159.5">$5M/month spend</th></tr></thead><tbody><tr><td>Storage size</td><td>1.25 GB</td><td>12.5 GB</td><td>125 GB</td><td>1.25 TB</td></tr><tr><td>Storage cost</td><td>$0.00</td><td>~$0.05</td><td>~$2.30</td><td>~$24.80</td></tr><tr><td>Query cost</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>~$1.56</td></tr><tr><td>Egress cost</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>$0.00</td></tr><tr><td><strong>Total cost per month</strong></td><td><strong>$0.00</strong></td><td><strong>~$0.05</strong></td><td><strong>~$2.30</strong></td><td><strong>~$26.36</strong></td></tr></tbody></table>

* For storage, up-to 10 GB is free.
* For queries, up-to 1 TB is free.
* For egress, same-region transfer is free.

We default to **Scenario 1** during the export setup to maximize the value of Google’s free tier and eliminate network egress fees.

#### Scenario 2: Different Region (common with existing billing project)

*(Example: Customer's BigQuery in asia-south1 (Mumbai), OneLens processing in US Multi-region)*

<table><thead><tr><th>Component</th><th width="149.5">$5K/month spend</th><th width="164">$50K/month spend</th><th width="167.5">$500K/month spend</th><th width="159.5">$5M/month spend</th></tr></thead><tbody><tr><td>Storage size</td><td>1.25 GB</td><td>12.5 GB</td><td>125 GB</td><td>1.25 TB</td></tr><tr><td>Storage cost</td><td>$0.00</td><td>~$0.06</td><td>~$2.65</td><td>~$28.52</td></tr><tr><td>Query cost</td><td>$0.00</td><td>$0.00</td><td>$0.00</td><td>~$1.56</td></tr><tr><td>Egress cost</td><td>~$0.10</td><td>~$1.00</td><td>~$10.00</td><td>~$100.00</td></tr><tr><td><strong>Total cost per month</strong></td><td><strong>~$0.10</strong></td><td><strong>~$1.06</strong></td><td><strong>~$12.65</strong></td><td><strong>~$130.08</strong></td></tr></tbody></table>

* For storage, up-to 10 GB is free.
* For queries, up-to 1 TB is free.
* For egress, same-region transfer is free.


# Connecting to OCI

To begin using OneLens, you need to connect your OCI account by configuring cost exports, creating a user and assigning required permissions for FinOps assessment. You can assign access at **tenancy-level** or **compartment-level** as per your needs.

{% stepper %}
{% step %}

### Create a group

This step creates a group `OneLensBillingReader` to host the `OneLens FinOps Reader` user.

* Navigate to `Identity & Security` > `Domains`.

<figure><img src="/files/YK52orkLM7y1tHDFAm0u" alt=""><figcaption></figcaption></figure>

* Select your domain.

<figure><img src="/files/1IayvkkhPivaZ5mYczJq" alt=""><figcaption></figcaption></figure>

* Navigate to the `User Management` tab.

<figure><img src="/files/Ce5MpDU0iuYHdcTjAaAZ" alt=""><figcaption></figcaption></figure>

* Scroll to `Groups`, and select `Create Group`.

<figure><img src="/files/SRBAayS1USkyhyBBAxUn" alt=""><figcaption></figcaption></figure>

* In the opened Create group window, enter the following details:
  * Name: `OneLensBillingReader`
  * Description: `Group containing OneLens FinOps Reader user for reading cost & usage data for FinOps analysis`.

<figure><img src="/files/wK2EyOSs5l9XAsCazQek" alt=""><figcaption></figcaption></figure>

All other options can be left as default.

* Click `Create`.

{% endstep %}

{% step %}

### Create a user

This step creates the **OneLens FinOps Reader** user and adds them to the group.

* In the `User Management` tab, under `Users`, click `Create`.

<figure><img src="/files/7EAkPj51I28moprcmJre" alt=""><figcaption></figcaption></figure>

* In the opened Create User window, enter the following details:
  * First name: `OneLens FinOps Reader`
  * Username / Email: `onelens.finops@astuto.ai`
  * Use the email address as the username: `Enabled`
  * Groups: select the `OneLensBillingReader` group
  * Click `Create`.

<figure><img src="/files/7kBUUpuFYiN2BczWEfIP" alt=""><figcaption></figcaption></figure>

{% endstep %}

{% step %}

### Create a policy

This step creates a policy that allows the created user in the group to access cost & usage data, and read metadata about resources in your compartment or tenancy.

* Search for and navigate to `Policies`.
* Click `Create Policy`.

{% hint style="warning" %}
Make sure that the the root compartment is selected.

Cost export policy statements are only supported in the root compartment.
{% endhint %}

<figure><img src="/files/7xQTP1cEnSc6Z2bENszc" alt=""><figcaption></figcaption></figure>

* In the opened Create Policy window, enter the following details:
  * Name: `OneLensReaderPolicy`
  * Description: `Policy statements for enabling OneLens FinOps Reader user to read cost & usage data, and resource-level metadata`.
  * Under `Policy Builder`, click `Show manual editor`.
  * Paste the following policy block in the statement field:

#### For Tenancy-wide resource visibility:

If you want to have visibility into all resources in your tenancy, use the following policy blocks:

<mark style="color:$success;">**Cost & Usage statements (must be tenancy-level):**</mark>

{% code lineNumbers="true" %}

```
define tenancy reporting as ocid1.tenancy.oc1..aaaaaaaaned4fkpkisbwjlr56u7cj63lf3wffbilvqknstgtvzub7vhqkggq
endorse group OneLensBillingReader to read objects in tenancy reporting

allow group OneLensBillingReader to read usage-reports in tenancy
allow group OneLensBillingReader to read metrics in tenancy
allow group OneLensBillingReader to read optimizer-api-family in tenancy
allow group OneLensBillingReader to read usage-budgets in tenancy
allow group OneLensBillingReader to read rate-cards in tenancy
allow group OneLensBillingReader to read organizations-family in tenancy
allow group OneLensBillingReader to inspect compartments in tenancy
allow group OneLensBillingReader to inspect tag-namespaces in tenancy
```

{% endcode %}

<mark style="color:$danger;">**Resources visibility statement (tenancy-wide inspect with sensitive resources denied):**</mark>

```
allow group OneLensBillingReader to inspect all-resources in tenancy where all { target.resource.type != 'user', target.resource.type != 'group', target.resource.type != 'policy', target.resource.type != 'dynamic-group', target.resource.type != 'network-source', target.resource.type != 'authentication-policy', target.resource.type != 'api-key', target.resource.type != 'auth-token', target.resource.type != 'smtp-credential', target.resource.type != 'customer-secret-key', target.resource.type != 'db-credential', target.resource.type != 'identity-provider', target.resource.type != 'identity-provider-group-mapping', target.resource.type != 'oauth2client', target.resource.type != 'vault', target.resource.type != 'key', target.resource.type != 'secret', target.resource.type != 'certificate', target.resource.type != 'private-ca-bundle', target.resource.type != 'console-history', target.resource.type != 'work-request' }
```

#### For Compartment-scoped resource visibility:

If you want to have visibility into all resources in a specific compartment(s), use the following policy blocks:

<mark style="color:$success;">**Cost & Usage statements (must be tenancy-level):**</mark>

{% code lineNumbers="true" %}

```
define tenancy reporting as ocid1.tenancy.oc1..aaaaaaaaned4fkpkisbwjlr56u7cj63lf3wffbilvqknstgtvzub7vhqkggq
endorse group OneLensBillingReader to read objects in tenancy reporting

allow group OneLensBillingReader to read usage-reports in tenancy
allow group OneLensBillingReader to read metrics in tenancy
allow group OneLensBillingReader to read optimizer-api-family in tenancy
allow group OneLensBillingReader to read usage-budgets in tenancy
allow group OneLensBillingReader to read rate-cards in tenancy
allow group OneLensBillingReader to read organizations-family in tenancy
allow group OneLensBillingReader to inspect compartments in tenancy
allow group OneLensBillingReader to inspect tag-namespaces in tenancy
```

{% endcode %}

<mark style="color:$danger;">**Resources visibility statement (compartment-scoped inspect with sensitive resources denied):**</mark>

```
allow group OneLensBillingReader to inspect all-resources in compartment id <CompartmentOCID> where all { target.resource.type != 'user', target.resource.type != 'group', target.resource.type != 'policy', target.resource.type != 'dynamic-group', target.resource.type != 'network-source', target.resource.type != 'authentication-policy', target.resource.type != 'api-key', target.resource.type != 'auth-token', target.resource.type != 'smtp-credential', target.resource.type != 'customer-secret-key', target.resource.type != 'db-credential', target.resource.type != 'identity-provider', target.resource.type != 'identity-provider-group-mapping', target.resource.type != 'oauth2client', target.resource.type != 'vault', target.resource.type != 'key', target.resource.type != 'secret', target.resource.type != 'certificate', target.resource.type != 'private-ca-bundle', target.resource.type != 'console-history', target.resource.type != 'work-request' }
```

{% hint style="warning" %}
**\<CompartmentOCID>** is to be replaced with your actual compartment OCID.&#x20;

You can add multiple compartments by duplicating the statement with different compartment OCIDs.
{% endhint %}

#### For Resource family-scoped resource visibility:

<mark style="color:$success;">**Cost & Usage statements (must be tenancy-level):**</mark>

```
define tenancy reporting as ocid1.tenancy.oc1..aaaaaaaaned4fkpkisbwjlr56u7cj63lf3wffbilvqknstgtvzub7vhqkggq
endorse group OneLensBillingReader to read objects in tenancy reporting

allow group OneLensBillingReader to read usage-reports in tenancy
allow group OneLensBillingReader to read metrics in tenancy
allow group OneLensBillingReader to read optimizer-api-family in tenancy
allow group OneLensBillingReader to read usage-budgets in tenancy
allow group OneLensBillingReader to read rate-cards in tenancy
allow group OneLensBillingReader to read organizations-family in tenancy
allow group OneLensBillingReader to inspect compartments in tenancy
allow group OneLensBillingReader to inspect tag-namespaces in tenancy
```

<mark style="color:$danger;">**Resources visibility statements (only scoped to minimal resources):**</mark>

```
allow group OneLensBillingReader to inspect instance-family in tenancy
allow group OneLensBillingReader to inspect volume-family in tenancy
allow group OneLensBillingReader to inspect virtual-network-family in tenancy
allow group OneLensBillingReader to inspect load-balancer-family in tenancy
allow group OneLensBillingReader to inspect database-family in tenancy
allow group OneLensBillingReader to inspect autonomous-database-family in tenancy
allow group OneLensBillingReader to inspect object-family in tenancy
allow group OneLensBillingReader to inspect file-family in tenancy
allow group OneLensBillingReader to inspect functions-family in tenancy	
allow group OneLensBillingReader to inspect dns-family in tenancy	
```

<figure><img src="/files/rzFRdTdCmyKRGQptYnK2" alt=""><figcaption></figcaption></figure>

{% hint style="danger" %}
Note that even though we have used **inspect** statement here (can only read metadata), we have added a deny block for disallowing the following sensitive resource types for added security:

**Identity & credentials:**

* user
* group
* policy
* dynamic-group
* network-source
* authentication-policy
* api-key
* auth-token
* smtp-credential
* customer-secret-key
* db-credential
* identity-provider
* identity-provider-group-mapping
* oauth2client

**Keys & secrets:**

* vault
* key
* secret
* certificate
* private-ca-bundle

**Logs & traces:**

* console-history
* work-request

\
If you require any additional items to be explicitly denied, please feel free to reach out to the OneLens team.
{% endhint %}

{% endstep %}

{% step %}

### Generating & sharing credentials

This step guides you to add a public key to the user, generating and sharing the Configuration File.

* Navigate to `Identity & Security` > `Domains`.
* Select your domain.
* Navigate to the `User Management` tab.
* Under `Users,` select the `OneLens FinOps Reader` user.
* Navigate to the `API keys` tab and select `Add API key`.

<figure><img src="/files/dvyEwoGyjdxCJ6y1zUPy" alt=""><figcaption></figcaption></figure>

* In the opened `Add API key` window, select `Choose public key file`, and upload the **Public Key** shared to you by the OneLens team.
* Click `Add`.

<figure><img src="/files/XyXF0lflXZOSg36bZKQW" alt=""><figcaption></figcaption></figure>

* In the `API keys` list, click the `three dots` to the right of the API key just added, and click `View configuration file`.

<figure><img src="/files/pvgJLSRILk6r7CrSnZOs" alt=""><figcaption></figcaption></figure>

* In the opened `Configuration file preview` window, click `Copy` to copy the content.

<figure><img src="/files/0g0pJ03gtlDg6wHuv0KU" alt=""><figcaption></figcaption></figure>

* Share the copied value to the OneLens team over a secure channel like email.

{% hint style="success" %}
Congratulations, you have completed the OCI integration with OneLens.

Read on for more details on how we generate keys to share with you, a full definition of permissions assigned and what they are used for.
{% endhint %}

<details>

<summary>Appendix: Policy definitions</summary>

Below listed are the policy statements used by OneLens and a description of the purpose.

<table><thead><tr><th width="247">Permission</th><th width="125">Privilege</th><th width="144">Scope</th><th width="292">Purpose</th></tr></thead><tbody><tr><td>define tenancy reporting as ocid1.tenancy.oc1...<br><br>endorse group OneLensBillingReader to read objects in tenancy reporting</td><td>Read</td><td>Tenancy</td><td>Enables a cost export, and allows the user in the OneLensBillingReader group to read it.</td></tr><tr><td>inspect compartments</td><td>Inspect</td><td>Tenancy</td><td>To map costs to compartments.</td></tr><tr><td>inspect tag-namespaces</td><td>Inspect</td><td>Tenancy</td><td>To read tags groups.</td></tr><tr><td>inspect tag-definitions</td><td>Inspect</td><td>Tenancy</td><td>To read tags keys.</td></tr><tr><td>read organizations-family</td><td>Read</td><td>Tenancy</td><td>To map childs of the tenancy.</td></tr><tr><td>inspect tenant</td><td>Inspect</td><td>Tenancy</td><td>To display tenancy metadata like OCID, home region, etc.</td></tr><tr><td>read usage-reports</td><td>Read</td><td>Tenancy</td><td>To read usage details and map to costs.</td></tr><tr><td>read usage-budgets</td><td>Read</td><td>Tenancy</td><td>To read budgets set.</td></tr><tr><td>read rate-cards</td><td>Read</td><td>Tenancy</td><td>To read negotiated rates.</td></tr><tr><td>read metrics</td><td>Read</td><td>Tenancy</td><td>To read right-sizing recommendations (CPU, memory, etc.)</td></tr><tr><td>read optimizer-api-family</td><td>Read</td><td>Tenancy</td><td>To read cost optimization recommendations provided by Oracle.</td></tr><tr><td>inspect all-resources in tenancy <mark style="color:$warning;"><strong>(optional)</strong></mark></td><td>Inspect</td><td>Tenancy</td><td>To read resources metadata in tenancy.<br><br><mark style="color:$warning;"><strong>(only applicable if visibility is tenancy-wide)</strong></mark></td></tr><tr><td>inspect all-resources in compartment id <mark style="color:$warning;"><strong>(optional)</strong></mark></td><td>Inspect</td><td>Compartment</td><td>To read resources metadata in a compartment<br><br><mark style="color:$warning;"><strong>(only applicable if visibility is compartment-scoped)</strong></mark></td></tr><tr><td>inspect instance-family <mark style="color:$warning;"><strong>(optional)</strong></mark></td><td>Inspect</td><td>Tenancy / Compartment</td><td>To map costs to Compute resources.<br><br><mark style="color:$warning;"><strong>(only applicable if visibility is resource family-scoped)</strong></mark></td></tr><tr><td>inspect volume-family <mark style="color:$warning;"><strong>(optional)</strong></mark> </td><td>Inspect</td><td>Tenancy / Compartment</td><td>To map costs to Block storage resources.<br><br><mark style="color:$warning;"><strong>(only applicable if visibility is resource family-scoped)</strong></mark></td></tr><tr><td>inspect virtual-network-family <mark style="color:$warning;"><strong>(optional)</strong></mark></td><td>Inspect</td><td>Tenancy / Compartment</td><td>To map costs to Networking resources and Data Transfer.<br><br><mark style="color:$warning;"><strong>(only applicable if visibility is resource family-scoped)</strong></mark></td></tr><tr><td>inspect load-balancer-family <mark style="color:$warning;"><strong>(optional)</strong></mark></td><td>Inspect</td><td>Tenancy / Compartment</td><td>To map costs to Networking resources and Data Transfer.<br><br><mark style="color:$warning;"><strong>(only applicable if visibility is resource family-scoped)</strong></mark></td></tr><tr><td>inspect database-family <mark style="color:$warning;"><strong>(optional)</strong></mark></td><td>Inspect</td><td>Tenancy / Compartment</td><td>To map costs to Database resources.<br><br><mark style="color:$warning;"><strong>(only applicable if visibility is resource family-scoped)</strong></mark></td></tr><tr><td>inspect autonomous-database-family <mark style="color:$warning;"><strong>(optional)</strong></mark></td><td>Inspect</td><td>Tenancy / Compartment</td><td>To map costs to Database resources.<br><br><mark style="color:$warning;"><strong>(only applicable if visibility is resource family-scoped)</strong></mark></td></tr><tr><td>inspect object-family <mark style="color:$warning;"><strong>(optional)</strong></mark></td><td>Inspect</td><td>Tenancy / Compartment</td><td>To map costs to Object Storage resources.<br><br><mark style="color:$warning;"><strong>(only applicable if visibility is resource family-scoped)</strong></mark></td></tr><tr><td>inspect file-family <mark style="color:$warning;"><strong>(optional)</strong></mark></td><td>Inspect</td><td>Tenancy / Compartment</td><td>To map costs to File Storage resources.<br><br><mark style="color:$warning;"><strong>(only applicable if visibility is resource family-scoped)</strong></mark></td></tr><tr><td>inspect functions-family <mark style="color:$warning;"><strong>(optional)</strong></mark></td><td>Inspect</td><td>Tenancy / Compartment</td><td>To map costs to Serverless Functions resources.<br><br><mark style="color:$warning;"><strong>(only applicable if visibility is resource family-scoped)</strong></mark></td></tr><tr><td>inspect dns-family <mark style="color:$warning;"><strong>(optional)</strong></mark></td><td>Inspect</td><td>Tenancy / Compartment</td><td>To map costs to DNS resources.<br><br><mark style="color:$warning;"><strong>(only applicable if visibility is resource family-scoped)</strong></mark></td></tr></tbody></table>

</details>
{% endstep %}
{% endstepper %}


# Frequently Asked Questions (FAQ)

Answers to common questions regarding the architecture, security, and implementation of the OneLens Oracle Cloud Infrastructure integration.

## What do I need before I can connect OneLens to OCI?

You need the following before starting the OCI integration:

* An active OCI account with access to the root compartment for configuring cost exports.
* Permission to manage Identity & Security settings, including creating domains, users, groups, and policies.
* The public key file provided by the OneLens team (required during API key setup in Step 4).

{% hint style="info" %}
All four steps, creating a group, user, policy, and generating credentials - must be completed in order. Skipping any step will prevent OneLens from reading your OCI cost and usage data.
{% endhint %}

## Does OneLens modify any of my OCI resources?

**No.** OneLens uses a dedicated read-only user (OneLens FinOps Reader) with strictly scoped OCI policies. The permissions only allow reading cost, usage, and resource metadata - no write, delete, or administrative actions are possible.

Even the resource visibility permissions use inspect-level access only, which allows reading metadata but not the resource contents themselves. Additionally, a deny block is applied to explicitly exclude sensitive resource types such as IAM credentials, secrets, and vault keys.

{% hint style="success" %}
To revoke OneLens access at any time, simply delete the OneLens FinOps Reader user or remove them from the OneLensBillingReader group in your OCI domain.
{% endhint %}

## Why must the cost export policy be created in the root compartment?

OCI Cost & Usage export policy statements are only supported at the root (tenancy) level. This is an OCI platform requirement - the cost data export service is scoped to the tenancy, not to individual compartments.

Even if you choose compartment-scoped or resource family-scoped visibility for resource metadata, the Cost & Usage statements in the policy must always be written at the tenancy level.

{% hint style="warning" %}
Make sure the root compartment is selected when creating the OneLensReaderPolicy. Creating the policy in a child compartment will cause the cost export statements to fail.
{% endhint %}

## What is the difference between the three visibility scopes - tenancy-wide, compartment-scoped, and resource family-scoped?

All three options include the same Cost & Usage statements (required for billing data). They differ only in how much resource metadata OneLens can see:

* **Tenancy-wide:** OneLens can inspect all resource types across your entire tenancy, excluding sensitive types. Best for full visibility.
* **Compartment-scoped:** OneLens can inspect all resource types within one or more specific compartments you define. Use when you want to limit visibility to particular environments or teams.
* **Resource family-scoped:** OneLens can only inspect a predefined set of resource families (e.g. compute, database, networking). Provides the most restricted access while still enabling cost-to-resource mapping.

{% hint style="info" %}
You can add multiple compartment-scoped statements by duplicating the inspect statement with different compartment OCIDs. Replace with the actual OCID for each compartment.
{% endhint %}

## Why is there a deny block for certain resource types in the policy?

Even though inspect-level access only reads metadata (not resource content), OCI's policy system requires explicit exclusions to prevent inspect permissions from applying to sensitive resources. The deny block covers three categories:

* **Identity & credentials:** users, groups, policies, API keys, auth tokens, identity providers, OAuth clients, and similar.
* **Keys & secrets:** vault, key, secret, certificate, and private CA bundle resources.
* **Logs & traces:** console history and work requests.

This ensures OneLens cannot access any credential or secret data even inadvertently.

{% hint style="success" %}
If you need additional resource types excluded from OneLens access, contact the OneLens team at <support@astuto.ai> and they can adjust the policy statements accordingly.
{% endhint %}

## What user and group names does OneLens require, and can I change them?

The setup uses the following names by convention:

* **Group:** OneLensBillingReader
* **User first name:** OneLens FinOps Reader
* **Username / Email:** <onelens.finops@astuto.ai>
* **Policy:** OneLensReaderPolicy

These names are recommended for clarity and consistency but are not technically required by OCI. What matters is that the policy statements reference the correct group name, and the user is a member of that group.

{% hint style="info" %}
If your organisation has a naming convention for IAM resources, you can use your own names - just ensure the group name in the policy statements matches the group you actually create.
{% endhint %}

## Where do I get the public key to upload during API key setup?

The OneLens team will provide you with a public key file before you begin the integration. This key is used to create an API key pair for the OneLens FinOps Reader user, which allows OneLens to authenticate securely to your OCI tenancy.

During Step 4 (Generating & sharing credentials), you upload this public key in the OCI console under the user's API keys tab. OCI then generates a Configuration File preview that you copy and share back to the OneLens team.

{% hint style="warning" %}
Do not generate your own key pair for this step. The OneLens team must hold the matching private key for authentication to work. Use only the public key they provide.
{% endhint %}

## What information do I need to share with OneLens after completing the setup?

After uploading the public key in Step 4, OCI generates a Configuration File. Copy the full contents of this file and share it with the OneLens team via a secure channel such as email (<support@astuto.ai>).

The configuration file contains the following details OneLens needs to connect:

* *Tenancy OCID*
* *User OCID*
* *Fingerprint of the API key*
* *Region*
* *Key file reference*

{% hint style="success" %}
The Configuration File preview is shown immediately after adding the API key. Click Copy in the preview window to capture the full content before closing it.
{% endhint %}

## How long does it take for data to appear in OneLens after connecting?

Once OneLens receives your configuration file and sets up the connection, the initial data ingestion begins. Depending on the size of your OCI tenancy and cost export history, the first data may take a few hours to appear in the dashboards.

After the initial load, OneLens processes data on an ongoing basis, so your cost and usage insights remain current automatically.

## Can I scope OneLens access to only certain compartments?

**Yes.** Use the compartment-scoped visibility option when creating your policy. This limits resource metadata visibility to the compartments you specify, while still allowing full access to tenancy-level cost and usage data (which is required regardless of scope).

You can include multiple compartments by adding separate inspect statements for each compartment OCID in the policy. For example:

```
allow group OneLensBillingReader to inspect all-resources in compartment id <CompartmentOCID1> where all { ... }
allow group OneLensBillingReader to inspect all-resources in compartment id <CompartmentOCID2> where all { ... }
```

{% hint style="info" %}
Each compartment statement must include the same deny conditions for sensitive resource types to maintain consistent security boundaries.
{% endhint %}

## What happens if I make a mistake during policy setup?

OCI policies can be edited after creation. In the OCI console, navigate to Policies, select OneLensReaderPolicy, and click Edit Policy Statements to make corrections.

Common mistakes include:

* Selecting a child compartment instead of the root compartment when creating the policy.
* Mistyping the group name in a policy statement — it must exactly match the group name you created.
* Forgetting to replace \<CompartmentOCID> with an actual OCID in compartment-scoped statements.

{% hint style="success" %}
Use OCI's Policy Builder with the manual editor enabled to paste and verify policy statements directly. This reduces the risk of formatting errors.
{% endhint %}

## Can I revoke OneLens access to my OCI tenancy?

**Yes.** To revoke access, you can take any of the following actions in the OCI console:

* Delete the OneLens FinOps Reader user - this immediately invalidates all API keys associated with that user.
* Remove the user from the OneLensBillingReader group - this removes all policy-based permissions without deleting the user.
* Delete the OneLensReaderPolicy - this removes all permissions granted to the group.

Once access is revoked, OneLens will no longer be able to authenticate to your tenancy or retrieve any data.

{% hint style="warning" %}
Deleting the API key (rather than the user or group membership) will also revoke access, but you would need to regenerate and reshare credentials with the OneLens team if you want to reconnect later.
{% endhint %}


# Connecting to Databricks

## Connect to Databricks

Connect your Databricks account to OneLens to import usage and billing data for cost analysis, anomaly detection, and optimization insights.

{% hint style="info" %}

#### Before you begin

Ensure the following:

* You have **Account Admin** access in Databricks
* Your workspace is **Unity Catalog-enabled**
* You can create Service Principals and SQL Warehouses
  {% endhint %}

{% hint style="info" %}

#### Required Permissions

The Service Principal used for this integration must have the following permissions:

#### SQL Warehouse

* `CAN USE` on the SQL Warehouse

#### Unity Catalog (System Tables)

Grant **Data Reader** access on:

* `system.billing`
* `system.compute`
* `system.access`
  {% endhint %}

***

## Configuring Databricks

Complete the following steps in your Databricks account before integrating with OneLens

{% stepper %}
{% step %}

### Collect account and workspace details

* Log in to the Databricks console
* Copy your **Databricks Account ID**

<figure><img src="/files/SExmWQ0bB4zEdiaseLZ1" alt=""><figcaption></figcaption></figure>

* Navigate to **Workspaces** and select your workspace
* Copy the **Workspace URL**

<figure><img src="/files/aPPMC73Hbwj5hyHOKNxh" alt=""><figcaption></figcaption></figure>

* Open the workspace
  {% endstep %}

{% step %}

### Create a Service Principal

* Go to: **Settings → Identity and access → Service principals**
* Click **Add service principal**

<figure><img src="/files/m2JnmXQRolZ32Dr7QDT3" alt=""><figcaption></figcaption></figure>

* Enter a name (for example, `onelens-integration-sp`) & click on add
* Open the Service Principal and go to the **Secrets** tab
* Click **Generate secret. When the secret expires, you’ll need to create a new one and reconfigure integration with OneLens.**

<figure><img src="/files/lYtBtsGBqXVMhga6LSya" alt=""><figcaption></figcaption></figure>

* Copy the following and save to use in OneLens :
  * Client ID
  * Client Secret

<figure><img src="/files/68Se0CeduXn8HbV52er0" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Create a SQL Warehouse

* Navigate to: **SQL → SQL Warehouses**
* Click **Create warehouse**

<figure><img src="/files/Yc1vvWAhcsomAlG0HtSo" alt=""><figcaption></figcaption></figure>

* Configure:
  * Type: Serverless
  * Size: **2X-Small**
* Create the warehouse
* Copy the **SQL Warehouse ID**

<figure><img src="/files/vy3qq10zCp4ZF4LfJoRh" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Grant warehouse access

* Open the SQL Warehouse
* Go to **Permissions**
* Add the Service Principal
* Grant `CAN USE` permission

<figure><img src="/files/SBqdGlKjxZAbAjzSwAhS" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Grant system table access

* Navigate to **Catalog → system**
* Grant **Data Reader** access to the Service Principal on:
  * `system.billing`
  * `system.compute`
  * `system.access`

<figure><img src="/files/J0v9b350PkHZzvdbsgOF" alt=""><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

***

## Connecting Databricks in OneLens

Complete the following steps in OneLens.

{% stepper %}
{% step %}

### Open the integration flow

1. Navigate to **OneLens → Integrations → Databricks**
2. Click **Connect Databricks**

<figure><img src="/files/V8nH01fNx5IcMOXI9HNA" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Enter account details

1. **Integration Name**
2. **Databricks Account ID**
3. Workspace URL
4. **SQL Warehouse ID**

<figure><img src="/files/QwMRtUK25RE43oP6DLWG" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Enter authentication details

Provide Service Principal credentials :

* Client ID
* Client Secret

{% hint style="info" %}
Your client secret is encrypted at rest and never exposed to end users. OneLens only accesses billing and metadata tables. We do not access query results or customer datasets.
{% endhint %}

{% endstep %}

{% step %}

<figure><img src="/files/KbONclEelQVxripqulcN" alt=""><figcaption></figcaption></figure>

### Validate Connection

OneLens will automatically verify:

* Authentication
* SQL Warehouse access
* System table permissions
* Ability to query usage data

Once all checks pass, click **Connect**.

<figure><img src="/files/dQ58wdvvSw9mrTxvZUXN" alt=""><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

***

### Data handling and security

* OneLens reads only billing and usage metadata from Databricks system tables
* No access to query results or user data
* Credentials are encrypted at rest

***

### Data availability

* Data ingestion begins immediately after connection
* Historical data is imported based on availability in system tables
* Data is refreshed continuously

***

### Troubleshooting

<details>

<summary>Authentication failed</summary>

Verify the Client ID and Client Secret

</details>

<details>

<summary>Warehouse access denied</summary>

Ensure the Service Principal has `CAN USE` permission

</details>

<details>

<summary>Missing system table permissions</summary>

Ensure Data Reader access is granted on all required schemas

</details>

<details>

<summary>No data available</summary>

Confirm Unity Catalog is enabled and system tables contain data

</details>


# Third Party Integrations

## Overview

Modern cloud operations rely on fast communication, seamless automation, and integrated visibility across tools. To support this, OneLens enables you to connect with popular third-party platforms like **Slack** and **Jira**, helping you receive alerts where your teams already work and automatically sync cost-related events into existing workflows.

## Available Integrations

OneLens currently supports integrations with the following platforms:

* [**Slack Integration**](/integrations/third-party-integrations/slack)\
  Get alerts and digests directly in Slack channels or user DMs.
* [**Jira Integration**](/integrations/third-party-integrations/jira)\
  Automatically create or update Jira issues from OneLens tickets and anomaly alerts for hands-free operations.

## Why Connect External Apps?

Integrating external apps with OneLens allows you to:

* **Receive important updates in real-time**—in the tools your teams already use.
* **Create and update tickets automatically** in your incident or backlog tracking systems.
* **Keep stakeholders informed** without switching platforms or checking multiple dashboards.

These integrations bring OneLens insights into your operational flow—so you never miss critical signals.

## How OneLens Manages Integrations

OneLens uses [**Truto**](https://www.truto.one/), a trusted third-party provider, to securely manage its external integrations. Truto handles the authentication, authorization, and secure token exchange between OneLens and your connected apps.

{% hint style="success" %}

## **Data Ownership & Privacy**

Your data remains yours. OneLens and Truto only access what is strictly necessary to perform the intended actions (like sending an alert or creating a ticket). **Your messages, files, or internal content are never accessed, stored, or sold.**
{% endhint %}

All integrations are visible and manageable from the **Integrations** section in the OneLens sidebar, where you can review connection status or disconnect at any time.


# Jira

OneLens integrates with Jira to help you automate ticket management workflows. Once connected, OneLens can automatically create or update Jira issues when an **anomaly is detected**, a **ticket is created**, or a **ticket status is updated**—ensuring your engineering and FinOps teams are instantly in sync.

Alerts generated from OneLens are created as **Jira issues within a specified project and epic**, and can also be **assigned to specific users**, helping streamline accountability and tracking.

{% hint style="success" %}

### Prerequisites

* You must be a **OneLens Admin** user to configure the Slack integration. *Make sure you are log in with the specific account that holds admin access.*
* You must have access to your Jira workspace (via Atlassian) with permission to:
  * View and manage projects and epics
  * Assign tickets
  * Approve third-party app access
    {% endhint %}

## Setting Up Jira

OneLens uses a trusted third-party provider, **Truto**, to securely connect with Atlassian (Jira).

{% hint style="success" %}
**Your data belongs to you—Truto does not sell or share your data.** All authentication and permissions are handled through a secure, privacy-respecting flow.*To know more about Truto,* [*click here*](https://truto.one/)*.*
{% endhint %}

### Required Jira Permissions

<details>

<summary>OneLens (via Truto) uses the following Jira scopes to automate issue creation and synchronization:</summary>

<table><thead><tr><th width="279.8515625">Jira Scope</th><th>Purpose Used in OneLens</th></tr></thead><tbody><tr><td><code>read:jira-work</code></td><td>Read issue types and metadata</td></tr><tr><td><code>write:jira-work</code></td><td>Create and update issues</td></tr><tr><td><code>read:jira-user</code></td><td>List assignable users</td></tr><tr><td><code>manage:jira-project</code></td><td>Read project structures for issue placement</td></tr><tr><td><code>manage:jira-configuration</code></td><td>Read issue field and status configurations</td></tr><tr><td><code>manage:jira-webhook</code></td><td>Enable webhook-based updates</td></tr><tr><td><code>manage:jira-data-provider</code></td><td>Allow secure token flow via Truto</td></tr><tr><td><code>read:application-role:jira</code></td><td>Confirm user roles</td></tr><tr><td><code>offline_access</code></td><td>Maintain integration without re-authentication</td></tr></tbody></table>

</details>

{% hint style="info" %}

## **Privacy Note**&#x20;

OneLens only accesses what’s necessary to create and sync Jira issues.\
It **does not read your Jira project content, internal comments, or attachments.** Integration is limited to anomaly and ticket creation, updates, and basic user/project metadata.
{% endhint %}

### Integration Steps

{% stepper %}
{% step %}
**Go to Integrations**

* Open the **Integrations** section from the OneLens sidebar.
  {% endstep %}

{% step %}
**Click Connect on Jira**

* Find the **Jira** option and click **Connect**.
  {% endstep %}

{% step %}
**Truto Authorization Prompt**

* You’ll see a message indicating that OneLens uses Truto for this integration. Click **Continue**.

  <figure><img src="/files/d4hqJWw5f88pz5rQr1FF" alt="" width="188"><figcaption></figcaption></figure>

{% endstep %}

{% step %}
**Review Permissions**

* You will be redirected to a screen listing required Jira permissions. Click **Connect**.

  <figure><img src="/files/3cbc4NJlh5BV5cPFXNxU" alt="" width="188"><figcaption></figcaption></figure>

{% endstep %}

{% step %}
**Login to Atlassian**

* Enter your Atlassian credentials. Ensure this account has access to the relevant **project**, **epics**, and **assignee details**.

  <figure><img src="/files/f5ftz81zacUdWSQUflgg" alt="" width="375"><figcaption></figcaption></figure>

{% endstep %}

{% step %}
**Authorize Truto-Jira**

* You will see a screen showing that **Truto-Jira** is requesting access on behalf of OneLens. Click **Allow**.

  <div align="left"><figure><img src="/files/WZTGeppzx6SRSESj39dl" alt="" width="563"><figcaption></figcaption></figure></div>

{% endstep %}

{% step %}
**Integration Confirmation**

* Jira is now connected. You can view the integration status in the Integrations section of OneLens.
  {% endstep %}
  {% endstepper %}

## Managing Integration

To disconnect Jira, go to the **Integrations** section and click **Disconnect** under the Jira option.

<div align="center" data-full-width="false"><figure><img src="/files/lENz5C6jYZ84Ao7My6aO" alt="" width="168"><figcaption></figcaption></figure></div>

{% hint style="warning" %}

## NOTE

Disconnecting Jira will **not remove previously created Jira issues**. However, you will no longer be able to create new issues from OneLens until the integration is reconnected. Existing workflows that depend on Jira will stop functioning until connection is restored.
{% endhint %}

## What Next

You can set up workflows for creating a Jira issue automatically whenever a **ticket is generated** or an **anomaly is detected** in OneLens.&#x20;

One of its usecase is:[Automatically Create Jira Issues for New Tickets](/automate/workflows-and-automation/usecases/automatically-create-jira-issues-for-new-tickets)


# Two Way Integration


# Slack

## Overview

OneLens integrates with Slack so you can receive **Anomaly Alerts**, **Ticket Notifications**, **Cost Alerts**, and **Resource Digests** directly in your Slack workspace. This enables near real-time visibility into key events without leaving your team’s communication tool.

You can configure workflows to send alerts to specific **users** or **channels**, including private ones.

{% hint style="warning" %}

### Prerequisites

* You must be a **OneLens Admin** user to configure the Slack integration. *Make sure you are log in with the specific account that holds admin access.*
* You must have permission in Slack workspace to authorize third-party integrations.
  {% endhint %}

## Setting Up Slack in OneLens

OneLens uses a trusted third-party provider, **Truto**, to securely connect with Slack.

{% hint style="success" %}
**Your data belongs to you—Truto does not sell or share your data.** All authentication and permissions are handled through a secure, privacy-respecting flow.*To know more about Truto,* [*click here*](https://truto.one/)*.*
{% endhint %}

### Required Slack Permissions

<details>

<summary>The following permissions are required for enabling slack integration:</summary>

<table><thead><tr><th width="217.109375">Permission Scope</th><th>Description</th></tr></thead><tbody><tr><td><code>users:read</code></td><td>View users in your Slack workspace</td></tr><tr><td><code>users:read.email</code></td><td>Access email addresses of users</td></tr><tr><td><code>team:read</code></td><td>Read workspace info</td></tr><tr><td><code>chat:write</code></td><td>Send messages as OneLens</td></tr><tr><td><code>chat:write.public</code></td><td>Post in public channels</td></tr><tr><td><code>im:write</code></td><td>Send messages to direct messages</td></tr><tr><td><code>channels:read</code></td><td>Access channel list</td></tr><tr><td><code>groups:read</code></td><td>Access private channel list</td></tr><tr><td><code>mpim:read</code></td><td>Access group DMs</td></tr><tr><td><code>im:read</code></td><td>Access direct messages</td></tr></tbody></table>

</details>

{% hint style="info" %}

## **Privacy Note**&#x20;

OneLens does **not** access, read, or store your messages or files.\
The integration uses these permissions **only to retrieve basic metadata** like user names, emails, and channel names—solely to enable alert routing.\
There is **no ongoing data pull** or background monitoring beyond the messages OneLens sends as alerts.
{% endhint %}

### Integration Steps

{% stepper %}
{% step %}
**Navigate to Integrations**

* From the OneLens sidebar, go to the **Integrations** section.
  {% endstep %}

{% step %}
**Initiate Slack Integration**

* Click on **Connect** under the Slack option.
  {% endstep %}

{% step %}
**Truto Consent Popup**

* A pop-up will inform you that OneLens uses Truto for Slack integration.

  <figure><img src="/files/d4hqJWw5f88pz5rQr1FF" alt="" width="188"><figcaption></figcaption></figure>
* Click **Continue** to proceed.
  {% endstep %}

{% step %}
**Permission Grant**

* Review the required permissions on the next screen. Click **Connect** to move forward.

{% endstep %}

{% step %}

### **Login to Slack**

* Sign in to your Slack workspace when prompted.

  <figure><img src="/files/3YuNB1ihqFwN7Elcb3pD" alt="" width="375"><figcaption></figcaption></figure>

{% endstep %}

{% step %}
**Workspace Selection**

You’ll be asked to allow OneLens access to a Slack workspace.

* Switch workspaces using the top-right corner if needed.
* You can also add a new workspace here.

  <figure><img src="/files/DkiKmUESGxJS8mSJw4G1" alt="" width="563"><figcaption></figcaption></figure>

{% endstep %}

{% step %}
**Grant Access**

* Click **Allow** to authorize the integration.
  {% endstep %}

{% step %}
**Confirmation**

* You’ll see a confirmation page indicating successful Slack integration.

  <figure><img src="/files/UZ67uoLrsDcdHGSGGqto" alt="" width="375"><figcaption></figcaption></figure>

{% endstep %}
{% endstepper %}

## Managing Integration

You can manage your Slack connection from the **Integrations** section in OneLens.

To **disconnect** Slack, click **Disconnect** under the Slack option.

<figure><img src="/files/cRw7pDxK7kTRRz0CpX8Q" alt="" width="170"><figcaption></figcaption></figure>

{% hint style="warning" %}

## NOTE

Disconnecting will **not remove** previously delivered Slack alerts.\
However, OneLens will **no longer be able to send messages** to your Slack workspace until the integration is reconnected.
{% endhint %}

## What Next

Once Slack is connected, you can now:

* Connect your Private Slack Channels to OneLens

  Head to [Connect Slack Private Channels to OneLens](/facts-and-faqs/faqs/connect-slack-private-channels-to-onelens)
* Setup Workflows for Slack Notifications

  Learn more about [Workflows & Automation](/automate/workflows-and-automation)


# Teams


# PagerDuty


# ServiceNow


# Two Way Setup


# Kubernetes

OneLens can be integrated with your selected K8s clusters to get usage and cost insights, all in one place. This will help you gain control over cost and run clusters efficiently.

OneLens supports Kubernetes integration for EKS *(Amazon Elastic Kubernetes Service on AWS)* and AKS *(Azure Kubernetes Service on Azure)*.

Follow the guidelines in order to complete the setup:

### [Agent Setup](/integrations/kubernetes/onelens-agent)

Set up the OneLens K8s agent using Helm to start collecting resource usage and metadata from your cluster.&#x20;

### [Enable Split Cost Allocation for EKS](/integrations/kubernetes/enable-split-cost-allocation-for-eks)

Enable workload-level cost allocation by linking your EKS resource usage with your CUR report.


# OneLens Agent

## Overview

The **OneLens Agent** is a **read-only** agent that integrates seamlessly with your EKS or AKS Kubernetes cluster. It connects your cluster to the OneLens platform, allowing you to monitor resources, track metrics, optimize costs, and generate detailed reports on resource utilization.

## Data Collection

The agent collects a comprehensive set of data to give you the insights you need to optimize your Kubernetes environment. Here’s a breakdown of the data:

### **High-Level Data**

* **Kubernetes Resources**: Information on the state, attributes and labels of resources in your cluster.
* **Usage Metrics**: Data on resource allocation and usage (e.g. CPU, memory).
* **Cost Data**: Insights into the cost of workloads, including idle and overhead costs.

### Low Level Details

| Category                     | Examples                                                                                |
| ---------------------------- | --------------------------------------------------------------------------------------- |
| **Workload Resources**       | CronJobs, DaemonSets, Deployments, Jobs, ReplicaSets, StatefulSets, Pods and Containers |
| **Namespace & Quota**        | LimitRanges, ResourceQuotas, Namespaces and Resource Spec                               |
| **Node & Storage Resources** | Nodes, PersistentVolumeClaims, PersistentVolumes, StorageClasses and LoadBalancers      |

## Architecture

The OneLens K8 Agent uses several components to collect and send data from your Kubernetes cluster to OneLens. Below is an overview of the core components involved:

<figure><img src="/files/VL3vWQ08NtXhzw3K0Arj" alt=""><figcaption></figcaption></figure>

### **Internal Component**

* **OneLens Deployer :** A temporary Kubernetes **Job** deployed via Helm to onboard K8s clusters. It sets up the full OneLens agent stack with [temporary RBAC permissions](/integrations/kubernetes/onelens-agent/artifacts).
* **OneLens Updater :** **Cronjob** responsible for any daily maintenance and patching of the agent, as and when available.
* **OpenCost** : An [open-source project](https://github.com/opencost/opencost) that measures cloud infrastructure and container costs, enabling real-time cost monitoring for Kubernetes. It is deployed as a **Deployment.**
* **Prometheus**: An [open-source project](https://github.com/prometheus/prometheus) for collecting and storing metrics, used in conjunction with OpenCost to scrape and store resource allocation and usage data. It is deployed as a **Deployment.**
* **OneLens Exporter**: A light weight stateless **Cronjob** that collects data from OpenCost and Prometheus every 60 minutes (or configured duration) and pushes it to the OneLens bucket for analysis.

### **External Dependencies**

* **S3/GCS**: A storage service used to temporarily hold cluster data before it is processed by the OneLens platform, encrypted with KMS
* **ECR (Elastic Container Registry)**: Stores container images for the OneLens components, which are pulled during pod startup or restarts.
* **OneLens Backend:** Provides runtime configuration to the Exporter.

{% hint style="info" %}
The tools and source codes are referenced in the [Artifacts](/integrations/kubernetes/onelens-agent/artifacts) section.
{% endhint %}

{% hint style="warning" %}

## Privacy and Security

The OneLens K8 Agent is designed with privacy and security in mind:

* **Read-Only Access**: The agent operates with **read-only access** to your cluster, meaning it only collects data and **does not modify** any resources or configurations.
* **No Access to Secrets**: The agent does not access secrets, config maps, or sensitive environment variables within your cluster.
* **Encrypted Transmission**: All data is transmitted securely using TLS 1.3, ensuring confidentiality.
* **Access Control**: The S3/GCS bucket where your data is stored is private and can only be accessed through secure, time-limited pre-signed URLs.
  {% endhint %}

## Data Retention

After setup, the agent starts collecting data and storing it in the Prometheus server. The retention of data depends on the number of pods in your cluster. The recommended configuration is to use **dynamic scaling for Prometheus**, with a PVC size of 10GB.&#x20;

Here’s an estimate of how long your data will be retained:

| Pod Count  | Retention Period     |
| ---------- | -------------------- |
| 10-50      | 45 Days              |
| 50-100     | 30 Days              |
| 100-500    | 10 Days              |
| Beyond 500 | Proportionally Lower |

## Cost Associated with Agent

The OneLens agent runs as a set of **lightweight pods** within the cluster. These pods monitor container-level metrics, resource limits, and usage trends. The cost structure is mainly influenced by the number of pods in the cluster.

The agent incurs a cost per cluster, based on pod count:

| Cluster Size (Pods) | CPU (Cores) | Memory (GB) | Total Monthly Cost ($) |
| ------------------- | ----------- | ----------- | ---------------------- |
| < 100               | 0.237       | 1.33        | \~ $3                  |
| 100-499             | 0.386       | 1.92        | \~ $6                  |
| 500-999             | 0.587       | 3.70        | \~ $17                 |
| 1000-1499           | 0.696       | 5.47        | \~ $22                 |
| 1500-2000           | 0.805       | 7.25        | \~ $27                 |

Please note that we run our agent pods on shared nodes. The given pricing is an indication and actual price depends on node which the pods are placed.\
For further details on how to set up the agent and onboard a cluster, visit the [Onboarding a K8s Cluster](/integrations/kubernetes/onelens-agent/onboarding-a-k8s-cluster) section.


# Onboarding a K8s Cluster

Onboarding your Kubernetes (EKS/AKS) cluster to OneLens is quick and easy. By following the steps below, you will integrate your kubernetes cluster with OneLens.

{% hint style="success" %}

### **RBAC Permission Required**

To set up the OneLens K8 Agent, user who will be executing the Helm charts needs to have the following **RBAC permissions.** This is a one-time requirement.

```yaml
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]
```

{% endhint %}

## Onboarding Checklist

Before you onboard your cluster, you need to verify that all the necessary prerequisites are in place.&#x20;

Use the below command to quickly verify the prerequisites:

```bash
curl -sSL https://raw.githubusercontent.com/astuto-ai/onelens-installation-scripts/refs/heads/master/scripts/prereq-check/onelens-prereq-check.sh | bash
```

This script will automatically check your cluster's configuration and let you know if anything needs to be adjusted.

## Onboarding Process: Video Guide

Here is the detailed video showcasing how you can setup the OneLens Agent in your kubernetes cluster.&#x20;

{% embed url="<https://youtu.be/RIvO0ziukBw>" %}

## Step-by-Step Guide

Follow these steps to onboard your Kubernetes cluster. You can execute them locally or from a bastion server that has access to your clusters.

### 1. **Verify Prerequisites**

Ensure you meet all the prerequisites outlined above before proceeding.

### 2. **Select the EKS Cluster**

Use **`kubectl`** to set the context to the cluster you want to onboard:

```bash
kubectl config use-context <cluster-name>
```

This command targets the correct cluster for the OneLens Agent deployment.

{% hint style="danger" %}

#### **Precaution**

Make sure you are running the onboarding script on the **correct cluster**. Copying and pasting a script generated for one cluster into a different cluster's context can cause errors or misconfiguration.
{% endhint %}

### **3**. **Run the Onboarding Script**

Log into the **OneLens UI** and select the cluster you want to onboard.

Click on the **plus** icon.&#x20;

<figure><img src="/files/PdZGcVYHWUZT1Gt0mb1e" alt=""><figcaption></figcaption></figure>

The UI will automatically generate a deployment command for the selected cluster.

Copy the onboarding script.

Here’s the format of setup command that you’ll will get:

```sh
helm upgrade --install onelensdeployer onelens/onelensdeployer \
--set job.env.CLUSTER_NAME="<cluster_name>" \
--set job.env.REGION="<region>" \
--set-string job.env.ACCOUNT="<account_id>" \
--set job.env.REGISTRATION_TOKEN="<registration_token>"
```

<figure><img src="/files/jtM8b6JwMR0wGbeHBybd" alt=""><figcaption></figcaption></figure>

Run it in your terminal.<br>

### 4. **Verification**

It will take around 2-3 minutes for the deployment of the agent in your cluster.&#x20;

After the agent deployment, the status in the OneLens UI will show as **`Connecting`**.

<figure><img src="/files/NbmHphpT5tZXsHqOB3Fy" alt=""><figcaption></figcaption></figure>

The status will update to **`Connected`** within 1–2 hours, once data is received on our end.

<figure><img src="/files/Y2VB52muVImQvWjEXbp1" alt=""><figcaption></figcaption></figure>

Finally, simply click on the cluster name to view detailed insights and analysis.

## Upgrade the OneLens Agent

{% hint style="info" %}
Currently the process is manual. OneLens team will reach out to you in order to perform new patches on each integrated cluster. The following process outlines the approach we are working on, in order to make this seamless.
{% endhint %}

You can initiate OneLens agent upgrades directly from your OneLens account. The console displays the available patch version along with detailed release notes. You can select the clusters to patch, and the request will be routed to the authorized owner in your organization for approval.

### How Patching is executed in you Cluster

* OneLens Updater is responsible for the patch process.
* It runs daily at **2:00 AM UTC** and checks via OneLens APIs whether the current cluster is approved for patching.
* If a request is found, it applies the patch without manual intervention.

#### Patch Command

Following patch command will be executed by OneLens Updater, ensuring the existing configurations are used:

```bash
helm upgrade onelens-agent onelens/onelens-agent --version=<latest-release> -n onelens-agent
```


# Artifacts

The complete Kubernetes agent setup uses **Helm charts** for deployment, ensuring consistent and reproducible installations across environments.

To set up the agent in your cluster, there are three key parts:

1. **Deployer** – A one-time job that installs all required components.
2. **Agent** – A continuously running service consisting of Exporter, Prometheus and OpenCost.
3. **Updater** - Maintain and patches the agent as and when new updates are available.  &#x20;

Everything listed here is accessible so you can review, audit, and verify what’s being installed in your environment.

{% hint style="success" %}
To download container images hosted on Amazon ECR Public, run the following command to authenticate your Docker client:

```bash
aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/w7k6q5m9
```

{% endhint %}

{% hint style="info" %}

### 1. OneLens Deployer (job)

The OneLens Deployer is a one-time Kubernetes job designed to onboard your EKS/AKS cluster seamlessly. Deployed using a Helm chart, it sets up all necessary OneLens agent components on your cluster.

* **Deployment:** One-time Kubernetes **job** deployed via Helm.
* **Function:** Installs the full OneLens agent stack on the EKS/AKS cluster.
* **Permissions:** Temporarily adopts the following RBAC permissions to deploy required resources. These permissions grant cluster-wide, unrestricted access across all API groups, resources, and actions. This is necessary because the job handles setup tasks that may span multiple namespaces, involve multiple resource types (e.g., ConfigMaps, Secrets, CRDs), and require administrative-level control.
  * ```yaml
    # Bootstrap permissions (TEMPORARY - auto-deleted after installation)
    rules:
      # Namespace creation
      - apiGroups: [""]
        resources: ["namespaces"]
        verbs: ["create"]
      # StorageClass creation
      - apiGroups: ["storage.k8s.io"]
        resources: ["storageclasses"]
        verbs: ["create"]
      # ClusterRole creation
      - apiGroups: ["rbac.authorization.k8s.io"]
        resources: ["clusterroles"]
        verbs: ["create"]
      # ClusterRoleBinding creation
      - apiGroups: ["rbac.authorization.k8s.io"]
        resources: ["clusterrolebindings"]
        verbs: ["create"]
    ```
* **Lifecycle:** No OneLens resource will have these RBAC permissions after onboarding the agent.
* **Cleanup Post-Onboarding**: Once onboarding is complete, the `onelensdeployer` job **automatically deletes itself**. You can verify this behavior by referring to the final line of the installation script.
  * [Installation Script](https://github.com/astuto-ai/onelens-installation-scripts/blob/master/install.sh)
* **Source Code**
  * Repository: [GitHub Link](https://github.com/astuto-ai/onelens-installation-scripts/tree/master/charts/onelensdeployer)
* **Full Package**
  * Helm Chart: [Package Link](https://github.com/astuto-ai/onelens-installation-scripts/blob/master/onelensdeployer-0.1.0.tgz)
* **Container Image**
  * ECR Public Image:&#x20;

    ```
    public.ecr.aws/w7k6q5m9/onelens-deployer
    ```

{% endhint %}

{% hint style="info" %}

### 2. OneLens Agent

The OneLens Agent is a set of components deployed on your Kubernetes cluster to collect cost and usage metrics.

* **Source Code**
  * **OneLens Exporter**&#x20;
    * Kind : Cronjob
    * Hourly job that collects cost and usage metrics from Prometheus and uploads them to S3/GCS.
    * Repository: [GitHub Link](https://github.com/astuto-ai/onelens-installation-scripts/tree/master/charts/onelens-agent)
  * **Prometheus**&#x20;
    * Kind: Deployment&#x20;
    * Uses the **open-source Prometheus** for metrics collection.
    * Repository: [GitHub Link](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack)
  * **OpenCost**&#x20;
    * Kind: Deployment&#x20;
    * Uses the **open-source OpenCost** for Kubernetes cost visibility.
    * Repository: [Github Link](https://github.com/opencost/opencost)
* **Permissions:** Access is limited to workload metadata (Pods, Deployments, Nodes, HPAs) required for cost attribution and optimization recommendations. The agent has no access to sensitive data such as Secrets, ConfigMaps, or application payloads
  * ```yaml
    rules:
    # Core API resources
    - apiGroups: [""]
      resources: ["nodes", "pods", "namespaces"]
      verbs: ["get", "list"]

    # Apps API resources
    - apiGroups: ["apps"]
      resources: ["deployments", "daemonsets", "statefulsets"]
      verbs: ["get", "list"]

    # Batch API resources
    - apiGroups: ["batch"]
      resources: ["jobs", "cronjobs"]
      verbs: ["get", "list"]

    # Autoscaling API resources
    - apiGroups: ["autoscaling"]
      resources: ["horizontalpodautoscalers"]
      verbs: ["get", "list"]

    # Allow API discovery for DynamicClient
    - nonResourceURLs: ["/api", "/api/*", "/apis", "/apis/*"]

    ```
* **Full Package**
  * Helm Chart: [Package Link](https://github.com/astuto-ai/onelens-installation-scripts/blob/master/onelens-agent-0.1.1-beta.3.tgz)
* **Container Image**
  * ECR Public Image:&#x20;

    ```
    public.ecr.aws/w7k6q5m9/onelens-agent
    ```

{% endhint %}

{% hint style="info" %}

## 3. OneLens Updater&#x20;

The OneLens Updater is responsible for daily maintenance and patching of the OneLens agent. It runs automatically **every day at 2:00 AM UTC**.

* **Deployment:** Deployed during initial onboarding as a **Cronjob**.
* **Function:** Checks patches. looks for user's approval and **applies** them to the OneLens agent.
* **Permissions:** Uses **RBAC permissions** to read resource states, verify configurations, and apply patches.

  ```yaml
  rules:
    # Full control ONLY within onelens-agent namespace
    - apiGroups: ["*"]
      resources: ["*"]
      verbs: ["*"]
      # Scoped to onelens-agent namespace only via RoleBinding

    # Manage ONLY OneLens-owned cluster resources (restricted by resourceNames)
    - apiGroups: ["storage.k8s.io"]
      resources: ["storageclasses"]
      verbs: ["*"]
      resourceNames: ["onelens-sc"]

    - apiGroups: ["rbac.authorization.k8s.io"]
      resources: ["clusterroles", "clusterrolebindings"]
      verbs: ["*"]
      resourceNames:
        - onelens-agent-workload-reader
        - onelens-agent-workload-reader-binding
        - onelens-agent-prometheus-server
        - onelens-agent-kube-state-metrics

    # Cluster-wide READ-ONLY for monitoring
    - apiGroups: [""]
      resources: ["nodes", "pods", "services", "namespaces"]
      verbs: ["get", "list", "watch"]
    - apiGroups: ["apps"]
      resources: ["deployments", "daemonsets", "statefulsets"]
      verbs: ["get", "list", "watch"]
  ```
* **Lifecycle:** Remains active post-onboarding to support automated daily updates.
  {% endhint %}


# Enable Split Cost Allocation for EKS

To view pod-level EKS costs in OneLens, you need to enable split cost allocation from two places in your AWS account:

1. **CUR Preferences** – to include split cost allocation data in the Cost and Usage Report (CUR).

{% hint style="success" %}
The **Split Cost Allocation Data option in CUR preferences** is already enabled for you during onboarding through CloudFormation Templates (CFTs).
{% endhint %}

2. **Cost Management Preferences** – to opt in to EKS cost allocation.

{% hint style="danger" %}

### Warning: Require Payer and Regular Account Access

Split cost allocation must be configured from a **Payer and Regular account** in AWS Cost Management Preferences. If you do not have access to the payer account or if it is managed by an external third-party provider, **please raise a ticket** with **Payer Account Owner or the provider** to enable split cost allocation.

When using an unsupported account, you'll see the following message:

![](/files/dAzUlLPF1ftV9Ppj3N8i)
{% endhint %}

## Step-by-Step Guide

{% stepper %}
{% step %}

### **Enable EKS Split Cost Allocation**

1. Open the [**AWS Cost Management Console**](https://us-east-1.console.aws.amazon.com/costmanagement/home#/home).
2. In the left menu, select <kbd>**Cost Management Preferences**</kbd>.
3. Under **Split cost allocation data**:
   1. Select <kbd>**Amazon Elastic Kubernetes Service**</kbd>
   2. Choose <kbd>**Resource Requests**</kbd>

<figure><img src="/files/1qp95EB0pIaXvLh34Lfj" alt="" width="563"><figcaption></figcaption></figure>

4. Click <kbd>**Save Preferences**</kbd> at the bottom right.
   {% endstep %}

{% step %}

### Ensure Required Tags Are Enabled

After enabling split cost allocation, AWS automatically creates and activates the following cost allocation tags **in your payer account**:

* `aws_eks_cluster_name`
* `aws_eks_namespace`
* `aws_eks_node`
* `aws_eks_workload_type`
* `aws_eks_workload_name`
* `aws_eks_deployment`

These tags must remain enabled for OneLens to attribute pod-level costs accurately.

{% hint style="warning" %}

## **Note**

If any of the AWS-generated EKS tags were previously disabled in your account, enabling split cost allocation will **not** automatically reactivate them. You must manually enable those tags from the [**Cost Allocation Tags**](https://us-east-1.console.aws.amazon.com/costmanagement/home#/tags) page in the Billing Console.
{% endhint %}

**To verify:**

1. Go to [**Cost Allocation Tags**](https://us-east-1.console.aws.amazon.com/costmanagement/home#/tags) in the AWS Billing Console.
2. Open the <kbd>**AWS-Generated Tags**</kbd> tab.
3. Filter by **`eks`.**
4. Ensure all required tags are enabled and active.

   <figure><img src="/files/etgp7BsRzMYLG1JXaH3k" alt="" width="563"><figcaption></figcaption></figure>

{% endstep %}
{% endstepper %}

After the setup, your CUR will start including pod-level cost breakdowns. OneLens will use this data to provide deeper visibility into your EKS costs.

## Additional Cost for Split Allocation in EKS

There is **no direct AWS fee** for enabling this feature. However, you may incur an estimated <kbd>**$2.73/month per 10,000 pods**</kbd> due to increased CUR data size and processing overhead.


# Memory Metrics

## Overview

Monitoring memory usage across AWS shouldn’t cost you time or money when it’s not needed. OneLens automatically turns memory metrics **on only when a policy is violated**, and turns them **off when no longer useful** - helping you stay efficient and cost-effective.

## The Problem with Memory Metrics

Memory metrics in AWS are **not enabled by default**. These are **custom metrics** that require the **CloudWatch agent** to be manually installed on each EC2 instance—and AWS charges you for every custom metric collected.

Let’s break down the numbers with an example of **10,000 EC2 instances**

* With memory monitoring enabled on all 10,000 instances, the cost adds up to:

  ```
  10,000 instances × 1 memory metric × $0.30 = $3,000 per month
  ```
* That’s around **$100 per day and $3000/month**, even if you’re not actively using the data.

{% hint style="warning" %}
Reference: [AWS CloudWatch Pricing](https://aws.amazon.com/cloudwatch/pricing/)
{% endhint %}

You’re now left with two options here:

* Keep metrics off and risk missing underutilization.
* Keep metrics on and watch your costs rise without guaranteed insights.

## What OneLens Does Uniquely

OneLens takes a smarter path by activating memory metrics **only where it matters**—based on actual policy violations.

Let’s say you have **10,000 EC2 instances**, and **200 of them** violate a policy such as “**Standalone On-Demand EC2 instances should not be underutilized**” based on only monitoring "**CPU utilization**".  OneLens automatically enables memory metrics on just those 200 instances—not all 10,000.

Here’s what happens next:

* In the **first 2 days**, suppose **150 instances** show memory usage crossing the configured threshold. OneLens disables memory metrics for those 150 immediately and will mark the ticket closed as it is confirmed that utilization is optimal.
* For the remaining **50 instances**, memory metrics continue running for the full **30-day observation period**.
  * If usage remains below the threshold for the entire 30 days, OneLens disables metrics and marks the instance as underutilized.

Then OneLens enters a second phase:

* It **waits for 30 more days** to see if the ticket is closed.
* If the ticket is still open, OneLens **re-enables memory metrics for the next 30-day cycle**, giving you fresh data.
* This loop continues until the ticket is resolved.

{% hint style="success" %}

## Benefits

By only enabling memory metrics **when triggered by policy**, and by continuously cycling based on ticket status, OneLens helps you:

* Avoid unnecessary cost
* Still get the memory data when it actually matters
* Remove the burden of tracking or managing this manually

You stay informed, without overspending.
{% endhint %}

### Setup & Enablement

Memory metrics are **enabled by default in your OneLens tenant**.

However, to start collecting data from specific AWS accounts, you’ll need to **install the memory metrics Runbook** manually in those accounts.

Learn more about [Setup Metrics Collection](/integrations/memory-metrics/setup-metrics-collection)


# Setup Metrics Collection

Memory Metrics in OneLens allows you to monitor memory usage across your AWS accounts. While the feature is **enabled by default in your OneLens tenant**, you’ll need to **perform a one-time setup in each AWS account** where you want to start collecting memory metrics.

## Steps to Connect an AWS Account

1. Log in to [OneLens UI](https://app-in.onelens.cloud/).
2. Navigate to **Integrations** from the left sidebar.
3. Under **Cloud Integration**, select **AWS** and click **View Details**.
4. Switch to the **Memory Metrics** tab.

   You'll see a list of AWS accounts along with their current connection status.

<figure><img src="/files/YCwS3izBeKYaNuRV6iaW" alt="" width="563"><figcaption></figcaption></figure>

5. Click **Connect** next to the account you want to set up.

   A dialog box appears with two setup ways:

{% tabs %}
{% tab title="Ask Someone" %}
Use this when you want another team member to complete the setup.

* You’ll be prompted to **enter the user's email address** and optionally **add a comment** (e.g., “Please complete memory metrics setup for this account”).
* OneLens will send the setup instructions to the specified email.
  {% endtab %}

{% tab title="Connect Yourself" %}
Use this when you want to perform the setup directly.

* You’ll be guided through the exact setup steps based on your AWS environment.
  {% endtab %}
  {% endtabs %}

## Setup Options Based on Your AWS Environment

Depending on your AWS environment, you will need to follow one of the setup paths outlined below:

### 1. Master–Child Setup (AWS Organizations)

Use this method when you want to track memory metrics across an entire AWS Organization with one configuration step on the master account.

{% hint style="warning" %}

## Important

To begin, click **Connect** next to the **master account** in the Memory Metrics tab.
{% endhint %}

{% stepper %}
{% step %}
[**Setup Delegate Account**](#set-up-delegated-account-and-enable-change-manager)

Within your AWS Organization, assign a **delegate account** that will manage deployments across all child accounts using AWS Systems Manager and StackSets.

{% hint style="danger" %}

## **Important**

The **master/payer account cannot be used as a delegated account**. Ensure you create the delegated account from the master account, not as the master account itself.
{% endhint %}
{% endstep %}

{% step %}
[**Enable AWS Change Manager**](#set-up-delegated-account-and-enable-change-manager)

In the delegate account, activate AWS **Change Manager** to allow auditable and secure execution of automated deployments.
{% endstep %}

{% step %}
[**Deploy CloudFormation Template as a StackSet for Child Accounts**](#id-2.-deploy-childcft-as-a-stackset)

Use **StackSets** to roll out the same configuration to all child accounts (including master account).

**Child CFT Link:**

{% code overflow="wrap" %}

```
https://prod-onyx-backend.s3.ap-south-1.amazonaws.com/onyx/aws/cft/onyx-child.template.json
```

{% endcode %}
{% endstep %}

{% step %}
[**Deploy CloudFormation Template as a Stack**](#id-1.-deploy-master-cft-as-a-stack)

Deploy the provided CloudFormation Template (CFT) in the delegate account to configure required IAM roles and data collection setup.

**Master CFT Link:**

{% code overflow="wrap" %}

```url
https://prod-onyx-backend.s3.ap-south-1.amazonaws.com/onyx/aws/cft/onyx-master.template.json
```

{% endcode %}
{% endstep %}
{% endstepper %}

{% hint style="info" %}

## Output of CFT Installation

* IAM roles required for SSM automation and data collection are created.

  Check [#permissions-required](#permissions-required "mention")
* Runbooks for enabling/disabling memory metrics are registered in AWS Change Manager.
* OneLens is now set to manage memory metrics automatically.
  {% endhint %}

### 2. Individual Account Setup

Use this if you prefer to configure memory metrics on a per-account basis or do not use AWS Organizations.

{% stepper %}
{% step %}
[**Enable AWS Change Manager**](#enable-change-manager)

Enable **AWS Change Manager** within the selected account to safely manage and track CloudFormation deployments.

{% hint style="warning" %}

## **Note**&#x20;

For individual accounts, you can skip directly to **Step 6: Setup Change Manager** and continue the setup from there.
{% endhint %}
{% endstep %}

{% step %}
[**Deploy CloudFormation Template as a Stack**](#id-1.-deploy-master-cft-as-a-stack)

Deploy the provided master CloudFormation Template (CFT) to configure the account for memory metrics collection.

**Master CFT Link:**

{% code overflow="wrap" %}

```url
https://prod-onyx-backend.s3.ap-south-1.amazonaws.com/onyx/aws/cft/onyx-master.template.json
```

{% endcode %}
{% endstep %}
{% endstepper %}

{% hint style="success" %}
Repeat these steps for each account you want to track independently.
{% endhint %}

## Set Up Delegated Account & Enable Change Manager

{% stepper %}
{% step %}

#### Locate Change Manager

* Open the AWS Console in your Master Account.
* Search for **`Change Manager`** and select **`Set up organization`**.\
  Note: If you have already set up your AWS Organization, you can skip to **step 6: Setup Change Manager**.&#x20;

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/679ca7392df324ceeced7c82_Frame%2024.png" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}

{% step %}

#### Quick Setup

* On the **`Quick Setup`** page, click **`Create`** under Change Manager.

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/679ca8482df324ceecedb069_Frame%201171275761.png" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}

{% step %}

#### Assign Delegated Account

* From your accounts list, choose one to act as the central account for executing changes.

{% hint style="warning" %}
Note: The Master/Payer account cannot be used.
{% endhint %}

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a1036fb3c9672bc691b813_Install%20Change%20Manager%20step%203.png" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}

{% step %}

#### Configure Permissions

* In the **Permissions to request and make changes** section, create a temporary permission set:

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a104980f53ee2286ffa823_Install%20Change%20Manager%20step%204.png" alt="" width="563"><figcaption></figcaption></figure>

Paste the following JSON Code in the editor.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ssm:*",
      "Resource": "*"
    }
  ]
}
```

* Now locate CloudShell on the bottom left of the screen.

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67bf11b55ba079cc1a6ee25e_Cloudshell.png" alt="" width="563"><figcaption></figcaption></figure>

* When CloudShell opened run these commands\
  Before running the commands, ensure that you specify the correct region where you want to deploy.

{% code overflow="wrap" %}

```sh
aws iam create-service-linked-role --aws-service-name ssm.amazonaws.com --region {region}
```

{% endcode %}

{% code overflow="wrap" %}

```sh
aws iam create-service-linked-role --aws-service-name changemanagement.ssm.amazonaws.com
```

{% endcode %}

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67bf0b92f2f7c20b646819a5_97860f4ce34ddba45578b5dc180adf22_Configure%20Permissions.png" alt="" width="563"><figcaption></figcaption></figure>

* If a command returns an error, first verify the region settings in both your environment and the command. If the region is correct, the error can be ignored.‍
  {% endstep %}

{% step %}

#### Finalize Setup

* Leave remaining fields blank (add tags if needed) and click **`Create`**.

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a10e21480f6f5bcb45f392_Install%20Change%20Manager%20step%205.png" alt="" width="563"><figcaption></figcaption></figure>

* Wait for deployment to complete.

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a10e3683bfc19006953b14_Install%20Change%20Manager%20step%206.png" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}

{% step %}

#### Setup Change Manager

* Navigate to Change Manager, and select **`Settings`**

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a10ea6ed706ccd0a5bb12d_Install%20Change%20Manager%20step%207.png" alt="" width="563"><figcaption></figcaption></figure>

* In the settings page click **`Edit`**.

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a10e5f9bdec0ee2bc3cb6f_Install%20Change%20Manager%20step%208.png" alt="" width="563"><figcaption></figcaption></figure>

* In the edit page, make sure the Change Template review & approval permission is unchecked & save the settings.

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a1140963b58fcbd2cd4d40_Install%20Change%20Manager%20step%209.png" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}

{% step %}

#### Save Organization IDs

* Go to AWS Organizations, **copy your Organization ID and Root ID**, and save them for deploying the CloudFormation Template (CFT).

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a1172997f75ca68ee51029_Install%20Change%20Manager%20step%2010.png" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

## CloudFormation Templates Deployment

### **Permissions Required**

To enable seamless automation while deploying this CloudFormation Template (CFT), we will acquire the necessary permissions for the **Executor** and **Requestor** roles.

Please review the permissions below before proceeding with the deployment.

<details>

<summary>Executor Role Permissions</summary>

| Service               | Summary                                                                                                    |
| --------------------- | ---------------------------------------------------------------------------------------------------------- |
| IAM RoleManagement    | Pass the Onyx-Execution-Role                                                                               |
| SSM Parameters        | Get and put parameters under parameter/onyx/\*                                                             |
| EventBridge Rules     | Full access to EventBridge rules starting with Onyx-\*                                                     |
| EC2 Operations        | Read and write permissions for managing auto-scaling groups, EC2 instance profiles, IAM roles and policies |
| SSM Parameters        | Full access to all SSM operations                                                                          |
| SNS                   | Publish to SNS topics prefixed with Automation\* or onyx-\*                                                |
| S3 Bucket Access      | Read access to S3 buckets/objects matching \*-onyx-\*                                                      |
| SQS Queue Access      | Full access to Onyx-Orchestrator-Queue                                                                     |
| Scheduler Permissions | Full access to schedule group Onyx-Orchestrator-Schedule-Group                                             |
| Auto Scaling & EC2    | Describe and manage Auto Scaling groups and EC2 instance profiles                                          |
| IAM                   | Manage IAM roles and policies, attach policies, and pass roles                                             |
| Lambda                | Read and update Lambda functions and layers                                                                |
| Tagging               | Add and manage tags for resources                                                                          |

{% code title="JSON" fullWidth="false" %}

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DeleteSnapshot",
        "ec2:DescribeInstanceStatus",
        "ec2:CreateTags",
        "ec2:DeleteTags",
        "ec2:DescribeTags",
        "ec2:AssociateIamInstanceProfile",
        "ec2:DescribeAddresses",
        "ec2:DescribeIamInstanceProfileAssociations",
        "ec2:DescribeInstances",
        "ssm:*",
        "cloudwatch:GetMetricData",
        "cloudwatch:GetMetricStatistics",
        "iam:AddRoleToInstanceProfile",
        "iam:AttachRolePolicy",
        "iam:CreateInstanceProfile",
        "iam:CreateRole",
        "iam:GetInstanceProfile",
        "iam:GetPolicy",
        "iam:GetRole",
        "iam:ListInstanceProfiles",
        "iam:ListInstanceProfilesForRole",
        "iam:ListRolePolicies",
        "iam:GetRolePolicy",
        "tag:TagResources"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:Get*", "s3:List*"],
      "Resource": ["arn:aws:s3:::*-onyx-*", "arn:aws:s3:::*-onyx-*/*"]
    },
    {
      "Effect": "Allow",
      "Action": "sqs:*",
      "Resource": "arn:aws:sqs:ap-southeast-1:471112792234:Onyx-Orchestrator-Queue"
    },
    {
      "Effect": "Allow",
      "Action": "sns:Publish",
      "Resource": ["arn:aws:sns:*:*:onyx-*", "arn:aws:sns:*:*:Automation*"]
    },
    {
      "Effect": "Allow",
      "Action": "scheduler:*",
      "Resource": [
        "arn:aws:scheduler:*:*:schedule-group/Onyx-Orchestrator-Schedule-Group",
        "arn:aws:scheduler:*:*:schedule/Onyx-Orchestrator-Schedule-Group/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:*:*:function:Automation*"
    },
    {
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "arn:aws:iam::471112792234:role/Onyx-Execution-Role"
    },
    {
      "Effect": "Allow",
      "Action": ["ssm:GetParameter", "ssm:PutParameter"],
      "Resource": "arn:aws:ssm:*:*:parameter/onyx/*"
    },
    {
      "Effect": "Allow",
      "Action": "events:*",
      "Resource": "arn:aws:events:*:*:rule/Onyx-*"
    },
    {
      "Effect": "Allow",
      "Action": ["iam:CreatePolicy", "iam:PutRolePolicy"],
      "Resource": [
        "arn:aws:iam::471112792234:policy/Onyx-*",
        "arn:aws:iam::471112792234:role/Onyx-*"
      ]
    }
  ]
}‍
```

{% endcode %}

</details>

<details>

<summary>Requestor Role Permissions</summary>

| Service          | Summary                                                                  |
| ---------------- | ------------------------------------------------------------------------ |
| ECR              | Get Image for Lambda Execution                                           |
| Organizations    | List accounts for parent                                                 |
| SSM (OpsItem)    | Get OpsItem, list OpsItem events                                         |
| SSM (Documents)  | Add tags, create, delete, get, and update documents prefixed with Onyx\* |
| EventBridge      | List tags for EventBridge rules prefixed with Onyx-                      |
| SSM (Automation) | Start change request execution for automations prefixed with Onyx\*      |
| SSM (Automation) | Add tags, get automation execution details                               |
| S3 Bucket Access | Get and list access for S3 buckets and objects matching \*-onyx-\*       |
| SQS Queue Access | Full access to Onyx-Orchestrator-Queue                                   |
| SNS              | Publish to SNS topics prefixed with onyx-\*                              |

{% code title="JSON" %}

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents",
        "ecr:BatchCheckLayerAvailability",
        "ecr:DescribeRepositories",
        "ecr:GetAuthorizationToken",
        "ecr:GetDownloadUrlForLayer",
        "organizations:ListAccountsForParent",
        "ssm:GetOpsItem",
        "ssm:ListOpsItemEvents"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:Get*", "s3:List*"],
      "Resource": ["arn:aws:s3:::*-onyx-*", "arn:aws:s3:::*-onyx-*/*"]
    },
    {
      "Effect": "Allow",
      "Action": "sqs:*",
      "Resource": "arn:aws:sqs:ap-southeast-1:471112792234:Onyx-Orchestrator-Queue"
    },
    {
      "Effect": "Allow",
      "Action": "sns:Publish",
      "Resource": "arn:aws:sns:*:*:onyx-*"
    },
    {
      "Effect": "Allow",
      "Action": "scheduler:*",
      "Resource": [
        "arn:aws:scheduler:*:*:schedule-group/Onyx-Orchestrator-Schedule-Group",
        "arn:aws:scheduler:*:*:schedule/Onyx-Orchestrator-Schedule-Group/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": [
        "arn:aws:iam::471112792234:role/Onyx-Orchestrator-Role",
        "arn:aws:iam::471112792234:role/Onyx-Execution-Role"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "ssm:AddTagsToResource",
        "ssm:CreateDocument",
        "ssm:DeleteDocument",
        "ssm:GetDocument",
        "ssm:UpdateDocument",
        "ssm:UpdateDocumentDefaultVersion",
        "ssm:UpdateDocumentMetadata",
        "ssm:UpdateOpsItem"
      ],
      "Resource": "arn:aws:ssm:*:471112792234:document/Onyx*"
    },
    {
      "Effect": "Allow",
      "Action": "events:ListTagsForResource",
      "Resource": "arn:aws:events:*:*:rule/Onyx-*"
    },
    {
      "Effect": "Allow",
      "Action": "ssm:StartChangeRequestExecution",
      "Resource": "arn:aws:ssm:*:*:automation-definition/Onyx*:*"
    },
    {
      "Effect": "Allow",
      "Action": ["ssm:AddTagsToResource", "ssm:GetAutomationExecution"],
      "Resource": "arn:aws:ssm:*:*:automation-execution/*"
    },
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::*:role/Onyx-Execution-Role*"
    }
  ]
}
```

{% endcode %}

</details>

### 1. Deploy Master CFT as a Stack

1. Log in to the Delegated Account chosen while setting up the Change Manager.
2. Navigate to CloudFormation and click **`Create Stack`**.

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a12d02b0cb4ed236462d87_Create%20Master%20stack%20step%201.png" alt="" width="563"><figcaption></figcaption></figure>

3. Choose **`Use an existing template`**.
4. Use this URL to paste in template section.

   <pre class="language-url" data-overflow="wrap"><code class="lang-url">https://prod-onyx-backend.s3.ap-south-1.amazonaws.com/onyx/aws/cft/onyx-master.template.json
   </code></pre>

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a12de380436f4779a57687_Create%20Master%20stack%20step%202.png" alt="" width="563"><figcaption></figcaption></figure>

4. Provide a stack name, keep the Environment as "**prod**," and Region to "**mum**" (change region to "us" if in the US region).
5. Enter your Organization ID (Only if you have master-child setup.)

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a12e2c5589eeae7c2e3c50_Create%20Master%20stack%20step%203.png" alt="" width="563"><figcaption></figcaption></figure>

6. Add tags as needed, acknowledge role creation, and click "**Submit.**"

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a12e872358ed1879ac7808_Create%20Master%20stack%20step%204.png" alt="" width="563"><figcaption></figcaption></figure>

7. Wait for deployment to complete.

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a12f73ba368cd775e149c3_Create%20Master%20stack%20step%205.png" alt="" width="563"><figcaption></figcaption></figure>

### **2. Deploy Child CFT as a Stackset**

1. Log in to the Delegated Account.
2. Navigate to CloudFormation, select StackSets and click **`Create Stack`**.

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a13d6ca2c4b2ed3dfd679c_Create%20Child%20Stack%20step%201.png" alt="" width="563"><figcaption></figcaption></figure>

3. Select "**Service-managed permissions**" as the Permission Model.
4. Use this URL to paste in template section.

   <pre class="language-url" data-overflow="wrap"><code class="lang-url">https://prod-onyx-backend.s3.ap-south-1.amazonaws.com/onyx/aws/cft/onyx-child.template.json
   </code></pre>

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a13d8bc22794ae4280bb65_Create%20Child%20Stack%20step%202.png" alt="" width="563"><figcaption></figcaption></figure>

5. Select a Preferred Stack Name
6. Enter the Delegated Account ID, keep the Environment as "**prod**," and Region to "**mum**" (change region to "us" if in the US region) for deploying the Child Stack.

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a13da34902191980bf7fe4_Create%20Child%20Stack%20step%203.png" alt="" width="563"><figcaption></figcaption></figure>

7. Add any desired tags and click **Next**.

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a13f1bc22794ae42825bbb_Create%20Child%20Stack%20step%204.png" alt="" width="563"><figcaption></figcaption></figure>

8. Select **`Deploy new stacks`**. &#x20;
9. Under Deployment targets, choose **`Deploy to organizational units`**.
10. Enter the root OU ID saved earlier.
11. For Account filter type, select **`Difference`** and input the Delegated Account ID in the Account numbers section.

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a13df3d3e1288b367148fd_Create%20Child%20Stack%20step%205.png" alt="" width="563"><figcaption></figcaption></figure>

12. Select a region where you want to deploy the child stack.

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a13f4f30f617979380209b_Create%20Child%20Stack%20step%206.png" alt="" width="563"><figcaption></figcaption></figure>

13. Define the maximum concurrent accounts linked in your organization. Select **Parallel** for region concurrency and click **Next**.

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a13f667e4ccb7872b9b94d_Create%20Child%20Stack%20step%207.png" alt="" width="563"><figcaption></figcaption></figure>

14. Acknowledge IAM role creation and click **`Submit`**.

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a13f8b7bcd13d2a264a4f9_Create%20Child%20Stack%20step%208.png" alt="" width="563"><figcaption></figcaption></figure>

15. Allow deployment to complete.

<figure><img src="https://cdn.prod.website-files.com/654cc1953659fbce12c35b03/67a13f9b4d2b21ca87e40733_Create%20Child%20Stack%20step%209.png" alt="" width="563"><figcaption></figcaption></figure>

## Post-Setup

Once the setup is complete, the **connection status** in the **Memory Metrics** tab will update to **Connected** for the configured account.

From this point forward:

* **OneLens will automatically manage the enabling and disabling of memory metrics** in your account as needed.
* **Memory usage data will begin flowing automatically** into your OneLens dashboard without requiring any manual intervention.


# Cost Reporting

## Overview

Cost Reporting in OneLens is your command center for understanding and managing cloud spend. It gives you the clarity to see where your money is going, why it’s being spent, and how you can optimize it.

With these reports, you can:

* Break down your costs exactly the way you want—by service, region, account, resource, or tags.
* Track spending trends over time and spot unusual changes before they become problems.
* Align cloud costs with your business objectives and cost centers.
* Share clear, actionable insights with your team or stakeholders.
* Cost Reporting provides unified visibility across all connected cloud providers - AWS, Azure, GCP, and OCI - in one place.

## Your Cost Reporting Tools

### [**Cost Atlas**](/observe-visibility-and-insights/cost-reporting/cost-atlas)

Quickly drill into your spending from any angle. Group and filter costs to isolate specific drivers -whether it’s a single resource, a particular region, or an entire service.

### **Persona-Wise Reports**

See reports built around your role. Whether you’re driving technical efficiency, financial control, or product delivery, you get the most relevant insights without wading through unnecessary data.

### [**Dashboards**](/observe-visibility-and-insights/cost-reporting/dashboards)

Track the metrics that matter most to you, all in one view. Dashboards give you real-time visibility by aggregating multi-cloud costs, trends, and savings progress.

### **Cost Allocation Report**

Easily assign costs to the right teams, projects, or cost centers. This gives you transparency, supports chargeback or showback, and keeps everyone accountable for their part of the spend.


# Cost Atlas

You can use Cost Atlas to view and break down your cloud spend across accounts, services, regions, resources, and usage types. It supports grouping, filtering, and cost-type selection to help you analyze spend patterns.

Cost Atlas provides unified cost analysis across all connected cloud providers - AWS, Azure, GCP, and OCI.

## How to View the Cost Atlas

1. Log into OneLens.
2. Navigate to the Cost Atlas from the main dashboard.

Here is how the dashboard will look like:

<figure><img src="/files/SX24SiS8gSRRWIO7Zq8a" alt=""><figcaption></figcaption></figure>

### Saved View

Start with the **default view or predefined view** for a quick overview, or switch to a saved **view** to tailor the dashboard layout and focus.

<figure><img src="/files/YV9EuTxA2rXxmnB4OVga" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}

## Default View

By default, the **Cost Atlas** opens with the following configuration:

* **Date Range:** Last 2 weeks
* **Cost Type:** Unblended cost
* **Granularity:** Daily
* **Group By:** Resource

If you mark a **custom view** as favourites, that view will **replace the above system default** as your new **default view**. The next time you open the page, your starred view (with its filters, grouping, and settings) will load automatically.

Learn how to [save custom views](/observe-visibility-and-insights/cost-reporting/cost-atlas/saved-views).
{% endhint %}

### Configure a Cost Report

To learn how to apply time filters, groupings, cost types, and filters, see [Configuring a Cost Report](/observe-visibility-and-insights/cost-reporting/cost-atlas/configuring-a-cost-report).

## Analyzing Cost Data

Once your report is configured, you can analyze cost data using key metrics and visual trends.

### a. Key Metrics

**Total Cost**: Shows your overall cloud expenditure for the selected period.

**Total Cost Delta**: Highlights variations in costs compared to the corresponding previous period, helping you track increases or reductions.

{% hint style="info" %}
You can **set the timeframe of the previous period** for comparison, allowing for flexible and context-specific analysis.
{% endhint %}

**Cost MTD (Month-to-Date)**: Displays the total accumulated cost from the start of the current month to the present date.

### **b. Table**

The table view includes the following key columns:

{% tabs %}
{% tab title="Total Cost" %}

* Displays overall spending for the selected period.
  {% endtab %}

{% tab title="Previous Cost" %}
Refers to the cloud costs from the time period directly before the one you are currently viewing. For example:

* If you are looking at costs for the month of March, the Previous Cost will show the expenses from February (the month immediately before March).
* If you're looking at costs for a specific week, the Previous Cost will display the costs from the week before the one you selected.
  {% endtab %}

{% tab title="Delta Cost" %}

* Highlights the difference between the selected and previous periods.
* You can view this cost  either in:
  * **Dollar Value**
  * **Percentage**
    {% endtab %}

{% tab title="Time Granularity" %}

* Daily, weekly, or monthly breakdowns based on the selected granularity.
  {% endtab %}

{% tab title="Display Option" %}

* Each row in the table contains a **Display** option. This option allows users to highlight data in the chart, focusing on specific cost patterns visually.

<figure><img src="/files/gBDEROjT1y1V42CLzHyI" alt="" width="375"><figcaption></figcaption></figure>
{% endtab %}
{% endtabs %}

{% hint style="success" %}

## Heatmap Mode

Heatmap mode is built into the cost table and always stays active. It automatically shades each cell based on its relative value to others in the same column. Higher costs appear with darker intensity, making it easy to spot spikes, dips, and outliers at a glance—no extra configuration needed.
{% endhint %}

## Focus Mode

Focus Mode helps you isolate rows that show significant cost deviations. Enable it using the toggle available in the table section.

<figure><img src="/files/TCeUCNLEKH911NzzcQVx" alt="" width="563"><figcaption></figcaption></figure>

**Configuration Steps**\
When enabling Focus Mode, you can apply the following conditions to refine the table:

1. **Set a threshold for average period** – Display only rows where the average cost for the selected period is higher than your defined threshold.
2. **Cost is lower than** – Hide rows with costs falling below the specified value.
3. **Rows do not match deviation parameters** – Exclude rows that do not meet the configured deviation thresholds (useful for anomaly-focused analysis).

**Use Cases**

* **Day-wise cost tracking** – Quickly detect daily anomalies or unusual spikes.
* **Month-to-month cost tracking** – Identify significant changes between months to spot trends or possible inefficiencies.

<figure><img src="/files/6OyunvrCMSRUU1E6zxzW" alt="" width="375"><figcaption></figcaption></figure>

## Export Cost Report

You can also export cost reports for offline analysis and sharing with stakeholders:

1. Click on the **Export** button in the Cost Atlas section.
2. Select the preferred format for your report:
   1. **CSV**: Ideal for detailed data analysis and manipulation.
   2. **Excel**: Provides a spreadsheet version of the cost report.

<figure><img src="/files/KHlJk42GUMtT2OzWDFfK" alt=""><figcaption></figcaption></figure>

#### Sample Export Preview

Below is a sample of how the exported file might look:

<figure><img src="/files/Nnmv3QN0WZ6HvvNAc8w0" alt="" width="563"><figcaption></figcaption></figure>


# Configuring a Cost Report

Use the configuration options in Cost Atlas to control the scope, structure, and type of cost data you want to analyze. You can adjust time filters, grouping levels, filters, and cost type to generate custom reports based on your analysis requirements.

### Date Range

* **Predefined Range:** Quickly access relevant cost data by selecting a range such as “Last 2 Weeks” or “Month-to-Date”.
* **Custom Range**: If you need to analyze costs over a specific period, define a custom date range to focus on the exact time frame.

<img src="/files/0lkAlLWUTfJRuS1BkECR" alt="" width="375">

### **Granularity Method**

You can aggregate cost data in three different ways, depending on the granularity you need for your analysis:

* **Daily**
* **Weekly**
* **Monthly**

<img src="/files/ZDuf5NRgzJxxRCtSJpU5" alt="" width="375">

### **Cost Representation Type**

You can choose the most relevant Cost Representation Type to gain the insights you need:

* **Unblended Cost** – Shows the raw usage cost at standard rates, before credits or account-level discounts.
* **Net Unblended Cost** – Reflects the actual billed amount after applying credits and discounts to unblended costs.
* **Blended Cost** – Distributes shared resource costs across linked accounts, offering an averaged view under consolidated billing.
* **Amortized Cost** – Spreads upfront Reserved Instance or Savings Plan fees evenly across the commitment period for long-term visibility.
* **Net Amortized Cost** – Combines amortized costs with credits and discounts to reveal your true, all-in long-term spending.

<img src="/files/eHWLGgnrld7mdRCxArLg" alt="" width="375">

### Grouping Costs

To help structure and analyze your cloud expenditure, you can group your cost data by various dimensions.

<details>

<summary>You can <strong>group by</strong> using the following dimensions:</summary>

<table><thead><tr><th width="113">Cloud</th><th width="194">Group By Option</th><th width="311">Description</th></tr></thead><tbody><tr><td>AWS</td><td><strong>Account</strong></td><td>AWS account.</td></tr><tr><td>AWS</td><td><strong>API Operation</strong></td><td>Specific API operations performed.</td></tr><tr><td>AWS</td><td><strong>Availability Zone</strong></td><td>AWS Availability Zone where resources are deployed.</td></tr><tr><td>AWS</td><td><strong>Billing Entity</strong></td><td>Billing entity associated with the usage.</td></tr><tr><td>AWS</td><td><strong>Charge Type</strong></td><td>Charge classification such as usage, recurring, or one-time fees.</td></tr><tr><td>AWS</td><td><strong>Cost Center</strong></td><td>Assigned cost center.</td></tr><tr><td>AWS</td><td><strong>Cost Center Category</strong></td><td>Defined cost center categories.</td></tr><tr><td>AWS</td><td><strong>Database Engine</strong></td><td>Database engine type (e.g., MySQL, PostgreSQL).</td></tr><tr><td>AWS</td><td><strong>Instance Type</strong></td><td>EC2 or database instance type.</td></tr><tr><td>AWS</td><td><strong>Legal Entity</strong></td><td>Legal entity associated with the account.</td></tr><tr><td>AWS</td><td><strong>Platform</strong></td><td>Operating system or platform type.</td></tr><tr><td>AWS</td><td><strong>Purchase Option</strong></td><td>Reserved, on-demand, or other purchase options.</td></tr><tr><td>AWS</td><td><strong>Region</strong></td><td>AWS region.</td></tr><tr><td>AWS</td><td><strong>Resource</strong></td><td>Individual resource identifiers.</td></tr><tr><td>AWS</td><td><strong>Service</strong></td><td>AWS service.</td></tr><tr><td>All clouds</td><td><strong>Tag</strong></td><td>User-defined tags.</td></tr><tr><td>AWS</td><td><strong>Tenancy</strong></td><td>Resource tenancy (shared or dedicated).</td></tr><tr><td>AWS</td><td><strong>Usage Type</strong></td><td>AWS usage type classification.</td></tr><tr><td>All clouds</td><td><strong>Virtual Tag</strong></td><td>Virtual tags created in OneLens for additional categorization.</td></tr><tr><td>Azure</td><td><strong>Benefit Name</strong></td><td>Applied reservation or savings plan name.</td></tr><tr><td>Azure</td><td><strong>Charge Type</strong></td><td>Cost record type classification (usage, purchase, refund)</td></tr><tr><td>Azure</td><td><strong>Frequency</strong></td><td>Billing recurrence indicator</td></tr><tr><td>Azure</td><td><strong>Meter</strong></td><td>Unique billing meter identifier</td></tr><tr><td>Azure</td><td><strong>Meter Category</strong></td><td>Top-level Azure service classification</td></tr><tr><td>Azure</td><td><strong>Meter Subcategory</strong></td><td>Azure service feature or tier breakdown</td></tr><tr><td>Azure</td><td><strong>Partner Name</strong></td><td>CSP or reseller partner identifier</td></tr><tr><td>Azure</td><td><strong>Pricing Model</strong></td><td>Billing arrangement type (on-demand, reservation, spot)</td></tr><tr><td>Azure</td><td><strong>Product</strong></td><td>Purchased Azure product or SKU name</td></tr><tr><td>Azure</td><td><strong>Product Order Name</strong></td><td>Enrollment or order grouping label</td></tr><tr><td>Azure</td><td><strong>Provider</strong></td><td>Infrastructure provider type</td></tr><tr><td>Azure</td><td><strong>Publisher Name</strong></td><td>Marketplace or service publisher identity</td></tr><tr><td>Azure</td><td><strong>Publisher Type</strong></td><td>Publisher origin classification (Microsoft, third-party)</td></tr><tr><td>Azure</td><td><strong>Resource Group Name</strong></td><td>Azure resource group container name</td></tr><tr><td>Azure</td><td><strong>Resource Location</strong></td><td>Deployed Azure region or datacenter</td></tr><tr><td>Azure</td><td><strong>Resource Type</strong></td><td>Azure ARM resource type identifier</td></tr><tr><td>Azure</td><td><strong>Service Family</strong></td><td>High-level Azure service grouping (Compute, Storage, Networking)</td></tr><tr><td>Azure</td><td><strong>Subscription</strong></td><td>Azure billing subscription scope</td></tr><tr><td>GCP</td><td><strong>Cost Type</strong></td><td>Charge classification (regular, tax, credit, adjustment)</td></tr><tr><td>GCP</td><td><strong>Country</strong></td><td>Billing or usage geographic country</td></tr><tr><td>GCP</td><td><strong>Folders</strong></td><td>GCP resource hierarchy folder path</td></tr><tr><td>GCP</td><td><strong>Labels</strong></td><td>User-defined key-value resource tags</td></tr><tr><td>GCP</td><td><strong>Location</strong></td><td>GCP multi-region or location grouping</td></tr><tr><td>GCP</td><td><strong>Organization</strong></td><td>GCP organization-level billing entity</td></tr><tr><td>GCP</td><td><strong>Project</strong></td><td>GCP project scope for cost attribution</td></tr><tr><td>GCP</td><td><strong>Region</strong></td><td>GCP compute region identifier</td></tr><tr><td>GCP</td><td><strong>Resource Global Name</strong></td><td>Fully-qualified GCP resource URI</td></tr><tr><td>GCP</td><td><strong>Resource Name</strong></td><td>Short display name of provisioned resource</td></tr><tr><td>GCP</td><td><strong>Seller</strong></td><td>Cost origin classification (Google, third-party reseller)</td></tr><tr><td>GCP</td><td><strong>Service</strong></td><td>GCP product service name (Compute Engine, BigQuery, etc.)</td></tr><tr><td>GCP</td><td><strong>SKU</strong></td><td>Granular billable unit or pricing item identifier</td></tr><tr><td>GCP</td><td><strong>System Labels</strong></td><td>Google-managed automatic metadata labels</td></tr><tr><td>GCP</td><td><strong>Zone</strong></td><td>GCP availability zone within a region</td></tr><tr><td>OCI</td><td><strong>Availability Domain</strong></td><td>OCI datacenter within a region</td></tr><tr><td>OCI</td><td><strong>Compartment ID</strong></td><td>Unique identifier for OCI resource compartment</td></tr><tr><td>OCI</td><td><strong>Compartment Name</strong></td><td>Logical resource grouping container name</td></tr><tr><td>OCI</td><td><strong>Product Description</strong></td><td>OCI service or feature display name</td></tr><tr><td>OCI</td><td><strong>Product SKU</strong></td><td>Billable product pricing unit identifier</td></tr><tr><td>OCI</td><td><strong>Region</strong></td><td>OCI deployed datacenter region</td></tr><tr><td>OCI</td><td><strong>Resource ID</strong></td><td>Unique OCID of the provisioned resource</td></tr><tr><td>OCI</td><td><strong>Service</strong></td><td>Top-level OCI service classification (Compute, Object Storage, etc.)</td></tr><tr><td>OCI</td><td><strong>Subscription</strong></td><td>OCI billing subscription or contract scope</td></tr><tr><td>OCI</td><td><strong>Tenant ID</strong></td><td>OCI tenancy-level billing entity identifier</td></tr></tbody></table>

</details>

{% hint style="success" %}

#### **NOTE**

OneLens supports grouping up to **four levels**, enabling multi-dimensional cost analysis for deeper insights.
{% endhint %}

![](/files/hJdSEr2vsYL59mn2uop8)

<figure><img src="/files/VdMcFBlxNopBOBDIXmLT" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}

## **Use Case**

A Finance Director needs to understand the distribution of cloud costs across different business units and resource types to find potential cost-saving opportunities.

**Solution:** The finance team utilizes the Group By feature across four levels:

* **Cost Center** – Groups costs based on departments, such as R\&D, Marketing, and Operations, spanning all connected cloud providers.
* **Service** – Breaks down costs by specific cloud services within each cost center, such as AWS EC2, Azure Virtual Machines, GCP Compute Engine, or OCI Block Storage.
* **Instance Type** – Further groups compute costs by instance type (e.g., AWS m5.large, Azure Standard\_D4s\_v3, GCP n2-standard-4), highlighting performance and cost considerations across providers.
* **Resource –** Identifies specific resources - such as individual EC2 instances, Azure SQL databases, or GCP BigQuery datasets, that contribute to the overall costs.

<img src="/files/0ccHppbsHYQb1FQiZ1cY" alt="" data-size="original">

{% endhint %}

### Filters

Filters help refine cost reports by focusing on specific data points.

Here is how you apply filters:

1. Navigate to the Filters section in the Cost Atlas.
2. Select multiple conditions to filter data using an AND condition.
3. Add rules by selecting:
   1. **Field**: Choose a cost attribute (e.g., Service, Account, Usage Type, Cost Center).
   2. **Operator**: Available operators for setting filter conditions include **In** or **Not In**.
   3. **Value**: Enter the specific data point to filter (e.g., EC2, us-east-1, >$1000).
4. Click Apply to filter cost data and focus on relevant insights.

{% hint style="info" %}

## Use Case

A cloud engineer wants to analyze storage costs for a specific cloud region and service to track data transfer expenses more effectively.

**Solution:** The engineer applies the following filters:

* **Service:** Amazon S3 or Storage Accounts
* **Region:** us-east-1 or US East 2
  {% endhint %}

The Cost Atlas then displays cost data specifically for Storage Accounts in the US East 2 region, helping the engineer track and investigate any rising data transfer costs.

![](/files/ALNSF9fcF3k3lBUMiogx)

#### Next: Save Your Cost Report View

Once the report is configured with the required time range, filters, grouping, and cost type, you can preserve the setup by saving it as a view.\
Learn [how to save your cost report view](/observe-visibility-and-insights/cost-reporting/cost-atlas/saved-views#how-to-save-a-view)


# Saved Views

With **Saved Views** in OneLens, you can easily store and access custom configurations of your data filters and visualizations. This feature allows you to save specific setups for later use, so you can quickly revisit the exact insights you need without having to reapply filters or adjust visualizations each time. Saved Views are perfect for recurring analysis or when you want to share your analysis setup with your team.

## Preconfigured Saved Views

You'll find a set of ready-to-use saved views in Cost Analyzer. Use them as-is or customize them for a quick analysis:

* **Top Rising Services:** Grouped by service, showing the top cost increases over the last 2 weeks, with daily splits for usage charges.
* **Usage Cost:** Displays total usage-based spend for the last month, without grouping.
* **Top 20 Resources / Usage Types:** Grouped by resource and usage type, showing the highest costs over the last 2 weeks, with daily splits for usage charges.
* **Last Month Cost:** Shows the total cost for the previous month, split daily, without grouping.
* **Account-Region-Service View:** Grouped by account, region, and service, with data from the last 2 weeks and daily splits for usage charges.

## **How to Save a View**

1. Apply the desired filters and configure your cost report presentation to meet your analysis requirements.

{% hint style="info" %}
*To learn how to configure a cost report,* [*click here*](/observe-visibility-and-insights/cost-reporting/cost-atlas#configuring-a-cost-report)*.*
{% endhint %}

2. Click on the **Default View** dropdown at the top-left corner of the page.
3. Select **Save Current View** from the dropdown menu.

<figure><img src="/files/wZlBlwyUAVsRLjMNLuzx" alt="" width="188"><figcaption></figcaption></figure>

4. Enter a name for your view that clearly describes its purpose.

<figure><img src="/files/Mdh8kXAs8H1IIxhCnofF" alt="" width="563"><figcaption></figcaption></figure>

5. Click **Save** to store the view for future use.

## **Managing Saved Views**

* **Edit**: Update any saved view by adjusting the filters or visualizations, then save the changes to keep your setup current.

<figure><img src="/files/jVwyJ7JGv66KF0txh91b" alt="" width="375"><figcaption></figcaption></figure>

* **Delete**: Remove saved views that are no longer relevant to keep your workspace organized.
* **Set as Favorite**: Mark important views as favorites so they’re always just a click away at the top of your list.

<figure><img src="/files/cFli9txMlWXsu5HefzoB" alt="" width="182"><figcaption></figcaption></figure>


# Personas Wise Reports


# Dashboards

The Dashboards in OneLens are tailored to provide purpose-built visibility for different decision-making needs — whether you're focused on strategic financial oversight or day-to-day operational efficiency.&#x20;

To support these distinct needs, OneLens offers the following two dashboards:

## [Executive Dashboard](/observe-visibility-and-insights/cost-reporting/dashboards/executive-dashboard)

The **Executive Dashboard** gives you a top-level view of cloud financials — built for those who need to monitor overall spend, track savings, and identify high-impact opportunities. It focuses on broad patterns, monthly trends, and high-level summaries that help guide strategic decisions without diving into operational complexity.

Use this dashboard when your goal is to:

* **Monitor cloud spend trends** across accounts, services, and regions
* **Track** potential and realized savings
* **Quickly spot rising costs** at a business unit or account level
* **Guide financial planning** and optimization at scale

\--> [Explore the Executive Dashboard](/observe-visibility-and-insights/cost-reporting/dashboards/executive-dashboard)

## [Operations Dashboard](/observe-visibility-and-insights/cost-reporting/dashboards/operations-dashboard)

The **Operations Dashboard** is built for users responsible for acting on cost-saving opportunities and managing policy-driven recommendations. It offers a real-time view of optimization activity — from what needs action to what’s already been resolved.

Use this dashboard when your goal is to:

* **Get a quick overview** of recent cost anomalies, deltas, and new resources
* **Track the total number** of open tickets
* **View a** **prioritized breakdown** of tickets by impact

\--> [Explore the Operations Dashboard](/observe-visibility-and-insights/cost-reporting/dashboards/operations-dashboard)


# Executive Dashboard

The Executive Dashboard gives you a sharp, high-level view of your cloud financials. Designed for fast decision-making, it focuses on what matters most - how much you're spending, how much you're saving, and where your biggest opportunities lie.

It starts by showing you the most recent cost activity, giving you an immediate sense of where your cloud budget is headed, across all your cloud providers.

<div align="left"><figure><img src="/files/mgDiYjVvHTdLFq2fGOho" alt=""><figcaption></figcaption></figure></div>

## Cost Overview

Quickly assess how your cloud spend is trending:

* **Last Month’s Spend** shows your total cloud spend of previous month.
* **Last Week’s Spend** gives a short-term view of spend patterns.
* **Average Daily Spend (Last 7 Days)** highlights your average daily burn rate and how it compares to the week before.

  <figure><img src="/files/7iOViGoiJDf5SOhSBWdJ" alt="" width="563"><figcaption></figcaption></figure>

Once you're grounded in current spend, the dashboard shifts focus to savings — what you’ve already achieved and what’s still on the table.

## Savings Overview

Measure how well your cost optimization efforts are paying off:

* **Potential Savings** outlines how much monthly cost you could reduce if recommended actions are taken.
* **Total Achieved Savings** reflects the savings already realized through resource optimization.
* **Achieved Savings** showcase the previous month savings and also compares the months savings to the preceding month.

  <figure><img src="/files/rLDKBplVW6KA3YHWCSrP" alt="" width="563"><figcaption></figcaption></figure>

After reviewing savings performance, it's time to explore where your costs are coming from and how they’re trending over time.

## Cost Trends

Get a multi-dimensional view of your cloud cost behavior:

* **Account-wise Trends** reveal how different accounts contribute to spend.
* **Region-wise Trends** track how your costs vary by cloud regions.
* **Service-wise Trends** show which services are driving usage and cost.

  <figure><img src="/files/0m0Cj3Yj61xw0vrsNoJ9" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="success" %}

## TIP

The trends here provide valuable context, but if you need to  dive deeper, you can **click the hyperlinked button**  at the **top right of the  trend section** to open a pre-filtered **Cost Atlas** view - highlighting the related detailed insights.
{% endhint %}

### Rising Costs

Surface key areas that may need deeper attention:

* **Top Rising Account** pinpoints the account with the sharpest cost increase.
* **Top Rising Service** shows the service contributing most to recent growth.
* **Top Rising Cost Center** highlights which business unit is seeing the biggest spike.

  <figure><img src="/files/DNLaMKnYfWcwoT93GkIR" alt="" width="563"><figcaption></figcaption></figure>

With rising contributors identified, the next view breaks down cost distribution across your organization.

### Cost by Cost Center

Understand how spend is allocated across different cost centers. This view helps you align budgets, track accountability, and make informed investment decisions at the org level.

<figure><img src="/files/p87TMeUd7UpDUjdtObNk" alt="" width="563"><figcaption></figcaption></figure>

To further complete the picture, the dashboard brings cost and savings together — giving you visual clarity on where you're efficient and where there’s room to improve.

## Cost & Savings Insights

### Achieved Savings vs. Cost (Graph)

A visual comparison of your **actual cost** against the **expected cost**, with **achieved savings** clearly highlighted in the gap. This lets you see the impact of optimization in one glance.

<figure><img src="/files/HS56CHBQPLCrF47FSpmE" alt="" width="563"><figcaption></figcaption></figure>

### Savings Opportunity by Service

Spot your next best moves:

* A **bar graph** ranks the top 10 services by potential savings.

  <figure><img src="/files/YJ4T0inq63v994ZOHC2V" alt="" width="563"><figcaption></figcaption></figure>
* A detailed **table** lists:
  * **Service** involved
  * **Potential Savings** that can achieved
  * **Current Cost**&#x20;
  * **Savings in Percentage**

With the Executive Dashboard, you are a step ahead - tracking spend, measuring savings, and steering your teams with clarity and confidence.


# Operations Dashboard

The **Operations Dashboard** is built for the engineers and FinOps working on day-to-day optimization and issue resolution. It surfaces everything you need to stay on top of assigned tickets, respond to alerts, and take action on cost-saving opportunities.

<figure><img src="/files/6WkXfUaqbmtHcJyrkwkw" alt=""><figcaption></figcaption></figure>

## View Options

You can toggle between two views:

* **My Tickets**: Focused on the tickets assigned to you.
* **All Tickets Analysis**: A broader view into all ticket activity across the organization.

  <figure><img src="/files/E00d4fKNqahnR8NjV2T3" alt="" width="563"><figcaption></figcaption></figure>

It starts by showing you the key numbers around ticket status.

## Tickets

Get a quick count of all ticket activity relevant to you or your team:

* **Prioritized Tickets** show the tickets with high priority and are currently assigned to any user.
* **In-Progress Tickets** number of tickets being worked on.
* **Total Tickets Assigned to All** gives you  the full scale of workload distribution across the team.

  <figure><img src="/files/ia1F3NEObk1U59Om0GiX" alt="" width="563"><figcaption></figcaption></figure>

Once you’re aware of pending work, the next step is to stay alert to what’s changing in your environment.

## Cost Watcher Review

This section highlights the volume of cost-related alerts, helping you track anomalies at a glance:

* **All Alerts** — total number of alerts currently being assigned.
* **Open Alerts** — alerts that have been assigned and not yet resolved.
* **New Alerts (Last 5 Days)** — fresh anomalies that have been assigned.

  <figure><img src="/files/bEZhAO4rZEeUjhAJjs0Z" alt="" width="563"><figcaption></figcaption></figure>

These numbers help you quickly assess how noisy or stable your environment is.

With a sense of operational workload and cost signals, the next section helps you dig into where savings are possible and how much impact you've made.

## Cost Savings Insights

This section shows where the biggest savings lie — and what progress has already been made.

### Saving Opportunity by Service

* A **bar graph** highlights the top 10 services with the highest potential savings.

  <figure><img src="/files/w3vU8ePbKMfga1AIvacO" alt="" width="563"><figcaption></figcaption></figure>
* A supporting **table** giving you the following details:
  * Service
  * Potential Savings
  * Current Cost
  * Savings in Percentage

    <figure><img src="/files/8lMNpGkDY8mtXJshAAxv" alt="" width="563"><figcaption></figcaption></figure>

### Tickets Resolved By

Understand how much has already been resolved — across multiple dimensions:

* **Overall** T**otal**
* **By Service**
* **By Region**
* **By Account**

  <figure><img src="/files/wjQ8aI2xmvl2rw4UQKrE" alt="" width="563"><figcaption></figcaption></figure>

### Prioritized Tickets Breakdown

A **pie chart** visualizes your current ticket status, broken down into:

* **Done**
* **In Progress**
* **Prioritized**

  <figure><img src="/files/VUyEh6zjnFWM3i289wD8" alt="" width="188"><figcaption></figcaption></figure>

Once you’ve reviewed savings and ongoing efforts, the final section brings focus to risks that were actively avoided.

## Cost Avoidance

Stay informed about the most recent cost anomalies and escalated risks. A list of **recent active alerts**, includes: **ID, Name, Cost Impact, Assigned To, Escalated On,** and **Created On**.

<figure><img src="/files/6F18bp9510O8lYEEL8LJ" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="success" %}

## TIP

The table here provide valuable context, but if you need to  dive deeper, you can **click the hyperlinked button**  at the **top right of the section** to open a **Cost Watcher** view — highlighting exactly the insights that you want to see.
{% endhint %}

The **Operations Dashboard** keeps your daily workflow focused and data-backed. Whether you're resolving issues, reviewing alerts, or acting on savings — you get a complete operational view in one place.


# Cost Allocations Report


# AI Cost & Usage Analyzer

> Analyze every AI dollar, every token, and every workload from a single place.

The AI Cost & Usage Analyzer provides a unified view of AI spending and usage across all connected providers. Build custom reports, drill into costs across multiple dimensions, compare trends over time, and understand exactly where your AI budget is being spent.

***

### Why use the AI Cost & Usage Analyzer?

AI billing is fragmented across providers, models, API keys, and teams. Finance needs accurate cost reporting, while engineering needs usage insights to optimize applications.

The AI Cost & Usage Analyzer brings both together with a flexible reporting engine that lets you analyze cost and usage from any perspective.

***

### Key Capabilities

#### Unified AI Cost Visibility

View AI costs across all supported providers in a single interface.

Analyze spend across:

* Providers
* Models
* Projects
* API Keys
* Teams
* Cost Centers
* Environments
* Applications
* Regions

<figure><img src="/files/4yGu46xvlxmXMJMlS4rW" alt=""><figcaption></figcaption></figure>

***

#### Cost & Usage Views

Switch between **Cost** and **Usage** depending on the question you're trying to answer.

**Cost View**

* Total spend
* Daily cost trends
* Provider comparison
* Model-wise spend
* Team-wise spend

**Usage View**

* Requests
* Token consumption
* Input vs Output tokens
* Cached tokens
* Reasoning tokens
* Model usage

No need to build separate reports—the same report can be viewed from either perspective.

<figure><img src="/files/sX23c4oAanGDq0P5jk2a" alt=""><figcaption></figcaption></figure>

***

#### Powerful Group By

Slice your data using up to **4 levels of grouping** to answer complex business questions.

Supported dimensions include:

* Provider
* Model
* Project
* API Key
* Team
* Cost Center
* Environment
* Application
* Region
* User / Caller
* Pricing Tier

Example:

```
Provider→ Team→ Project→ Model
```

Or

```
Cost Center→ Application→ API Key→ Caller
```

This allows finance and engineering teams to investigate spend without exporting data.

<figure><img src="/files/jsAYQdE7csHg57ntMRDT" alt=""><figcaption></figcaption></figure>

***

#### Advanced Filters

Create highly targeted reports using flexible filters.

Filter by:

* Date Range
* Provider
* Model
* Team
* Project
* API Key
* Environment
* Region
* Cost Center
* Token Type
* Pricing Tier
* Custom Tags

Combine multiple filters to answer questions like:

* Which projects used GPT-4 this month?
* How much did production spend on Claude Sonnet?
* Which API keys generated the highest reasoning token costs?

<figure><img src="/files/EwUvhfDUwZAnDyb9ZpVB" alt=""><figcaption></figcaption></figure>

***

#### Save & Reuse Reports

Frequently used reports can be saved and shared across teams.

Saved reports help standardize reporting across engineering, finance, and leadership.

Examples:

* Monthly AI Spend
* Team-wise Cost
* Model Utilization
* Production AI Cost
* Customer-wise AI Spend
* AI Cost by Cost Center

***

#### 25+ Pre-built Reports

Get started instantly with built-in reports covering common AI cost and usage scenarios.

Categories include:

* Cost Overview
* Provider Analysis
* Model Intelligence
* Token Health
* Workload Analysis
* Runtime Analysis
* Governance
* Unit Metrics
* AI Cost Allocation

These reports can be customized further using filters and grouping.

***

#### Trend Analysis

Track how AI usage changes over time.

Analyze trends by:

* Hour
* Day
* Week
* Month

Compare different time periods to identify:

* Growth in AI adoption
* New workloads
* Cost spikes
* Seasonal patterns
* Model migration

***

#### Token Breakdown

Understand what contributes to your AI bill.

Depending on the provider, OneLens breaks down costs by:

* Input Tokens
* Output Tokens
* Cached Input Tokens
* Cache Writes
* Cache Reads
* Reasoning Tokens

This helps identify opportunities to improve prompt design, caching, and model efficiency.

<figure><img src="/files/wqG7lihIvhjCdg70ZbNl" alt=""><figcaption></figcaption></figure>

***

#### Export & Share

Export reports for finance reviews, business reporting, or further analysis.

Supported formats include:

* CSV
* XLSX
* Scheduled Reports

Reports can also be pinned to dashboards for continuous monitoring.

***

### Example Use Cases

#### Engineering

* Which model is generating the highest cost?
* Which API key has the highest token consumption?
* Which application is driving spend growth?

#### Finance

* AI spend by department
* Monthly cost trends
* Provider-wise billing
* Budget forecasting

#### Product Teams

* Cost per feature
* Cost per customer
* Cost by environment
* AI adoption across products

***

### Best Practices

* Build reports using business dimensions like Team or Project instead of only Provider.
* Save commonly used reports to maintain consistency across teams.
* Use multiple Group By levels before exporting data.
* Combine filters with saved reports for recurring analysis.
* Pin high-value reports to dashboards for continuous visibility.


# Cost Watcher

Cost Watcher helps you stay on top of cost changes in your cloud environment. It tracks unexpected spikes, daily cost variations, and newly introduced resources that start incurring cost.

Cost Watcher is organized into three areas:

### [**Cost Anomaly**](/observe-visibility-and-insights/cost-watcher/cloud-cost-anomalies)

* Alerts you to sudden spikes in cost and shows which accounts, services, or regions are affected.

### [**Cost Delta**](/observe-visibility-and-insights/cost-watcher/cost-delta)

* Shows you how your cost has changed since the last update, broken down by account, service, region, or cost center.

### [**New Resources**](/observe-visibility-and-insights/cost-watcher/new-resources)

* Highlights any new resources that have started generating cost.

With Cost Watcher, you get a clear view of what’s changing in your cloud cost and where to focus next.


# Cloud Cost Anomalies

Unexpected changes in your cloud costs can quickly spiral into larger issues. The Anomaly Detection feature in OneLens keeps an eye on your spend trends and flags unusual patterns - so you don’t have to. Whether it's a sharp spike or a subtle drift, you'll know about it fast and have the tools to investigate and act.

## Detecting Cost Anomalies

OneLens constantly analyzes your cost data using advanced modeling techniques. You don’t need to set it up or tune the models - detection happens automatically in the background.

### How It Works

OneLens detects anomalies by extracting time series data from your cloud cost trends and running it through an **advanced** **auto-regressive statistical model**. This approach allows OneLens to identify unusual spikes or drops in cost by comparing actual values against predicted baselines, flagging only meaningful deviations as anomalies.

## Viewing Cost Anomalies

### Choosing An Anomaly

To view the list of anomalies, go to the Cost Watcher page from the sidebar.

#### **View Options**

On the top right, you have two ways to explore anomalies:

1. Anomalies by Account
2. Anomalies by Cost Centers

#### **Time Range Filter**

You can also set a custom time range to focus on a specific analysis window.

#### **Anomalies List**

Choose an anomaly to view its detailed breakdown.

<img src="/files/njv5nP5m21WlYxz9BszW" alt="" width="375">

### Understanding an Anomaly

Clicking into an anomaly opens a detailed view with the following components:

<img src="/files/Bq1spV95IqRV2aMimeVS" alt="" width="563">

<img src="/files/SfNcF5ZlQe6nqyZlIXG4" alt="" width="563">

#### Number References

1\. **Cost Trend Graph**

* Visualizes cost behavior before, during, and after the anomaly.

2\. **Time Range**

* Switch between **7-day or 14-day** views to analyze the timeframe around the anomaly.

3\. **Anomaly Cost Impact Panel**

* Highlights how much the actual cost deviated from the expected cost, along with the delta.

4\. **Chart Presentation Options**

* Change how you view the anomaly graph:
  * Bar Chart
  * Filled Area Chart
  * Full Screen View

5\. **Anomaly Location Panel**

* Shows the account, service, and region where the anomaly occurred.

6\. **Group By Options**

* Choose how to group data in the table and chart:
  * Usage Type → Resource
  * Resource → Usage Type

7\. **Anomalous Resources Cost Trend Graph**

* Displays the trend for each impacted resource to help you trace the cost change.

8\. **Resource/Usage Type Table**

* Tabular breakdown of affected resources and usage types with associated cost and usage metrics.

9\. **Data Display Options**

* Each row in the table includes a display toggle. Use it to highlight that data in the graph and visually isolate specific cost patterns.

## Cost Metric Behavior

To help you interpret what’s happening, OneLens tags each anomaly with a Cost Metric Behavior label. This tells you how the affected metric behaved leading up to the anomaly:

* #### **Trending Up/Down**
  * A consistent increase or decrease in cost over time.
  * **Ex**: An increase in data storage costs due to a growing database size over several months.
* #### **Seasonal**
  * A pattern that repeats (like month-end processing or weekly dev bursts).
  * **Ex**: Higher compute costs during the end-of-quarter reporting period, occurring every 3 months.
* #### **Volatile**
  * Cost data that swings unpredictably with no stable trend.
  * **Ex**: (to be added)
* #### **Others**
  * No clear pattern, indicating a sudden or isolated spike.
  * **Ex**: A service having intermittent uses throughout the year.

## Finding the Root Cause

OneLens pinpoint the factors behind the cost changes and provides detailed insights into the detected anomalies.

### **Resource Analysis**

You can see exactly which resources are responsible for the cost change and how many are involved. This helps you quickly pinpoint the parts of your infrastructure that need attention.

### **Usage Type Analysis**

You’ll get a breakdown of the usage type—like compute, storage, or data transfer—that triggered the anomaly. OneLens shows how much the usage deviated from expected levels, helping you understand the scale of the impact.

### **AI-Generated Hint**

Once the data is collected, OneLens uses AI to generate a simple, plain-English explanation of the likely cause. These hints guide your investigation and keep things easy to understand. Your data stays safe—no third-party storage is involved.

## Acting on Anomalies

Once an anomaly is identified, you decide what to do next. From the anomaly view, you can:

1. **Acknowledge** – Confirm that you’re aware of the anomaly.
2. **Document** – Add notes or details for future reference.
3. **Assign** – Send the anomaly to the right person or team.
4. **Dismiss** – Mark it as not actionable or irrelevant.
5. **Resolve** – Close the loop once action is taken.

Each action helps keep your anomaly management organized and trackable.

## Setting Detection Sensitivity

You can adjust how aggressive the anomaly engine is when flagging changes:

1. **Low Sensitivity** – Only flags major shifts or spikes.
2. **Medium Sensitivity** – Balanced detection (recommended).
3. **High Sensitivity** – Detects even minor deflections in cost.

Choose the level that matches your risk appetite and operational noise tolerance.

## Defining Anomaly Thresholds

Not every cost fluctuation needs to be flagged. You can fine-tune detection by setting minimum thresholds based on:

1. **Dollar Threshold** – e.g., trigger anomalies only when the cost change is more than $100.
2. **Percentage Threshold** – e.g., detect only if the change exceeds 15%.

Depending on how you want anomalies to be picked up, OneLens supports two threshold modes:

### Dollar AND Percentage

* An anomaly will only be flagged if both conditions are met:
* Example: Cost must increase **by at least $100** and **by more than 15%**.

### Dollar OR Percentage

* An anomaly will be flagged if either condition is met:
* Example: Cost increases **by $100 or more**, **or** the percentage increase exceeds **15%**—whichever comes first.


# AI Cost Anomalies

> Detect abnormal AI spend before it becomes a billing surprise.

AI Cost Anomalies continuously monitors your AI spending and automatically detects unusual cost patterns across providers, models, projects, API keys, and teams. Every anomaly includes root cause analysis to help you understand what changed and where to investigate.

***

### Why use AI Cost Anomalies?

AI costs can increase unexpectedly due to:

* Traffic spikes
* Incorrect model routing
* Prompt changes
* Agent loops
* Misconfigured applications
* New deployments
* Shadow AI usage

Manually monitoring dashboards isn't scalable. AI Cost Anomalies proactively identifies unusual spending so your team can respond before costs escalate.

***

### How It Works

OneLens uses statistical models to learn your historical spending patterns and establish dynamic baselines for every monitored dimension.

When spend deviates significantly from expected behavior, an anomaly is generated automatically.

No manual threshold configuration is required.

***

### Detection Dimensions

Detect anomalies across multiple business and technical dimensions.

Supported dimensions include:

* Provider
* Region
* Service
* Model
* Caller (User or API Key)

This helps quickly isolate whether a spike is caused by infrastructure, an application, or a specific workload.

<figure><img src="/files/ZYaaKFN1YilXqw2QRIMm" alt=""><figcaption></figcaption></figure>

***

### Root Cause Analysis

Every anomaly includes an automatically generated root cause summary.

Understand:

* What changed
* Which dimension contributed most
* Estimated cost impact
* Timeline of the anomaly
* Recommended investigation path

Instead of simply notifying you that costs increased, OneLens explains where the increase originated.

<figure><img src="/files/SPmwamoRXUyFQIz7JqMY" alt=""><figcaption></figcaption></figure>

***

### Token Contribution Analysis

Understand what actually drove the additional cost.

Depending on the provider, OneLens breaks down cost contribution across:

* Input Tokens
* Output Tokens
* Cached Tokens
* Reasoning Tokens

This helps determine whether increased costs were caused by larger prompts, longer responses, reduced cache efficiency, or reasoning-heavy workloads.

<figure><img src="/files/Xfr8XO0RkcdiRo4qCiZ4" alt=""><figcaption></figcaption></figure>

***

### Anomaly Lifecycle

Track the complete lifecycle of every anomaly.

Available states include:

* Open
* Acknowledged
* Investigating
* Resolved

This allows teams to collaborate, avoid duplicate investigations, and maintain an audit trail of incident resolution.

<figure><img src="/files/RdXSGTUtw41BQTdJ71Ih" alt=""><figcaption></figcaption></figure>

***

### Alerting & Notifications

Receive anomaly alerts through your existing communication channels.

Supported notification channels include:

* Email
* Slack
* Microsoft Teams
* ServiceNow

Notifications include a summary of the anomaly along with a direct link to investigate further.

***

### Investigate Faster

Each anomaly provides enough context to begin troubleshooting immediately.

Quickly answer questions like:

* Which model caused the spike?
* Which API key generated the spend?
* Which team owns the workload?
* Is this affecting one provider or multiple?
* Is the increase temporary or ongoing?

From the anomaly page, you can drill directly into the AI Cost & Usage Analyzer for deeper analysis.

<figure><img src="/files/7lGkkYDmzF5jAr6MuW3o" alt=""><figcaption></figcaption></figure>

***

### Example Scenarios

#### Unexpected Model Upgrade

An application starts routing requests from GPT-4o Mini to GPT-4. OneLens detects the sudden increase in cost and highlights the affected model.

***

#### Agent Loop

An autonomous workflow repeatedly calls an LLM, generating thousands of unnecessary requests. The abnormal spending pattern is detected within the reporting cycle.

***

#### Cache Miss Spike

A prompt update reduces cache effectiveness, causing a significant increase in input token costs. Token contribution analysis highlights the drop in cache efficiency.

***

#### Shadow AI Usage

A newly created API key begins generating significant spend outside approved projects. The anomaly identifies the caller responsible for the increase.

***

### Best Practices

* Review anomalies daily to identify issues before invoices arrive.
* Route alerts to the teams responsible for the affected workloads.
* Investigate recurring anomalies to identify long-term optimization opportunities.
* Use anomaly insights alongside AI Budgets to proactively manage spending.
* Track resolution status to ensure every anomaly is investigated and closed.


# Cost Delta

Cost Delta helps you quickly identify unexpected changes in your cloud spend. By comparing your current cost against a historical baseline, OneLens highlights spikes or drops that deserve your attention.

## Set Up Cost Delta Thresholds and Filters

Start by defining what counts as a significant cost change for you.

* **Thresholds**: Set thresholds as a percentage or absolute value to control when OneLens flags a delta.
* **Filters**: Focus on what matters to you—filter by account, service, region, or cost center.
* **Frequency**: Decide how often you want OneLens to check for deltas—daily, weekly, or custom.

## View a Cost Delta

When OneLens detects a cost delta, it’s immediately available in your dashboard. Each delta card shows you:

* Which account, service, region, or cost center was affected
* The current spends vs. historical spend
* The delta value and percentage
* When the change was first noticed

You can sort, search, and filter the list to quickly zero in on the changes that matter most to you.

## Understand a Cost Delta

To help you understand what’s driving the delta, OneLens gives you the full context:

* **Spend Trend**: View how the cost evolved over time.
* **Breakdown by Dimension**: Drill down by usage type, instance type, resource, or tag.
* **Baseline Comparison**: See how your current cost compares with historical norms.

## Finding the Root Cause

### Top 10 Resource Root Cause

OneLens surfaces the top 10 resources contributing to the delta. You can immediately see which resources are behind the cost shift and how much each one contributed.

### AI-Based Hint

You also get an AI-generated hint that helps explain the delta using patterns from your data—such as usage anomalies, sudden scaling, or policy violations. It’s designed to save you time during investigation.

## Act on a Cost Delta

* **Acknowledge**: Indicate that the delta is under review to prevent duplicate investigations.
* **Document**: Add notes or links to create a record of the investigation.
* **Assign**: Assign the delta to the appropriate individual or team for follow-up.
* **Dismiss**: Dismiss expected or irrelevant deltas.
* **Resolve**: Mark as resolved once addressed to keep the view clean and focused.


# New Resources

New resources in your infrastructure are tracked, with associated costs and changes highlighted over time. This allows you to monitor the financial impact of newly deployed resources and manage costs effectively.

## Setup New Resource Alerts

Alerts for new resources can be configured:

1. **As a Trigger**: Get immediate notifications whenever a new resource is created, and cost changes are detected.
2. **As a Digest**: Receive regular summaries (e.g., daily or weekly) of new resources and their cost impacts.

## Viewing Newly Created Resource’s Details

You can view key details of new resources, including:

* Resource Type
* Associated cost
* Creation date and time
* Cost changes or spikes

## Act on Newly Created Resources

After reviewing a new resource, you can:

* **Acknowledge**: Confirm the resource’s creation and its cost impact.
* **Document**: Log details about the resource’s purpose and expected cost.
* **Assign**: Designate responsibility for further analysis and management.
* **Dismiss**: Remove unnecessary or erroneous resources.
* **Resolve**: Mark the resource as addressed once actions are completed.


# Cost Allocation

Cost allocation in OneLens helps you bring structure, accountability, and meaning to your cloud spend. Instead of navigating raw billing data, you can allocate every cost to the business unit, project, or environment it truly belongs to.

With multiple allocation strategies and flexible mapping capabilities, you decide how your costs are split, grouped, and reported - whether by accounts, tags, custom rules, or usage patterns.

***

## Why Cost Allocation matters for you

When your cloud costs are correctly allocated:

* You know **which teams**, **products**, or **applications** are driving the most spend.
* You can hold stakeholders **accountable** for their usage.
* You can improve **forecasting**, **chargebacks**, and **budget alignment**.
* You get better visibility to support **optimization and savings**.

## What you can do in OneLens

OneLens gives you several tools to define how your cloud spend is organized:

* #### [Business Hierarchy](/observe-visibility-and-insights/cost-allocation/cost-centres-and-business-hierarchy)

Create cost centers that mirror your real-world organization using account-based, tag-based, or resource group-based mapping. Track spend by team, product, environment, and more.

* #### [Virtual Tags](/observe-visibility-and-insights/cost-allocation/virtual-tags)

Apply business context to your resources even when cloud-native tags are inconsistent or missing. Use account, tag, or resource attributes to generate meaningful virtual tags for filtering and grouping costs.

* #### [Shared Cost Allocation](/observe-visibility-and-insights/cost-allocation/virtual-tags/shared-cost-allocation)

Distribute common or platform-level costs (like logging, networking, or shared services) across multiple cost centers using even, fixed, or weighted strategies.

* #### Production & Non-Production Cost

Separate operational workloads from test environments to understand the cost of running production vs experimentation.

* #### Kubernetes Cost Allocation

Allocate container-level usage back to namespaces, workloads, or teams running within Kubernetes clusters.

Cost allocation isn't just about reporting - it's about ownership. OneLens helps you build a clear, business-aware cost structure that scales with your cloud environment.

Let your spend speak in the language of your business.


# Cost Centres & Business Hierarchy

## Overview

Your cloud cost data only becomes meaningful when it reflects how your business is structured. In OneLens, you can define a business-aligned hierarchy by setting up **Cost Centers -** so that every dollar spent is tied to a team, product, or initiative you care about.

With flexible mapping strategies and multi-level categorization, you get to decide how your cloud spend is grouped, tracked, and analyzed across your organization.

### What is a Cost Centre?

A **Cost Centre** is a logical business unit that owns cloud spend.

It can represent:

* Business Unit
* Department
* Team
* Project
* Environment

Instead of looking at raw cloud bills, you see costs organized by who owns them.

***

### Business Hierarchy Structure

OneLens supports up to **4 levels of hierarchy**.

Example:

```
Organization
 └── Business Unit
      └── Team
           └── Project / Environment
```

Costs always roll up from the lowest level to the top.

If:

* Production = $12,000
* Staging = $3,000

Then:

* Platform Team = $15,000

***

### How to Build Your Hierarchy

Navigate to:

**Settings → Cost Allocation → Business Hierarchy**

#### Step 1: Create Top-Level Organization

Define your root node.

#### Step 2: Add Child Levels

Add Business Units, Teams, Projects, or Environments under the appropriate parent.

#### Step 3: Map Resources to Leaf Nodes

Only leaf-level cost centres should directly own resources.

## Mapping Strategies

You have the flexibility to organize your cloud usage using one or more of the following approaches:

### 1. Account-Based Mapping

If you're using separate cloud accounts for different teams, applications, or environments, OneLens lets you map those accounts directly to cost centers. You can group and analyze usage exactly the way your accounts are structured.

**Use this when:**

* Each department, team, or workload has its own account.
* You want a quick and reliable way to allocate costs with minimal setup.

### 2. Tag-Based Mapping

If you're tagging your cloud resources consistently, you can use those tags to align spend with your internal structure. OneLens lets you select tag keys and values to define how resources roll up into cost centers.

**Use this when:**

* You’ve already invested in good tag hygiene.
* You want fine-grained grouping based on team, project, or environment.

{% hint style="warning" %}

## *NOTE*

*OneLens does not perform tag audits. You are responsible for ensuring the quality of your tags.*
{% endhint %}

### 3. Resource Group-Based Mapping

Sometimes accounts or tags alone aren't enough—especially if resources are shared. In such cases, you can manually group resources together and map them to cost centers based on how your teams actually use them.

**Use this when:**

* You have shared accounts with mixed workloads.
* You need custom groupings to reflect how teams consume resources.

### Cost Center Categories

OneLens gives you the power to reflect your real-world business structure by defining up to **four levels** of cost center categories. This means you can slice and report your cloud costs in the way that aligns best with how your teams work and how you report performance.

Here are the categories you can use:

<table><thead><tr><th width="239.30859375">Category</th><th>What You Can Capture Here</th></tr></thead><tbody><tr><td><strong>Business Unit</strong></td><td>High-level groups like Engineering, Finance, or Marketing.</td></tr><tr><td><strong>Division</strong></td><td>Sub-sections of a business unit, like North America Sales.</td></tr><tr><td><strong>Product</strong></td><td>Cloud usage tied to customer-facing products or internal tools.</td></tr><tr><td><strong>Team</strong></td><td>Functional groups like SRE, Backend, or QA.</td></tr><tr><td><strong>Application</strong></td><td>Logical applications such as Login Service or Analytics Engine.</td></tr><tr><td><strong>Environment</strong></td><td>Lifecycle stages like Dev, QA, Staging, or Production.</td></tr><tr><td><strong>Project</strong></td><td>Initiatives like Migration Effort, PoC Testing, or Launch Phase.</td></tr><tr><td><strong>Others</strong></td><td>Anything else you need to track but don’t see in other categories.</td></tr></tbody></table>

You can mix and match these dimensions to reflect the exact structure you need.

## How to Create a Cost Center

To manage your cost centers in OneLens:

{% stepper %}
{% step %}
**Go to Settings**

From the main navigation, open the **Settings** section.
{% endstep %}

{% step %}
**Check Under Business Mapping**

Click on **Organization Cost Centers** to view and manage your business mapping.
{% endstep %}
{% endstepper %}

From here, you can configure how your resources are grouped using account-based, tag-based, or resource group-based strategies—and assign them to relevant cost center categories like Business Unit, Product, Team, and Environment.

<figure><img src="/files/pzdWuKgsmp1S7lsmTT9b" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="warning" %}

## Important&#x20;

Any changes you make to cost centers—including creation, updates, or deletions—will be published and reflected across OneLens after **24 hours**.
{% endhint %}

### How Costs Roll Up

* All costs must map to a leaf node.
* Parent nodes aggregate child costs automatically.
* Reports always reflect roll-up totals.

This enables:

* BU-level reporting
* Team-level optimization
* Executive dashboards

***

### Best Practices

* Mirror real budget ownership
* Keep structure simple initially
* Avoid unnecessary levels
* Assign ownership at the lowest responsible layer

## Connecting Cost Centers to Virtual Tags

While cost centers define your business hierarchy, **Virtual Tags** give you another way to organize and analyze your cloud spend. You can manually create virtual tags based on accounts, tags, or resource attributes - even if cloud-native tags are missing or inconsistent.

Virtual Tags extend the power of cost centers across all OneLens views, making it easier for you to filter, allocate, and report costs at scale.

[**Learn more about Virtual Tags and how to create them**](/observe-visibility-and-insights/cost-allocation/virtual-tags)


# AI Cost Allocation

> Understand exactly where your AI spend is going and who is responsible for it.

AI Cost Allocation helps organizations attribute AI costs to the right teams, projects, products, customers, or business units. Instead of viewing a single monthly AI bill, break down spend into meaningful business dimensions for chargeback, showback, budgeting, and accountability.

***

### Why AI Cost Allocation?

As AI adoption grows, a single provider bill often includes usage from multiple teams, applications, and environments.

Without cost allocation, it's difficult to answer questions like:

* Which team is driving AI spend?
* Which product costs the most to operate?
* Which customer generates the highest AI costs?
* How much AI spend belongs to production versus development?
* Who should own an unexpected increase in costs?

AI Cost Allocation provides complete visibility into where every AI dollar is spent.

***

### Allocate Costs Across Business Dimensions

Analyze AI spend using dimensions that match your organization.

Supported dimensions include:

* Team
* Project
* Product
* Cost Center
* Environment
* Application
* Customer
* Organization
* API Key
* User / Caller
* Provider
* Model

***

### Multi-Level Cost Breakdown

Drill into costs using up to **4 levels of grouping**.

Example views:

```
Cost Center
→ Team
→ Project
→ Model
```

```
Customer
→ Product
→ Provider
→ Model
```

```
Environment
→ Application
→ API Key
→ Caller
```

This makes it easy to understand both high-level trends and detailed cost drivers.

***

### Flexible Filters

Focus your analysis using advanced filters.

Filter by:

* Time Range
* Provider
* Model
* Team
* Project
* Environment
* Customer
* Cost Center
* API Key
* Region
* Pricing Tier

Combine filters with grouping to build reports tailored to finance, engineering, or product teams.

***

### Chargeback & Showback

Allocate AI costs to internal teams or external customers with confidence.

Common chargeback models include:

* Team-wise AI spend
* Department-wise AI spend
* Product-wise AI spend
* Customer-wise AI spend
* Environment-wise AI spend

Whether you're recovering costs internally or simply improving visibility, OneLens provides a consistent allocation model across all providers.

***

### Customer-Level AI Economics

For SaaS businesses, AI Cost Allocation enables tenant-level visibility.

Measure:

* AI Cost per Customer
* AI Cost per Workspace
* AI Cost per Organization
* AI Gross Margin
* High-Cost Customers
* Unprofitable AI Features

This helps teams build sustainable pricing models and identify customers consuming disproportionate AI resources.

***

### Saved Reports

Create allocation reports once and reuse them across the organization.

Examples include:

* AI Spend by Team
* AI Spend by Customer
* AI Spend by Cost Center
* AI Spend by Product
* Production AI Costs
* Monthly Chargeback Report

Saved reports can be shared across teams or added directly to dashboards.

***

### Dashboard Integration

Pin allocation reports to dashboards for continuous visibility.

Popular dashboard widgets include:

* Spend by Team
* Spend by Product
* Spend by Customer
* Cost Center Distribution
* Top AI Consumers
* Monthly Chargeback Summary

This allows finance, engineering, and leadership to monitor AI spend from a single view.

***

### Example Use Cases

#### Finance

Track AI costs by department, business unit, or cost center for budgeting and financial reporting.

#### Engineering

Measure AI usage across applications, environments, and teams to improve ownership and accountability.

#### Product

Understand the operational cost of AI-powered features and compare products by AI spend.

#### SaaS Platforms

Track AI costs per tenant, identify high-cost customers, and support usage-based pricing strategies.

***

### Benefits

* Improve cost ownership across teams.
* Enable accurate chargeback and showback.
* Understand AI profitability by product or customer.
* Support budgeting with detailed cost attribution.
* Reduce time spent manually reconciling provider invoices.
* Build a single source of truth for AI spending.

***

### Best Practices

* Allocate costs using business dimensions rather than provider-specific metadata.
* Ensure every AI workload is mapped to a team, project, or cost center.
* Save recurring allocation reports for monthly reviews.
* Combine allocation reports with Unit Metrics to understand AI cost efficiency.
* Review allocation trends regularly to identify ownership gaps and unexpected spending.


# Production & Non Production Cost

Production and Non-Production cost segmentation allows you to clearly separate business-critical workloads from development, testing, and staging environments.

While this feature is powered by the same backend engine as **Business Hierarchy**, it provides a simplified and standardized way to classify workloads based on environment.

This ensures:

* Clean executive reporting
* Better budget planning
* Accurate savings tracking
* Clear production accountability

***

### Why Environment Segregation Matters

Without clear environment classification:

* Production and test workloads get mixed
* Optimization opportunities are unclear
* Savings tracking becomes distorted
* Finance cannot distinguish operational vs experimental spend

Separating production from non-production enables:

* Accurate margin analysis
* Smarter optimization decisions
* Reduced risk during cost-cutting
* Better forecasting

***

### How It Works

Production & Non-Production classification uses **tag-based rule definitions**.

You define what qualifies as:

* Production
* Non-Production

Based on:

* Tag Key / Value
* Account
* Resource Name
* Service
* Region

The system then categorizes all workloads accordingly.

***

#### Example Classification Logic

If:

* Tag `environment = prod`
* OR Tag `env = production`
* OR Account name contains `live`

Then:

→ Classify as **Production**

If:

* Tag `environment = dev`
* OR Tag `env = staging`
* OR Resource name contains `test`

Then:

→ Classify as **Non-Production**

***

<figure><img src="/files/IFG6fgjqA6NAy1UEakGF" alt=""><figcaption></figcaption></figure>

***

### Supported Rule Conditions

You can define rules using:

* Native Cloud Tags
* Account Name
* Subscription Name
* Project ID
* Resource Name
* Service
* Region
* Usage Type

Rules follow AND logic within a rule block.

Multiple rule blocks can be defined.

***

### How It Is Different from Business Hierarchy

| Feature          | Business Hierarchy              | Production & Non-Production              |
| ---------------- | ------------------------------- | ---------------------------------------- |
| Purpose          | Maps cost to business ownership | Segregates cost by environment type      |
| Depth            | Up to 4 levels                  | Binary classification (Prod vs Non-Prod) |
| Resource Mapping | Leaf-level cost centre          | Rule-based environment grouping          |
| Use Case         | BU / Team / Project reporting   | Operational environment reporting        |

Internally, both use the same allocation engine.\
Production & Non-Production is simply a simplified, purpose-built segmentation layer.

***

### Reporting Capabilities

Once configured, you can:

* View total Production spend
* View total Non-Production spend
* Compare Prod vs Non-Prod trends
* Filter dashboards by environment
* Track savings by environment type
* Monitor policy violations separately

***

### Best Practices

To ensure accurate classification:

* Standardize environment tag keys across teams
* Avoid multiple meanings for the same tag
* Review unmatched resources monthly
* Align environment definition with engineering policy

Recommended tag keys:

* `environment`
* `env`
* `stage`
* `deployment`

***

### Common Multi-Cloud Examples

#### AWS

* `environment = prod`
* `aws:autoscaling:groupName contains live`
* Account name contains `production`

#### Azure

* `Environment = Production`
* Subscription name contains `Prod`
* Resource group contains `Live`

#### GCP

* Label `env = prod`
* Project ID contains `production`

#### OCI

* Tag namespace `Operations.Environment = Prod`

***

### Why This Feature Is Important

Production workloads:

* Directly impact revenue
* Require higher reliability
* Must be optimized carefully

Non-production workloads:

* Can be aggressively optimized
* Can tolerate scheduling policies
* Are ideal for automation-based savings

This separation enables smarter FinOps decisions.

***

### Governance Alignment

Environment classification also enables:

* Production-only alerting
* Non-production shutdown policies
* Environment-specific workflow automation
* Scoped access controls

If you have not configured cost centres yet, refer to:

👉 **Cost Centres & Business Hierarchy**

***

### Summary

Production & Non-Production Cost gives you:

* Clean workload segregation
* Accurate financial visibility
* Better optimization control
* Executive-level clarity

It is simple to configure, but powerful in impact.


# Virtual Tags

## Overview

Virtual Tags in OneLens empower you to assign cost allocation logic beyond native cloud provider tagging - whether you're on AWS, Azure, GCP, or OCI.. You can fill gaps where tags are missing, incorrectly applied, or entirely unsupported - so your financial reporting reflects your true business structure.

Whether you’re mapping untagged resources, allocating shared expenses, or grouping untaggable items like discounts and savings plans, Virtual Tags give you the flexibility to define cost your way.

## What You Can Tag

You can use Virtual Tags to assign cost in the following scenarios:

* #### Missed Tagged Spend

Capture resources that should have been tagged but weren’t - due to human error, late tagging, or tag propagation issues.

* #### Untagged Costs

Assign cost to resources that never had any tags applied.

* #### Untaggable Costs

Apply tags to services or line items that are not taggable through cloud-native methods.

**Examples of untaggable services and line items:**

<table><thead><tr><th width="152.5"> Category</th><th width="464">Examples</th></tr></thead><tbody><tr><td>Services</td><td>Data Transfer, RDS Backups</td></tr><tr><td>Line Items</td><td>Discounts, Credits, Savings Plans, Refunds, Reservations, Out-of-cycle Adjustments</td></tr></tbody></table>

## How to Create a Virtual Tag

Follow the steps below to create your own Virtual Tags:

{% stepper %}
{% step %}
Go to **Settings** in the left sidebar.
{% endstep %}

{% step %}
Under **Business Mapping**, open **Organization Cost Center**.

<figure><img src="/files/Yf9EB7sdCf1xnA8ga4xA" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Switch to the **Virtual Tags** tab.

<figure><img src="/files/hKHWXVBe2YxkejTnGLvk" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Click **Create Virtual Tag**.

<figure><img src="/files/eZJRzgoIGYRuRJBM6jdV" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Enter a **Key** (name of the tag) and an optional **Description**. After that click **Define Value** at the bottom right.

<figure><img src="/files/IGyy14hTaz7dKbFYrVnP" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}

{% step %}
&#x20;Set the cost mapping values and conditions.

Learn how to [#defining-values](#defining-values "mention").&#x20;

<figure><img src="/files/NGCaVrRjXJOu4lQNx3Yj" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Click **Create Virtual Tag** (bottom right).
{% endstep %}
{% endstepper %}

The tag is now created.&#x20;

{% hint style="warning" %}

## Note

It takes up to **24 hours** for cost data to sync with the tag.Once synced, you can start using the tag in **Cost Altas** to slice, filter, and group cost based on your custom logic.
{% endhint %}

## Defining Values

When you create a **Virtual Tag**, you're essentially building your own rule-based cost mapping system. This lets you assign a **value** to specific resources - even if they have no native tags.

You do this by creating **conditions** that determine **which resources get mapped** to which **tag value**. Once the conditions are met, OneLens automatically maps the associated cost to that value - so you can track, report, and allocate cost in a way that aligns with how you view your business.

{% hint style="info" %}

## Use Case

**For example:**\
If you run all S3 workloads for data analytics in the `us-west-2` region, you can create a virtual tag value called **Data Analytics - S3** and map it to:

* **Field:** `Service` → **Operator:** `Is` → **Value:** `S3`
* **Field:** `Region` → **Operator:** `Is` → **Value:** `us-west-2`

All matching S3 charges will now be grouped under **Data Analytics - S3 -** even if they weren’t tagged that way in AWS.

<img src="/files/O6Jng2ZTa6SnXHWxdm6x" alt="" data-size="original">
{% endhint %}

You can add multiple conditions to create fine-tuned cost mappings.

### How to Set Conditions

#### Step 1: Choose Field

Select the attribute you want to match your condition against. Each field represents a dimension of the resource or billing data.

<details>

<summary>Available Fields</summary>

<table><thead><tr><th width="113">Cloud</th><th width="194">Group By Option</th><th width="311">Description</th></tr></thead><tbody><tr><td>AWS</td><td><strong>Account</strong></td><td>AWS account.</td></tr><tr><td>AWS</td><td><strong>API Operation</strong></td><td>Specific API operations performed.</td></tr><tr><td>AWS</td><td><strong>Availability Zone</strong></td><td>AWS Availability Zone where resources are deployed.</td></tr><tr><td>AWS</td><td><strong>Billing Entity</strong></td><td>Billing entity associated with the usage.</td></tr><tr><td>AWS</td><td><strong>Charge Type</strong></td><td>Charge classification such as usage, recurring, or one-time fees.</td></tr><tr><td>AWS</td><td><strong>Cost Center</strong></td><td>Assigned cost center.</td></tr><tr><td>AWS</td><td><strong>Cost Center Category</strong></td><td>Defined cost center categories.</td></tr><tr><td>AWS</td><td><strong>Database Engine</strong></td><td>Database engine type (e.g., MySQL, PostgreSQL).</td></tr><tr><td>AWS</td><td><strong>Instance Type</strong></td><td>EC2 or database instance type.</td></tr><tr><td>AWS</td><td><strong>Legal Entity</strong></td><td>Legal entity associated with the account.</td></tr><tr><td>AWS</td><td><strong>Platform</strong></td><td>Operating system or platform type.</td></tr><tr><td>AWS</td><td><strong>Purchase Option</strong></td><td>Reserved, on-demand, or other purchase options.</td></tr><tr><td>AWS</td><td><strong>Region</strong></td><td>AWS region.</td></tr><tr><td>AWS</td><td><strong>Resource</strong></td><td>Individual resource identifiers.</td></tr><tr><td>AWS</td><td><strong>Service</strong></td><td>AWS service.</td></tr><tr><td>All clouds</td><td><strong>Tag</strong></td><td>User-defined tags.</td></tr><tr><td>AWS</td><td><strong>Tenancy</strong></td><td>Resource tenancy (shared or dedicated).</td></tr><tr><td>AWS</td><td><strong>Usage Type</strong></td><td>AWS usage type classification.</td></tr><tr><td>All clouds</td><td><strong>Virtual Tag</strong></td><td>Virtual tags created in OneLens for additional categorization.</td></tr><tr><td>Azure</td><td><strong>Benefit Name</strong></td><td>Applied reservation or savings plan name.</td></tr><tr><td>Azure</td><td><strong>Charge Type</strong></td><td>Cost record type classification (usage, purchase, refund)</td></tr><tr><td>Azure</td><td><strong>Frequency</strong></td><td>Billing recurrence indicator</td></tr><tr><td>Azure</td><td><strong>Meter</strong></td><td>Unique billing meter identifier</td></tr><tr><td>Azure</td><td><strong>Meter Category</strong></td><td>Top-level Azure service classification</td></tr><tr><td>Azure</td><td><strong>Meter Subcategory</strong></td><td>Azure service feature or tier breakdown</td></tr><tr><td>Azure</td><td><strong>Partner Name</strong></td><td>CSP or reseller partner identifier</td></tr><tr><td>Azure</td><td><strong>Pricing Model</strong></td><td>Billing arrangement type (on-demand, reservation, spot)</td></tr><tr><td>Azure</td><td><strong>Product</strong></td><td>Purchased Azure product or SKU name</td></tr><tr><td>Azure</td><td><strong>Product Order Name</strong></td><td>Enrollment or order grouping label</td></tr><tr><td>Azure</td><td><strong>Provider</strong></td><td>Infrastructure provider type</td></tr><tr><td>Azure</td><td><strong>Publisher Name</strong></td><td>Marketplace or service publisher identity</td></tr><tr><td>Azure</td><td><strong>Publisher Type</strong></td><td>Publisher origin classification (Microsoft, third-party)</td></tr><tr><td>Azure</td><td><strong>Resource Group Name</strong></td><td>Azure resource group container name</td></tr><tr><td>Azure</td><td><strong>Resource Location</strong></td><td>Deployed Azure region or datacenter</td></tr><tr><td>Azure</td><td><strong>Resource Type</strong></td><td>Azure ARM resource type identifier</td></tr><tr><td>Azure</td><td><strong>Service Family</strong></td><td>High-level Azure service grouping (Compute, Storage, Networking)</td></tr><tr><td>Azure</td><td><strong>Subscription</strong></td><td>Azure billing subscription scope</td></tr><tr><td>GCP</td><td><strong>Cost Type</strong></td><td>Charge classification (regular, tax, credit, adjustment)</td></tr><tr><td>GCP</td><td><strong>Country</strong></td><td>Billing or usage geographic country</td></tr><tr><td>GCP</td><td><strong>Folders</strong></td><td>GCP resource hierarchy folder path</td></tr><tr><td>GCP</td><td><strong>Labels</strong></td><td>User-defined key-value resource tags</td></tr><tr><td>GCP</td><td><strong>Location</strong></td><td>GCP multi-region or location grouping</td></tr><tr><td>GCP</td><td><strong>Organization</strong></td><td>GCP organization-level billing entity</td></tr><tr><td>GCP</td><td><strong>Project</strong></td><td>GCP project scope for cost attribution</td></tr><tr><td>GCP</td><td><strong>Region</strong></td><td>GCP compute region identifier</td></tr><tr><td>GCP</td><td><strong>Resource Global Name</strong></td><td>Fully-qualified GCP resource URI</td></tr><tr><td>GCP</td><td><strong>Resource Name</strong></td><td>Short display name of provisioned resource</td></tr><tr><td>GCP</td><td><strong>Seller</strong></td><td>Cost origin classification (Google, third-party reseller)</td></tr><tr><td>GCP</td><td><strong>Service</strong></td><td>GCP product service name (Compute Engine, BigQuery, etc.)</td></tr><tr><td>GCP</td><td><strong>SKU</strong></td><td>Granular billable unit or pricing item identifier</td></tr><tr><td>GCP</td><td><strong>System Labels</strong></td><td>Google-managed automatic metadata labels</td></tr><tr><td>GCP</td><td><strong>Zone</strong></td><td>GCP availability zone within a region</td></tr><tr><td>OCI</td><td><strong>Availability Domain</strong></td><td>OCI datacenter within a region</td></tr><tr><td>OCI</td><td><strong>Compartment ID</strong></td><td>Unique identifier for OCI resource compartment</td></tr><tr><td>OCI</td><td><strong>Compartment Name</strong></td><td>Logical resource grouping container name</td></tr><tr><td>OCI</td><td><strong>Product Description</strong></td><td>OCI service or feature display name</td></tr><tr><td>OCI</td><td><strong>Product SKU</strong></td><td>Billable product pricing unit identifier</td></tr><tr><td>OCI</td><td><strong>Region</strong></td><td>OCI deployed datacenter region</td></tr><tr><td>OCI</td><td><strong>Resource ID</strong></td><td>Unique OCID of the provisioned resource</td></tr><tr><td>OCI</td><td><strong>Service</strong></td><td>Top-level OCI service classification (Compute, Object Storage, etc.)</td></tr><tr><td>OCI</td><td><strong>Subscription</strong></td><td>OCI billing subscription or contract scope</td></tr><tr><td>OCI</td><td><strong>Tenant ID</strong></td><td>OCI tenancy-level billing entity identifier</td></tr></tbody></table>

</details>

#### Step 2: Choose Operator

Operators define how the field value should match the input you provide.

<details>

<summary>Available Operators</summary>

| **Contains**            | Matches if the field includes the specified text.            |
| ----------------------- | ------------------------------------------------------------ |
| **Does Not Contain**    | Matches if the field excludes the specified text.            |
| **Starts With**         | Matches if the field begins with the specified text.         |
| **Does Not Start With** | Matches if the field does not begin with the specified text. |
| **In**                  | Matches if the field is one of the listed values.            |
| **Is Not In**           | Matches if the field is not in the list of values.           |
| **Is Null**             | Matches if the field has no value.                           |
| **Is Not Null**         | Matches if the field has any value (i.e., not empty).        |

</details>

#### Step 3: Enter Value

Provide the value(s) you want OneLens to match. You can:

* Choose one or more values for operators like `In` or `Is Not In`
* Enter strings or substrings for operators like `Contains` and `Starts With`

You can continue adding more **fields and conditions** to refine how the tag applies.

{% hint style="success" %}

## Verifying Resources

Once you’ve defined a value, OneLens lets you **verify the resources** that match the logic before finalizing. This helps ensure your mapping works as expected.

<img src="/files/roBA9dBkMkMyx0P35FyV" alt="" data-size="original">
{% endhint %}

#### Step 3: Allocating Shared Costs

Virtual Tags can also be used to allocate **shared costs** like support charges, data transfer, or common infrastructure across business units.\
➡️ Learn more about [Shared Cost Allocation](/observe-visibility-and-insights/cost-allocation/virtual-tags/shared-cost-allocation)

{% hint style="info" %}

## **Note**&#x20;

**Allocating cost is optional**—you can choose to use virtual tags purely for grouping or visibility purposes without impacting cost allocation.
{% endhint %}

### Value Status Guide

Each value inside a Virtual Tag passes through a lifecycle status to help you track its readiness.

| Status          | What It Means                                                                 |
| --------------- | ----------------------------------------------------------------------------- |
| **Not Defined** | You’ve created the value, but no resources are mapped yet.                    |
| **Defined**     | Resources have been mapped to the value, and associated costs are identified. |
| **Allocated**   | The value is used in your cost hierarchy and cost is allocated accordingly.   |

{% hint style="success" %}
A value is usable in Cost Atlas as soon as it is **Defined**. Allocation is optional.
{% endhint %}

## Managing Virtual Tags

All your created tags are listed in the **Virtual Tags** tab.

You can manage any tag using the menu on the right of each row:

* **Manage** — Edit values, logic, or name.
* **Delete** — Remove the tag if it's no longer needed

  <figure><img src="/files/5XSXWFGJXftALGQlnQm3" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
Once the tag has synced, a **View in Cost Atlas** button appears. Clicking it will open a predefined view showing costs associated with the tag.
{% endhint %}


# Shared Cost Allocation

## Overview

Virtual Tags in OneLens not only help you group untagged costs but also allow you to allocate those costs—either directly or across multiple cost centers. With flexible sharing methods like even split, fixed proportion, and weighted distribution, you get fine-grained control over how costs are tracked and reported.

## Why Allocate Shared Cost

In most cloud environments, you deal with services and resources that don’t belong to any one team. Platform services like CloudWatch, central storage buckets, shared networking, or monitoring tools often show up under a single cost center—usually the team that set them up. As a result, your cost visibility becomes skewed, and other teams escape accountability despite consuming shared services.

With OneLens, you can solve this by assigning such shared costs fairly across the right cost centers. Whether you want to divide costs equally, assign a fixed percentage, or let OneLens distribute costs based on usage, you stay in control—without needing AWS-native tags.

You do all this using **Virtual Tags**, right from within OneLens.

## What You Can Do

When setting up **Virtual Tags**, you can optionally define how costs associated with a tag value are allocated. You can:

* Assign all costs to **a single cost center**
* Distribute costs across **multiple cost centers by:**
  * **Even Split**\
    Divide the cost equally among selected cost centers, regardless of usage.
  * **Fixed Proportion**\
    Manually assign percentage splits to reflect planned ownership or budgeting.
  * **Weighted Allocation**\
    Automatically split cost based on each cost center’s actual usage or contribution to the bill.

## How You Can Allocate Cost

{% stepper %}
{% step %}
**Create a Virtual Tag**

→ Learn how to create [Virtual Tags](/observe-visibility-and-insights/cost-allocation/virtual-tags#how-to-create-a-virtual-tag)
{% endstep %}

{% step %}
**Define a Value with Conditions**

Add a new value and define its matching conditions. For example:

* **Field:** `Service`
* **Operator:** `Is`
* **Value:** `CloudWatch`

This will match all CloudWatch-related charges.
{% endstep %}

{% step %}
**Enable Cost Allocation**

While adding a value inside the tag:

* Click on **Allocate Cost**.

  <figure><img src="/files/5lpWGOT3IRCLOm0nU3zY" alt=""><figcaption></figcaption></figure>
* Choose between **Direct** or **Shared Allocation**.

{% tabs %}
{% tab title="Direct Allocation" %}
Use the **"Allocate To"** dropdown to pick the **one cost center** that should receive 100% of the cost.

<figure><img src="/files/Es1ZTa5c24K1Wr1UjkTc" alt="" width="563"><figcaption></figcaption></figure>
{% endtab %}

{% tab title="Shared Allocation" %}
Follow these steps to share the cost among multiple cost centers:

1. **Select a Cost Center Category**\
   This helps narrow down the list of eligible cost centers.
2. **Pick the Cost Centers**\
   Choose the specific cost centers that will receive a portion of the cost.
3. **Choose the Allocation Type:**

   <figure><img src="/files/71JtURG7GeF5G0QGQMop" alt="" width="563"><figcaption></figcaption></figure>

<table data-header-hidden><thead><tr><th width="112.01171875">Option</th><th>What It Does</th></tr></thead><tbody><tr><td><strong>Even Split</strong></td><td>Divides cost equally between the selected cost centers.</td></tr><tr><td><strong>Fixed Proportion</strong></td><td>Lets you assign specific percentages (e.g., 50%, 25%, 25%) to each center.</td></tr><tr><td><strong>Weighted Allocation</strong></td><td>Automatically distributes cost based on:<br>• <strong>% of Total Bill</strong> (e.g., based on last month's spend)<br>• <strong>% of Total of Selected Cost Centers</strong> (more precise within the chosen group)</td></tr></tbody></table>
{% endtab %}
{% endtabs %}
{% endstep %}
{% endstepper %}

{% hint style="info" %}

## Example Use Case

If your central data pipeline (e.g., a Redshift cluster) supports multiple departments, and you want to allocate the cost accordingly:

* Create a virtual tag value called `Shared Data Infra`.
* Define matching rules using fields like `Service = Redshift`.
* Allocate cost using shared allocation:
  * Cost Center Category: `Departments`
  * Cost Centers: `Analytics`, `Product`, `Finance`
  * Allocation Type: **Fixed Proportion**\
    → 40% Analytics, 40% Product, 20% Finance

This ensures shared resources are accounted for fairly—without requiring manual tracking or external spreadsheets
{% endhint %}


# Kubernetes Cost Allocation

Kubernetes environments are shared by nature.

Native cloud tags are insufficient.

OneLens K8s agent collects telemetry:

* CPU usage
* Memory usage
* Storage usage
* Network usage

Costs are attributed at:

* Namespace level
* Workload level
* Pod level (where applicable)

Then mapped to cost centres.

***

### How It Works

```
Cluster Cost
     ↓
Namespace Usage
     ↓
Workload Attribution
     ↓
Cost Centre Mapping
```

This enables:

* Team-level cluster accountability
* Workload-level optimization
* Shared cluster fairness


# Untaggable Cost Tagging

Not all cloud costs can be tagged at the source.

In real-world cloud environments, a significant portion of spend originates from **system-generated, billing-level, or shared infrastructure charges** that do not inherit resource tags.

If left unmanaged, these costs appear as:

* Unallocated
* Uncategorized
* Attributed to "No Owner"
* Dumped into root accounts

This creates reporting gaps and weakens financial accountability.

Virtual Tags solve this.

***

### Why Some Costs Cannot Be Tagged

Certain charges are generated:

* At billing time (not resource level)
* Across accounts
* Outside of compute resources
* At platform or enterprise agreement level

These charges **do not carry native tags**, even if tagging hygiene is strong.

Examples include:

* Data transfer between services
* Enterprise Discount Program (EDP) adjustments
* Support plan fees
* Reserved Instance (RI) amortization
* Savings Plan (SP) amortization
* Cross-account networking
* RDS automated backups
* Out-of-cycle adjustments
* Marketplace subscriptions

***

### How Virtual Tags Solve This

Virtual Tags allow rule-based allocation using billing metadata such as:

* Usage Type
* Charge Type
* Service
* Region
* Account
* Resource Name

Instead of modifying cloud tags, OneLens applies allocation logic during the cost pipeline.

This ensures 100% cost allocation coverage — even for costs that cannot be tagged natively.

***

### Example Rule

If:

* Usage Type contains `"DataTransfer"`
* Region = `us-east-1`

Then:

→ Assign to **Platform Shared Cost Centre**

This ensures shared networking costs are consistently allocated to the correct business owner.

***

### Common Untaggable Cost Examples

Below is a reference table of real-world untaggable or system-level charges and how they are typically handled.

| Cloud | Cost Type                                | Why It’s Untaggable                | Typical Allocation Strategy                           | Example Virtual Tag Rule                                         |
| ----- | ---------------------------------------- | ---------------------------------- | ----------------------------------------------------- | ---------------------------------------------------------------- |
| AWS   | Inter-AZ / Inter-Region Data Transfer    | Generated at network billing layer | Allocate to Platform or proportional to consuming BUs | `Provider = AWS` AND `Usage Type contains "DataTransfer"`        |
| AWS   | NAT Gateway Data Processing              | Network-layer charge               | Proportional split across consuming cost centres      | `Service = AmazonVPC` AND `Usage Type contains "NatGateway"`     |
| AWS   | RDS Automated Backup Storage             | System-generated backup usage      | Assign to owning application team                     | `Service = AmazonRDS` AND `Usage Type contains "BackupUsage"`    |
| AWS   | Enterprise Support Fee                   | % of monthly spend                 | Even split or proportional across all cost centres    | `Charge Type = Support`                                          |
| AWS   | Marketplace Subscription                 | Subscription-level billing         | Assign to owning BU                                   | `Billing Entity = AWS Marketplace`                               |
| AWS   | EDP (Enterprise Discount Program) Credit | Applied post usage                 | Proportional to total spend                           | `Line Item Type = Discount`                                      |
| AWS   | OOC (Out-of-Cycle) Charge                | Manual billing adjustment          | Assign to Finance Shared cost centre                  | `Line Item Type = Fee` AND `Description contains "Out of Cycle"` |

| Cloud | Cost Type                        | Why It’s Untaggable               | Typical Allocation Strategy          | Example Virtual Tag Rule                                     |
| ----- | -------------------------------- | --------------------------------- | ------------------------------------ | ------------------------------------------------------------ |
| Azure | Inter-Region Data Transfer       | Generated at network layer        | Allocate to Platform or proportional | `Provider = Azure` AND `Meter Category contains "Bandwidth"` |
| Azure | Azure Support Plan               | Subscription-level charge         | Even split across BUs                | `Meter Category = Support`                                   |
| Azure | Backup Vault Storage             | Generated by Azure Backup service | Assign to owning BU                  | `Service Name = Azure Backup`                                |
| Azure | Marketplace Charges              | Subscription-level billing        | Map to owning BU                     | `Publisher Type = Marketplace`                               |
| Azure | EA (Enterprise Agreement) Credit | Applied at billing account level  | Proportional across cost centres     | `Charge Type = Credit`                                       |

| Cloud | Cost Type                    | Why It’s Untaggable          | Typical Allocation Strategy | Example Virtual Tag Rule                                         |
| ----- | ---------------------------- | ---------------------------- | --------------------------- | ---------------------------------------------------------------- |
| GCP   | Inter-Region Network Egress  | Network-layer billing        | Proportional allocation     | `Provider = GCP` AND `SKU Description contains "Network Egress"` |
| GCP   | Committed Use Discount (CUD) | Billing-level construct      | Proportional allocation     | `Credit Type contains "CommittedUseDiscount"`                    |
| GCP   | Sustained Use Discount       | Applied post-usage           | Proportional allocation     | `Credit Type contains "SustainedUsage"`                          |
| GCP   | Cloud Support                | Billing account-level charge | Even split                  | `Service Description contains "Support"`                         |
| GCP   | Snapshot Storage             | Generated by system backup   | Assign to owning BU         | `SKU Description contains "Snapshot"`                            |
| GCP   | Marketplace Subscription     | Subscription billing         | Assign to BU                | `Service Description contains "Marketplace"`                     |

| Cloud | Cost Type              | Why It’s Untaggable        | Typical Allocation Strategy | Example Virtual Tag Rule                                     |
| ----- | ---------------------- | -------------------------- | --------------------------- | ------------------------------------------------------------ |
| OCI   | Data Transfer Outbound | Network-layer charge       | Proportional allocation     | `Provider = OCI` AND `Usage Type contains "DataTransferOut"` |
| OCI   | Support Subscription   | Account-level subscription | Even split                  | `Service Name contains "Support"`                            |
| OCI   | Reserved Capacity      | Billing-level allocation   | Proportional allocation     | `Usage Type contains "ReservedCapacity"`                     |
| OCI   | Backup Storage         | System-generated           | Assign to owning BU         | `Service Name contains "Backup"`                             |
| OCI   | Marketplace Listing    | Subscription billing       | Map to BU                   | `Service Category = Marketplace`                             |

## How to Think About These Rules

When creating Virtual Tag rules for untaggable costs:

1. Identify the billing dimension that uniquely describes the cost\
   (Usage Type, Meter Category, SKU Description, Charge Type)
2. Decide allocation strategy:
   * Even split
   * Proportional
   * Fixed percentage
3. Assign to:
   * A Shared Platform cost centre
   * A Finance root cost centre
   * A Specific BU

***

### What Happens Without Virtual Tags

Without rule-based allocation:

* Untagged costs appear under “Unallocated”
* Finance sees reconciliation gaps
* BU-level reports become inaccurate
* Engineering cannot identify optimization scope
* Shared services distort team budgets
* Leadership loses trust in reporting

Over time, this erodes cost accountability.

***

### What Happens With Virtual Tags

With proper Virtual Tag configuration:

* 100% cost allocation coverage
* No orphan spend
* Clean BU-level reporting
* Fair shared cost distribution
* Accurate margin analysis
* Audit-ready cost transparency

Finance trusts the numbers.\
Engineering trusts the attribution.\
Leadership trusts the reporting.

***

### Best Practice

Start by:

1. Identifying top unallocated cost categories.
2. Creating targeted Virtual Tag rules for those categories.
3. Reviewing allocation impact before pipeline execution.
4. Monitoring allocation accuracy monthly.

Untagged cost is not a tagging failure — it is a billing reality.\
Virtual Tags ensure that reality does not break your reporting.


# AI Unit Costs

> Detect abnormal AI spend before it becomes a billing surprise.

AI Cost Anomalies continuously monitors your AI spending and automatically detects unusual cost patterns across providers, models, projects, API keys, and teams. Every anomaly includes root cause analysis to help you understand what changed and where to investigate.

***

### Why use AI Cost Anomalies?

AI costs can increase unexpectedly due to:

* Traffic spikes
* Incorrect model routing
* Prompt changes
* Agent loops
* Misconfigured applications
* New deployments
* Shadow AI usage

Manually monitoring dashboards isn't scalable. AI Cost Anomalies proactively identifies unusual spending so your team can respond before costs escalate.

***

### How It Works

OneLens uses statistical models to learn your historical spending patterns and establish dynamic baselines for every monitored dimension.

When spend deviates significantly from expected behavior, an anomaly is generated automatically.

No manual threshold configuration is required.

***

### Detection Dimensions

Detect anomalies across multiple business and technical dimensions.

Supported dimensions include:

* Provider
* Region
* Service
* Model
* Caller (User or API Key)

This helps quickly isolate whether a spike is caused by infrastructure, an application, or a specific workload.

***

### Root Cause Analysis

Every anomaly includes an automatically generated root cause summary.

Understand:

* What changed
* Which dimension contributed most
* Estimated cost impact
* Timeline of the anomaly
* Recommended investigation path

Instead of simply notifying you that costs increased, OneLens explains where the increase originated.

***

### Token Contribution Analysis

Understand what actually drove the additional cost.

Depending on the provider, OneLens breaks down cost contribution across:

* Input Tokens
* Output Tokens
* Cached Tokens
* Reasoning Tokens

This helps determine whether increased costs were caused by larger prompts, longer responses, reduced cache efficiency, or reasoning-heavy workloads.

***

### Anomaly Lifecycle

Track the complete lifecycle of every anomaly.

Available states include:

* Open
* Acknowledged
* Investigating
* Resolved

This allows teams to collaborate, avoid duplicate investigations, and maintain an audit trail of incident resolution.

***

### Alerting & Notifications

Receive anomaly alerts through your existing communication channels.

Supported notification channels include:

* Email
* Slack
* Microsoft Teams
* ServiceNow

Notifications include a summary of the anomaly along with a direct link to investigate further.

***

### Investigate Faster

Each anomaly provides enough context to begin troubleshooting immediately.

Quickly answer questions like:

* Which model caused the spike?
* Which API key generated the spend?
* Which team owns the workload?
* Is this affecting one provider or multiple?
* Is the increase temporary or ongoing?

From the anomaly page, you can drill directly into the AI Cost & Usage Analyzer for deeper analysis.

***

### Example Scenarios

#### Unexpected Model Upgrade

An application starts routing requests from GPT-4o Mini to GPT-4. OneLens detects the sudden increase in cost and highlights the affected model.

***

#### Agent Loop

An autonomous workflow repeatedly calls an LLM, generating thousands of unnecessary requests. The abnormal spending pattern is detected within the reporting cycle.

***

#### Cache Miss Spike

A prompt update reduces cache effectiveness, causing a significant increase in input token costs. Token contribution analysis highlights the drop in cache efficiency.

***

#### Shadow AI Usage

A newly created API key begins generating significant spend outside approved projects. The anomaly identifies the caller responsible for the increase.

***

### Best Practices

* Review anomalies daily to identify issues before invoices arrive.
* Route alerts to the teams responsible for the affected workloads.
* Investigate recurring anomalies to identify long-term optimization opportunities.
* Use anomaly insights alongside AI Budgets to proactively manage spending.
* Track resolution status to ensure every anomaly is investigated and closed.


# Service Cost Monitoring


# Kubernetes Visibility

Kubernetes workloads can drive significant cloud costs—but they’re often the hardest to track. The Kubernetes Visibility section in OneLens brings clarity by helping you understand how your EKS clusters are spending across namespaces, workloads, and time periods.

Whether you're exploring high-level cluster metrics or deep-diving into workload-level costs, this page is your starting point.

## How OneLens Gathers Data

To give you detailed insights, OneLens brings together two key data sources:

#### 1. AWS Cost and Usage Report (CUR)

OneLens reads your billing data from CUR to identify EKS clusters, their overall cost, and associated savings opportunities. This helps you see costs even before deploying the agent.

{% hint style="warning" %}
Make sure EKS **split cost allocation** is enabled in your AWS account. Without it, workload-level breakdowns won’t be available. If you're unsure, check the [Enable Split Cost Allocation for EKS](/integrations/kubernetes/enable-split-cost-allocation-for-eks) page to configure it.
{% endhint %}

#### 2. OneLens Agent

Once you install the OneLens agent inside a cluster, you unlock granular, real-time breakdowns by namespace, workload, and label. This is essential for full visibility.

{% hint style="success" %}
To learn more about the agent and onboard your cluster, follow the steps on the [OneLens Agent](/integrations/kubernetes/onelens-agent) page.
{% endhint %}

## Calculating Kubernetes Cost and Efficiency

OneLens calculates your cost and gives you clear signals on how much of that spend is being used effectively.

#### Visual Breakdown of Kubernetes Cost

To help you visualize how OneLens categorizes your spend, refer to the flowchart below:

<figure><img src="/files/8frOaL8VBQFEuJ3tInjR" alt=""><figcaption></figcaption></figure>

### Cost Categorization

All costs are calculated using official  [**AWS pricing**](https://aws.amazon.com/eks/pricing/) for the resources identified in your clusters. Currently there are 4 supported components that incurs cost:

* **Compute Cost** – Covers EC2 instance usage behind your nodes, including reserved or spot capacity, container resource requests (CPU & memory), and idle headroom.
* **Storage Cost** – Includes both ephemeral node storage and persistent volumes (EBS, EFS, GP3, IO1, IO2), even if unattached or over-provisioned.
* **Networking Cost** – Accounts for load balancers and data transfer charges, with attention to misconfigured or orphaned resources.
* **Management Cost** – Captures Kubernetes control plane charges and extended support costs for outdated EKS versions.

The costs are categorized as:

* **Utilized** – Actively delivering value
* **Over-provisioned Capacity** – Reserved but underutilized
* **Wastage** – Incurred without being tied to active usage

{% hint style="success" %}
All pricing references AWS billing rates to ensure accuracy with your actual invoice.
{% endhint %}

### Efficiency Calculation

To help you measure how well your resources are being used, OneLens calculates an **efficiency score** throughout the Kubernetes Visibility experience.

**`Efficiency = Total Utilized Cost / Total Payable Cost`**

* **Utilized Cost** reflects what’s actively powering workloads.
* **Payable Cost** is the total cost attributed to that container, workload, node, or cluster based on AWS billing data.

You’ll see this efficiency metric consistently across views—whether you're looking at **workload efficiency**, **node efficiency**, or **cluster efficiency**—giving you a clear signal on where optimization opportunities exist.

## What to Explore Next

Once you’ve understood how Kubernetes costs are gathered and calculated in OneLens, here’s where you can go next:

* [View Clusters & Cost Trends](/observe-visibility-and-insights/service-cost-monitoring/kubernetes-visibility/view-clusters-and-cost-trends) – Learn how to access and interpret the cluster list.
* [Cluster-Level Breakdown](/observe-visibility-and-insights/service-cost-monitoring/kubernetes-visibility/cluster-level-breakdown) – Dive into cost by namespace and workload.
* [OneLens Agent](/integrations/kubernetes/onelens-agent) – Enhance visibility with deeper usage insights.


# View Clusters & Cost Trends

To explore how your EKS clusters are performing and where your Kubernetes costs are going, start by accessing the **Kubernetes Visibility** section in OneLens. This view gives you a high-level summary of your clusters along with cost, efficiency, and potential savings signals.

## How to Access It

1. **Log in** to your[ OneLens UI](https://app-in.onelens.cloud/).
2. From the **left-hand sidebar**, click on **Kubernetes**.
3. You’ll land on the **Clusters** tab by default—this is where all discovered EKS clusters are listed and analyzed.

## Clusters List

The **Clusters** page shows both connected and disconnected clusters discovered via CUR. Here you can see:

### **Key Metrics**

At the top of the page, you’ll find aggregated metrics that summarize your Kubernetes usage:

* **Cost (Month-To-Date)** – Total EKS cost incurred so far in the current month
* **Previous Month Cost** – Total cost from the last completed billing month
* **Potential Savings** – Estimated savings based on optimization recommendations from OneLens
* **Total Clusters** – The number of EKS clusters currently detected from CUR

You  can get a quick sense of current cloud spend trends, helping you assess how this month compares with the last and where optimization opportunities may exist.

### **Cluster List Table**

You’ll see a table listing all the EKS clusters detected through CUR, enriched with key metadata and metrics that help you assess both cost and operational efficiency.

Each row includes:

* **Cluster Name** – The name identified through CUR or the OneLens agent
* **Version** – The current Kubernetes version
* **Status** – Shows the cluster’s connectivity state:
  * **Connected** – OneLens agent is installed and actively sending data
  * **Disconnected** – Identified through CUR, but the agent hasn’t been installed yet
  * **Deleted** – The cluster has been removed from your environment but still appears in the list
* **Cost** – Total cost attributed to the cluster for the selected time period
* **Potential Savings** – Estimated savings based on inefficiencies and unused resources
* **Efficiency** – A derived metric (available only for connected clusters) that reflects how effectively the cluster resources are being utilized relative to cost
* **Region** – AWS region where the cluster is or was deployed

{% hint style="success" %}

## **NOTE**

Clusters marked as **Deleted** have been removed during the current month but still show up because they **incurred costs within the ongoing billing period**. They will automatically be removed from the list after the current month ends.&#x20;

**Hover on the** **delete status** to see the exact date of cluster deletion.
{% endhint %}

You can **click on any cluster name** in the table to view its **Cluster-Level Breakdown**, where you'll find workload, namespace, and resource-specific insights—available for connected clusters.

To learn more about what’s available at the cluster level, visit the [Cluster-Level Breakdown](/observe-visibility-and-insights/service-cost-monitoring/kubernetes-visibility/cluster-level-breakdown) page.

<figure><img src="/files/Ia06ofnCCRMU2M19jMbR" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="info" %}

## NOTE

The data in this section is fully powered by CUR by default.

If you’d like to view data from the **OneLens agent** wherever it's available—such as real-time breakdowns by namespace, workload, and labels—**toggle the data source switch** at the top-right corner of the page.
{% endhint %}

## Cost Analyzer

The **Cost Analyzer** tab gives you a breakdown of how your EKS costs are distributed across clusters, workloads, namespaces, and more. It functions just like the main **Cost Analyzer** tab in OneLens, but with a limited set of features tailored specifically for Kubernetes environments.

{% hint style="warning" %}

### Prerequisites

To view meaningful data on this page:

* Your CUR data must include **EKS split cost allocation**

Not sure if split cost allocation is enabled? Visit the [Enable Split Cost Allocation for EKS](/integrations/kubernetes/enable-split-cost-allocation-for-eks) guide.
{% endhint %}

<figure><img src="/files/0ZglzDUwRgVy6DCHEcVM" alt="" width="563"><figcaption></figcaption></figure>

{% tabs %}
{% tab title="Controls" %}
Customize your view using the following:

* **Date Range** – Select the period you want to analyze
* **Granularity** – Choose the time resolution (e.g., daily)
* **Filters** – Narrow the view by cluster, namespace, workload type, workload name, labels, charge type, or resource type.
* **Group By** – Choose how to segment the cost data across:
  * Cluster Name
  * Namespace
  * Workload Type
  * Workload Name
  * Labels
  * Resource Type
  * Charge Type
    {% endtab %}

{% tab title="Key Metrics" %}
You’ll find two primary metrics:

* **Total Cost** – Aggregated EKS cost for the selected filters and period
* **Cost Delta** – Change in cost compared to the previous time window
  {% endtab %}

{% tab title="Cost Trend Graph" %}
The graph helps you visualize how cost evolves over time across the selected grouping. You can toggle between two visualization styles:

* **Bar Chart** – Ideal for distinct comparisons across groupings
* **Area Chart** – Useful for viewing accumulated or stacked trends

If you prefer a focused view on tabular data, you also have the option to **hide the graph** entirely.
{% endtab %}

{% tab title="Detailed Table" %}
A tabular breakdown appears below the graph, giving you a structured view of cost by the selected grouping.

{% hint style="success" %}

## **Highlight**

You can **toggle the cost delta display** to view it as either:

* **Dollar ($)** value
* **Percentage (%)** change
  {% endhint %}

The table can also be **exported** for offline use or reporting. You can choose from:

* **CSV** – Ideal for detailed data analysis and manipulation.
* **Excel** – Provides a structured spreadsheet version of the report.
  {% endtab %}
  {% endtabs %}

## What to Explore Next

Dig into specific workloads or namespaces using the [Cluster-Level Breakdown](/observe-visibility-and-insights/service-cost-monitoring/kubernetes-visibility/cluster-level-breakdown) page.


# Cluster-Level Breakdown

The **Cluster Level Breakdown** gives you an in-depth view of your Kubernetes cluster's cost and efficiency. It helps you analyze how your infrastructure spend is distributed, how efficiently your workloads are running, and where savings opportunities exist. Everything is designed to help you take action at the cluster level.

From overall spend to granular inefficiencies in compute, storage, and networking, everything you need to take control is right here.

## Getting Started

To open a detailed view of any cluster, just click on the **cluster name** from the main Kubernetes Visibility page.

{% hint style="warning" %}
You’ll only see this breakdown for clusters that are **actively connected** to OneLens.
{% endhint %}

Once you're inside, you'll find four tabs that break down every aspect of your cluster:

* [**Summary**](#summary-your-starting-point)
* [**Cost Analysis**](/observe-visibility-and-insights/service-cost-monitoring/kubernetes-visibility/cost-and-node-analysis#cost-analysis)
* [**Node Analysis**](/observe-visibility-and-insights/service-cost-monitoring/kubernetes-visibility/cost-and-node-analysis#node-analysis)
* [**Workloads**](/observe-visibility-and-insights/service-cost-monitoring/kubernetes-visibility/workload-drilldown)

Each tab gives you a different dimension of your cluster's behavior.

<figure><img src="/files/Ue0Ez3Lmrqi2axJbBp5f" alt="" width="563"><figcaption></figcaption></figure>

## Quick Cluster Snapshot

At the very top of the breakdown, you’ll see key identifiers to orient yourself and make sure that you stay in right environment:

* **Cluster Name**
* **Status** (connected or disconnected)
* **Kubernetes Version**
* Associated **Account** and **Region**
* Any applied **Tags**

{% hint style="success" %}

### Set Your Timeframe Filter

Use the **date range selector** to define the time window for all metrics and charts. Whether you're reviewing monthly spend, analyzing a spike from last week, or tracking changes after an optimization—this control keeps your analysis focused and relevant.
{% endhint %}

## Summary: Your Starting Point

The **Summary** tab gives you a bird’s-eye view of what’s happening in your cluster. If you’re looking for a quick health check on how your resources are being used, this is the place to start. It has the following metrics:

* **Total Cost** shows you the complete spend for the selected period.
* **Cost Delta** compares it with the previous period so you can spot increases or reductions.
* **Potential Savings** surfaces estimated cost reductions based on identified inefficiencies.
* **Cluster Efficiency** gives you a score that reflects how much of your cost is actively contributing to workloads.

  <figure><img src="/files/jbc1qDcpTd4lSlVaT9Er" alt="" width="563"><figcaption></figcaption></figure>

### Cluster Cost Breakdown

This section helps you understand how your total cluster cost is allocated across key categories:

* **Utilized Cost** – cost directly tied to workloads actively consuming resources
* **Unused Cost** – cost from idle or underutilized resources
* **Cluster Management** – operational overheads required to run the cluster
* **Extended Support** – additional service-related costs (like EKS extended support)

This breakdown gives you a clean view of what you're paying for—and whether it's returning value.

### Utilized vs Unused Cost Breakdown

To go deeper, the **Utilized Cost Breakdown** and **Unused Cost Breakdown** let you analyze each of these cost types across major resource classes:

* **Compute**
* **Networking**
* **Storage**

By seeing both actively utilized and idle costs side-by-side, you get a full picture of how your infrastructure is performing—and where adjustments can lead to real savings.<br>

<figure><img src="/files/VN27nq8bLraEC8gpJTIa" alt="" width="563"><figcaption></figcaption></figure>

### Cluster Efficiency Breakdown

Efficiency is a combination of how your nodes, workloads, storage, and networking are performing. This breakdown shows you each dimension individually:

* **Nodes Efficiency** – how well CPU and memory are being used on your nodes
* **Workloads Efficiency** – whether workload requests align with actual usage
* **Storage Efficiency** – whether provisioned storage matches real demand
* **Networking Efficiency** – how effectively your allocated bandwidth is used

These metrics highlights the exact area that needs optimization.

### Efficiency Trend

The **Efficiency Trend** chart helps you track how your cluster’s performance is evolving. Use it to validate the impact of recent changes, monitor improvement over time, or detect regressions before they grow into larger issues.

<figure><img src="/files/Gu36VeDAZHZGahilnBHm" alt="" width="563"><figcaption></figcaption></figure>

## What’s Next?

The **Summary** tab gives you a complete overview of the cluster—but to go deeper, you can explore the other tabs of the Cluster Level Breakdown. Each has its own dedicated page to help you focus on what matters most:

* Head to the [Cost & Node Analysis](/observe-visibility-and-insights/service-cost-monitoring/kubernetes-visibility/cost-and-node-analysis) page for detailed cost trends and per-node metrics.
* Visit the [Workload Drilldown](/observe-visibility-and-insights/service-cost-monitoring/kubernetes-visibility/workload-drilldown) page to analyze workload-specific usage, efficiency, and waste.


# Cost & Node Analysis

## Overview

When you need a closer look into how your Kubernetes clusters are driving cost and efficiency, the **Cost & Node Analysis** section brings everything into focus. The analysis helps you break down cost drivers at the nodes level and evaluate how effectively your nodes are being utilized.

The page consists of two tabs: **Cost Analysis** and **Node Analysis**, each offering a distinct lens into your infrastructure.

## Cost Analysis

In the *Cost Analysis* tab, you're presented with a breakdown of costs specific to the cluster you're viewing. It carries the same intuitive layout as the broader [View Clusters & Cost Trends](/observe-visibility-and-insights/service-cost-monitoring/kubernetes-visibility/view-clusters-and-cost-trends#cost-analyzer) in Kubernetes Visibility, but here, your focus is narrowed to a single cluster.

You can see how costs are split across compute, storage, and networking within the cluster. Use familiar groupings and filters to drill into trends and identify shifts in cluster-level spend.  You get to stay proactive in managing cost surges before they become expensive problems.

<figure><img src="/files/KwPP9LPbyS84xk0hnx3N" alt="" width="563"><figcaption></figcaption></figure>

## Node Analysis

The *Node Analysis* tab is where you evaluate how well your underlying compute nodes are performing—both financially and operationally. Whether you’re trying to find underutilized nodes or validate the impact of your spot instance strategy, here you get all the data you need in one place.

### Key Metrics

Right at the top, you’ll find essential metrics that give you a snapshot of your node performance:

* **Total Compute Cost** – See what you're spending to run all nodes within the cluster.
* **Node Efficiency** – Understand how well you're utilizing provisioned CPU and memory cost.
* **Unused Cost** – Identify the portion of your spend that went to idle resources.
* **Spot Usage Cost** – Track the cost saved through your spot instance strategy.

  <figure><img src="/files/lNLRslmujZdLloraDvaO" alt="" width="563"><figcaption></figcaption></figure>

## Node Overview Table

Dig into each node’s performance and cost with the overview table. It’s designed to help you compare and group nodes effortlessly.

<details>

<summary>List of Columns</summary>

| Column                  | Description                                                                     |
| ----------------------- | ------------------------------------------------------------------------------- |
| **Group by Node Group** | Toggle this to organize the data by node groups for clearer analysis.           |
| **Node Type**           | Displays the instance type (e.g., `m5.large`, `c6g.xlarge`) used by the node.   |
| **Compute Hours**       | Shows the total number of hours each node has been active.                      |
| **Cost**                | Reflects the actual cost incurred by each node.                                 |
| **Efficiency**          | Highlights how effectively the node's resources are being utilized.             |
| **Spot Cost**           | Indicates the cost specifically incurred from using spot instances.             |
| **Spot Coverage %**     | Represents the percentage of the node's runtime that was covered by spot usage. |

</details>

<figure><img src="/files/HktipwVD01zn1EzkmzqD" alt="" width="563"><figcaption></figcaption></figure>

You can use this table to identify over-provisioned nodes, validate the balance between spot and on-demand usage, and plan more efficient resource distribution.

## Utilization Trend

The *Utilization Trend* section gives you visual insights into how CPU and memory are used over time—enabling quick identification of inefficiencies.

#### **CPU Utilization**

You can compare **CPU utilized**, **CPU unused**, and **p99 CPU utilization** against the total CPU hours. This makes it easier to identify whether certain nodes are being over- or under-utilized, and where right-sizing could cut costs.

#### **Memory Utilization**

In a similar view, track your **used** vs **unused** memory, helping you spot memory over-allocation early.

<figure><img src="/files/o5tLeOXbdksTEKyFk5aC" alt="" width="563"><figcaption></figcaption></figure>

## Spot vs On-Demand Usage Cost Trend

The following trend chart shows how your costs are split between **spot** and **on-demand** nodes over time. By following this graph, you can evaluate how well you're balancing cost savings with workload reliability. If spot coverage is too low, this view makes it clear—prompting you to consider opportunities for optimization.

<figure><img src="/files/p05JZ60cxc7aQhr90nLa" alt="" width="563"><figcaption></figcaption></figure>

## What’s Next?

Once you've explored how your nodes contribute to cost and performance, you can move to the [Workload Drilldown](/observe-visibility-and-insights/service-cost-monitoring/kubernetes-visibility/workload-drilldown) page to see how individual namespaces and deployments are utilizing those resources.&#x20;


# Workload Drilldown

Overview

The **Workloads** tab gives you a focused lens into how individual workloads are consuming resources and contributing to your Kubernetes costs. From spotting inefficient deployments to uncovering potential savings, this view helps you take targeted action where it matters most.

## Navigating the View

When you land on the Workloads, you're looking at cost and efficiency data with filtering and time-range controls available at the top. You have:

* **Group by Namespace**\
  To group your workloads by namespace to align insights with how your teams or applications are structured.
* **Filters**\
  To refine your view using filters like workload type, efficiency levels, or potential savings to zero in on specific problem areas.
* **Date Range**\
  To set a custom date range to analyze trends over time. This affects all usage metrics and cost graphs in the view.

## Key Metrics

At a glance, the top-level metrics give you quick insight into your environment:

* **Namespaces**\
  Shows how many namespaces are currently running workloads during your selected period.
* **Potential Savings**\
  Tells you how much cost you could potentially save by right-sizing your workloads based on current usage patterns.
* **Workload Efficiency**\
  Provides an overall percentage representing how well your workloads are utilizing their allocated resources cost.

## Exploring the Workload List

Next up, you'll find a list of all workloads within the scope of your filters. Each row is a workload that you can explore further.

<details>

<summary>Here’s what each column tells you:</summary>

| Column                       | Description                                                                                                                        |
| ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| **Namespace**                | <p>The Kubernetes namespace where the workload is running. </p><p><em>Click the name to open a namespace-level breakdown.</em></p> |
| **Workload Name**            | The name of the workload                                                                                                           |
| **Workload Type**            | Indicates if it’s a Deployment, StatefulSet, DaemonSet, etc.                                                                       |
| **Efficiency**               | Calculated based on CPU and memory utilization vs. requested values.                                                               |
| **Total Cost**               | Total spend associated with the workload during the selected timeframe.                                                            |
| **Potential Savings**        | Estimated savings from optimizing CPU or memory allocations.                                                                       |
| **CPU Utilization (p99)**    | Peak CPU usage observed 99% of the time (in millicores).                                                                           |
| **Memory Utilization (p99)** | Peak memory usage observed 99% of the time (in MB).                                                                                |

</details>

Use this table to spot inefficient workloads, high spenders, or those with savings opportunities. When a workload catches your eye, click its row to dive into the details.

<figure><img src="/files/31EBNw6POdjcUjhczdFt" alt="" width="563"><figcaption></figcaption></figure>

## Diving Into a Specific Workload

Once you **click into a workload name**, you’ll see everything you need to understand about its resource behavior and cost impact.

You’ll start with key identifiers:

* **Workload Name**
* **Workload Type**
* **Namespace**
* **Labels** (Automatically pulled from your Kubernetes metadata.)

  <figure><img src="/files/xAeZTfyhxuW38yFhrAJd" alt="" width="563"><figcaption></figcaption></figure>

### Overview Tab

This section summarizes how the workload is built and how it's performing.

* **Workload Specification**\
  See the number of replicas currently deployed for this workload.
* **Resource Utilization (Last 30 Days)**

  CPU and memory usage are visualized over time, compared against the requested and limit values. You have the option to select from the following statistical views.&#x20;
* Based on the choice, the graphs for both **CPU (in millicores)** and **memory (in MB)** will be updated, helping you understand how resource allocation compares to actual usage.

<details>

<summary>Statistical Views Available</summary>

| Option      | Description                                                                                                                                                      |
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **p99**     | 99th percentile – the usage value **below which 99% of data points fall**. Useful for understanding consistent high usage without being affected by rare spikes. |
| **p95**     | 95th percentile – balances typical usage and peaks, ideal for sizing buffers.                                                                                    |
| **Max**     | Shows the absolute highest value observed.                                                                                                                       |
| **Min**     | Displays the lowest recorded value, highlighting underuse.                                                                                                       |
| **Average** | Provides the overall mean usage over time.                                                                                                                       |

</details>

* **Daily Cost**\
  You can track how a workload’s cost changes over time using adjustable date ranges. Compare recent trends with historical patterns, identify any cost spikes, and evaluate whether optimizations have had an impact.&#x20;

  The data is available both as **a visual trend graph** and in a **detailed breakdown table**.

<figure><img src="/files/RZxe3bq2GPoyS94TpdNw" alt="" width="375"><figcaption></figcaption></figure>

### Container-Level Insights

Every workload is made up of containers — and here’s where you get to see their individual impact.

For each container tab, you’ll find:

* **Resource Utilization (Last 30 Days)**
  * CPU usage in millicores
  * Memory usage in MB
* **Daily Cost**
  * Grouped by resource type option
  * Visualized with total and average cost graphs
  * Backed by a detailed table for container-by-container breakdown

<figure><img src="/files/IQMhLHJxmMrMjBLxJgCB" alt="" width="375"><figcaption></figcaption></figure>

With this view, you can identify which containers are over-provisioned or which are driving cost spikes — giving you clear direction for optimization.


# Data Transfer Cost Reports

Managing cloud infrastructure often means overlooking data transfer costs. With OneLens, you can pinpoint these hidden expenses - whether from public traffic, inter-region transfers, or cross-AZ communication. This section helps you track where your data moves, what it costs, and how to control it.

## Access Data Transfer Cost Reports

1. Log into OneLens.
2. Navigate to the <kbd>**Data Transfer Cost**</kbd> from the main dashboard.

Here is how the dashboard will look like:

![](/files/UhthFyD7R57pz6TReFuU)

#### Number References

1. [View Option](#view)
2. [Date Range](#date-range)
3. [Granularity Level](#granularity-level)
4. [Cost Representation Type](#cost-representation-type)
5. [Filters](#applying-filters)
6. [Data Transfer Cost Trends](#data-transfer-cost-trend)
7. [Group By Option](#grouping-by-option)
8. [Visualization Type](#visualization-type)
   1. Bar Chart
   2. Filled Area Chart
   3. Table Format

[**Deep Data Transfer Cost View**](#deep-data-transfer-cost-view)

9. [By Region](#by-region)
10. [By Higher Data Transfer Cost Contributors](#by-highest-data-transfer-cost-contributors)
11. [By Resources](#by-resources)
12. [By Operations](#by-operations)

## Understanding Data Transfer Cost

### Report View Configuration

#### Report View

Start with the <kbd>**default view**</kbd> for a quick overview.

<img src="/files/aE1L8Mvv8VAWZl0dnnUj" alt="" width="188">

#### Date Range&#x20;

* **Predefined Range:** Quickly access relevant cost data by selecting a range such as “**Last 2 Weeks**” or “**Month-to-Date**”.&#x20;
* **Custom Range**: If you need to analyze costs over a specific period, define a custom date range to focus on the exact time frame.&#x20;

<figure><img src="/files/U0WeNx4HcDSqdapp6KgA" alt="" width="188"><figcaption></figcaption></figure>

#### *Granularity Level* &#x20;

You can aggregate cost data in three different ways, depending on the granularity you need for your analysis:&#x20;

* **Daily**&#x20;
* **Weekly**&#x20;
* **Monthly**&#x20;

<figure><img src="/files/cLWZ2qMqw3VwCZKqrinO" alt="" width="97"><figcaption></figcaption></figure>

#### *Cost Representation Type*&#x20;

You can choose the most relevant Cost Representation Type to gain the insights you need:&#x20;

* **Unblended Cost** – See the raw cost before any discounts.
* **Net Unblended Cost** – Get the final bill after AWS discounts are applied.
* **Blended Cost** – Useful when managing accounts with shared resources.
* **Amortized Cost** – See long-term costs distributed across the commitment period.
* **Net Amortized Cost** – The clearest view of your true, discounted long-term spending.&#x20;

<figure><img src="/files/5ZtJhs7Ie8RjNtdWmZfM" alt="" width="185"><figcaption></figcaption></figure>

#### Applying filters&#x20;

Filters help refine cost reports by focusing on specific data points. &#x20;

Here is how you apply filters:&#x20;

1. Navigate to the `Filters` section at top left corner.&#x20;
2. Select multiple conditions to filter data using an AND condition.&#x20;
3. Add rules by selecting:&#x20;
   1. **Field**: Choose a cost attribute (e.g., Service, Account, Usage Type, Cost Center).&#x20;
   2. **Operator**: Available operators for setting filter conditions include **In** or **Not In**.&#x20;
   3. **Value**: Enter the specific data point to filter (e.g., EC2, us-east-1, >$1000).&#x20;
4. Click `Apply` to filter cost data and focus on relevant insights.&#x20;

{% hint style="info" %}

## **Use case**&#x20;

A cloud engineer wants to analyze storage costs for a specific AWS region and service to track data transfer expenses more effectively.&#x20;

### **Solution:**

The engineer applies the following filters:&#x20;

* Service: **Amazon S3**&#x20;
* Region: **us-east-1**&#x20;

The Data Transfer Cost Report then displays cost data specifically for Amazon S3 in the US-east-1 region, helping the engineer track and investigate any rising data transfer costs.&#x20;
{% endhint %}

<figure><img src="/files/PBEDYgwFMIBebCCpe8Fa" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}

## **Save Your Configured View**

After customizing your view, save it for easy access later. [Click here to learn how to save your view](/observe-visibility-and-insights/cost-reporting/cost-atlas/saved-views#how-to-save-a-view).
{% endhint %}

### Key Metrics

Right at the top, you’ll find a quick snapshot of where things stand.

#### **Total Cost**

* This shows your full cloud spend for the selected period.

#### **Total Data Transfer Cost (Data Transfer Cost)**

* Focus in on how much of that spend is due to data transfer.

#### **Data Transfer Cost Delta**

* See whether your data transfer cost is climbing or falling compared to the previous time window.

![](/files/w2ujfyh6GgjIahZiydIZ)

### Data Transfer Cost by Transfer Type

Understand the nature of your data movement and where the money goes.

#### **Public Transfers**

* Track internet-bound traffic and associated costs.

#### **Inter-AZ Transfers**

* Measure internal transfers between availability zones that still incur charges.

#### **Inter-Region Transfers**

* Identify cross-region communication that often spikes your bill.

{% hint style="success" %}

## Tip

Click on any transfer type name to hide or show its data in the visualization.
{% endhint %}

![](/files/WISl8KZZFqYW4tug3HLQ)

### Data Transfer Cost Trend

Explore how your data transfer cost behaves over time, with flexible options for grouping and visualization.

{% hint style="success" %}

## **Hover Chart for Detailed Insights**

While exploring charts, <kbd>**hover over any area**</kbd> to instantly view detailed information for that segment.
{% endhint %}

#### **Grouping By Option** &#x20;

You can **group by** using the following dimensions:&#x20;

1. Account&#x20;
2. API Operation&#x20;
3. Availability Zone&#x20;
4. Billing Entity&#x20;
5. Charge Type&#x20;
6. Database Engine&#x20;
7. Legal Entity&#x20;
8. Platform&#x20;
9. Purchase Option&#x20;
10. Region&#x20;
11. Resource&#x20;
12. Service&#x20;
13. Tag&#x20;
14. Tenancy
15. Transfer Type
16. Usage Type

<figure><img src="/files/Y0KlxDaAkwt6ZrdMKo5z" alt="" width="278"><figcaption></figcaption></figure>

#### **Visualization Type**

**Bar Chart**

* Use this view to compare data transfer costs across categories—such as accounts, services, or regions—side by side.

![](/files/fEa0vszVeHsDDWQaSVjj)

**Stacked Filled Chart**

* Ideal for identifying cumulative trends over time, this chart shows how different components contribute to the total cost.

![](/files/YzJobevevM1chdAKIBNv)

**Table Format**

* Provides a detailed, exportable view of your data, ideal for deep analysis or sharing with stakeholders.

<figure><img src="/files/M8w7S0dcbhqjHM1NvSGI" alt=""><figcaption></figcaption></figure>

### Deep Data Transfer Cost View

Once you've reviewed the trends and key metrics, you can drill down into the details to uncover exactly where your data transfer costs are coming from.

#### **By Region**

Get a complete picture of how data transfer costs vary across AWS regions. There are two main sections available, plus the **option to toggle a detailed table format**:

* **Highest Spending Regions**
  * View the regions with the highest data transfer costs, making it easy to identify key cost drivers.
* **Data Transfer Cost Overview**
  * Get a comprehensive look at the overall distribution of data transfer costs across all AWS regions.
* **Table View**
  * Switch to a table format for a more granular breakdown of the data. The table can be exported for offline analysis or reporting.

!\[A screenshot of a computer

AI-generated content may be incorrect.]\(/files/ZCksxe2AdbqGJOqZC6dC)

#### **By Highest Data Transfer Cost Contributors**

Identify the top contributors to your data transfer costs. This view is broken down into three key sections, each with **an option to toggle the table format** for a detailed breakdown:

* **By Service**
  * View the top services contributing to your data transfer costs.
* **By Account**
  * See which accounts are driving the most data transfer costs in your environment.
* **By Cost Center**
  * Break down costs by your internal cost center structure. You must select one of the following **granularities to view the breakdown:&#x20;**<kbd>**Account, Environment, Root, or Project**</kbd>.

![](/files/RlYO0uLTnBiaTqNPkEyo)

#### **By Resources**

View the resources contributing to your data transfer costs, focusing on the top 10, with these key features:

* **Data Size in GB or TB**
  * Toggle between GB or TB to see the data transfer size in the format that suits your needs.
* **Table View**
  * Switch to a table format to access a comprehensive list of all resources contributing to data transfer costs. This view is exportable for further analysis.

![](/files/IPN56okwhYsIOnWSC5SI)

#### **By Operations**

You can analyze data transfer costs based on AWS operations, focusing on the top 10. Key features include:

* **Data Size in GB or TB**
  * Toggle between GB or TB to view the data transfer size in your preferred unit for better scalability insights.
* **Table View**
  * Switch to a table format to view all operations contributing to data transfer costs. This option is exportable for further analysis.

![](/files/Ngx9sIGyF1DGbIOcgj0x)

## Export Reports

You can export cost reports for offline analysis or to share with stakeholders.\
The **Export** option is available at the **top left corner of every table view**.

You can choose from:

* **CSV** – Ideal for detailed data analysis and manipulation.
* **Excel** – Provides a structured spreadsheet version of the report.

<figure><img src="/files/gjKGszI0LK1bYzYepsxG" alt=""><figcaption></figcaption></figure>

#### Sample Preview

Here is the preview of a sample exported report:

<figure><img src="/files/zrzPNlVrOWjviUPsr97k" alt=""><figcaption></figcaption></figure>


# RI and SP Visibility


# Budgeting (SV)


# Setup Budgets


# Budget Alerts


# Budget Variance Reports


# Saving Dashboard

The **Saving Dashboard** gives you a comprehensive view of your cloud savings opportunities. It highlights potential savings across accounts, services, and regions, while also tracking savings that have already been achieved. This helps you focus on high-impact areas for cost optimization and measure progress.

## Key Features

### [Potential Savings](/optimize-cost-savings-and-recommendations/saving-dashboard/about-potential-savings)

The **Potential Savings** page shows opportunities to reduce costs across your cloud infrastructure. It organizes savings by account, service, region, and more, prioritizing opportunities based on impact and required effort.

You can use the data here to focus on areas that offer the highest return with the least effort, and take actions that are aligned with your cost-saving goals.

### [Achieved Savings](/optimize-cost-savings-and-recommendations/saving-dashboard/about-achieved-savings)

The **Achieved Savings** page displays the savings you have already realized. It tracks the cost reductions you’ve made and provides visibility into the success of your cost optimization strategies.

By reviewing the achieved savings, you can assess the effectiveness of your actions and fine-tune your approach for further improvements.


# About Potential Savings

The **Potential Savings** page highlights where you can reduce cloud spend based on policy-driven analysis. You’ll see actionable savings opportunities, track progress, and prioritize work based on effort and risk.

## How Potential Savings Are Calculated

* #### **Policy-Based Identification**

Every savings opportunity originates from a [policy violation](/optimize-cost-savings-and-recommendations/policy-violations) that highlights inefficiencies in your infrastructure—such as idle services, outdated instances, or over-provisioned capacity.

These evaluations are driven by [cost optimization policies](/govern-control-and-governance/cost-optimization-policies), which run daily across your cloud environment to detect areas of improvement.

* #### **AWS Pricing Comparison**

OneLens calculates potential savings by comparing the current cost of a resource with the cost of its recommended alternative using real-time AWS pricing data.

* #### **Monthly Potential Savings**

The calculated cost delta between the current and recommended state is **projected over 30 days** to reflect **monthly savings**.

#### Applied Example: Rightsizing an RDS Instance in Mumbai

Suppose you’re running an RDS instance of type `db.m7g.4xlarge` in the **Mumbai region**. OneLens detects underutilization and recommends a rightsizing action to **`db.m7g.2xlarge`**, based on the resource’s performance profile and violation attributes.

**Mumbai Region On-Demand Pricing:**

* `db.m7g.4xlarge`: **$1.916/hour**
* `db.m7g.2xlarge`: **$0.958/hour**

**Savings Calculation:**

* Hourly savings: $1.916 − $0.958 = **$0.958**
* Monthly potential savings: $0.958 × 24 × 30 = **$689.76**

This value—**$689.76**—is what OneLens displays as your **monthly potential savings** for this optimization opportunity.

{% hint style="success" %}
If multiple recommendations exist (e.g., two instance types based on performance), OneLens uses the most suitable one based on the policy violation's attributes.
{% endhint %}

To explore how potential savings are identified and displayed, visit the [Potential Savings page](/optimize-cost-savings-and-recommendations/saving-dashboard/view-potential-savings) for a comprehensive overview of the OneLens UI.


# View Potential Savings

Here is a walkthrough of the Potential Savings UI in OneLens. Each savings opportunity is based on a policy violation and is calculated using **region-specific AWS pricing**.

## Accessing Potential Savings

To get started:

1. Log in to your **OneLens UI**.
2. Navigate to **Savings Dashboards** from the left sidebar.
3. The below **Potential Savings** page opens by default.

![](/files/sh53tSyLvEQVPoEtQaNI)

#### Number References

1. [View Option](#view-option)
2. [Filters](#filter)

**Metric**

3. [Potential Saving](#potential-savings)
4. [Violation Detected](#violations-detected)
5. [Unique Resources](#unique-resources)

**Potential Saving Charts**

6. By Services
7. By Account
8. By Region

{% hint style="success" %}

## **Hover Chart for Detailed Insights**

While exploring charts, <kbd>**hover over any area**</kbd> to instantly view detailed information for that segment.
{% endhint %}

## Configuring the View

When you open the Potential Savings page, the **default view** is displayed. From here, you can either choose a pre-saved view or save a customized view for future use.

### View Option

You can start with pre-saved views or customize your own using filters.

* **Recent Tickets**: Shows tickets created in the last 7 days.
* **Quick Wins**: Filters for low-risk, easy-effort opportunities.
* **Waste**: Focuses on unused resources.
* **Graviton**: Surfaces opportunities to switch to Graviton instances.

![](/files/8LzrkrVWZhy4QQvFX31W)

{% hint style="success" %}

## Tip&#x20;

To learn how to save a customized view, [click here](/observe-visibility-and-insights/cost-reporting/cost-atlas/saved-views#how-to-save-a-view).
{% endhint %}

### Filter

Refine your view using filters:

* **Account ID**: Focus on a specific AWS account.
* **Region**: Limit results to a particular AWS region.
* **Service**: Select an individual AWS service.
* **Cost Center**: Filter by your organizational cost centers.
* **Created Date**: Choose a time window for ticket creation.
* **Change Type**:
  * **Application Changes**: Updates to app components.
  * **Config Changes**: Infrastructure-level adjustments.
  * **Decommissioning**: Terminating unused resources.
  * **Scheduling**: Time-based cost-saving actions.
* **Cost Saving Category**: Filter by the nature of the savings opportunity.
* **Risk**:
  * **Low**: Low-risk, generally safe changes.
  * **High**: Higher risk may need review.
* **Effort**:
  * **Easy**: Quick wins with minimal effort.
  * **Medium**: Requires moderate effort or coordination.
  * **Hard**: Higher-effort tasks with broader impact.

![](/files/8gQe21m4o5ORISXTNozE)

## Key Metrics

**Potential Savings**

See how much you could be saving monthly if you implement all recommended actions.

**Violations Detected**

Track the number of policy violations across your infrastructure.

{% hint style="warning" %}

## Note&#x20;

A single resource can be counted in multiple violations.
{% endhint %}

**Unique Resources**

Understand how many distinct resources are contributing to your potential savings.

![](/files/KTU1wAkoCDMt8cri2TN7)

## Potential Savings Trend

Understand how your savings opportunities are distributed:

### **Group By**

1. **Account**: Spot which accounts offer the most savings.
2. **Service**: Focus on the services where optimization will make the biggest impact.

### **Stack By**

Options vary based on your selection above:

1. When grouping by **Account**, you can stack by::
   1. **Service**
   2. **Region**
2. When grouping by **Service**, you can stack by::
   1. **Region**
   2. **Account**

![](/files/15U0ZhBUfdT49E4DBQb5)

## Potential Savings by Effort

This chart breaks down savings by how easy or hard they are to implement:

1. **Easy**: Minimal effort to implement.
2. **Medium**: Moderate effort and planning.
3. **Hard**: Significant changes or collaboration needed.

![](/files/un5Ukm8Zac1AhExuEsJO)

## Top 5 Saving Opportunities

Here you get the top 5 saving opportunities identified across your cloud environment. These are based on policy evaluations highlighting the most impactful actions you can take to reduce costs.

The table displays the following:

1. **Policy Name**: The policy that flagged the opportunity.
2. **Service**: The AWS service where the savings apply.
3. **Potential Savings**: Estimated monthly savings if all recommended actions are completed.
4. **Achieved Savings**: Actual monthly savings already realized from resolved tickets.
5. **Resources**: Total number of affected resources under this policy.

{% hint style="success" %}

## Tip

Clicking on any **Policy Name** opens a detailed view with all related tickets.
{% endhint %}

![](/files/ofIMz3UBaWexsVqwDSzd)


# About Achieved Savings

The Achieved Savings section shows the **monthly cost reductions** you've already realized. It provides insights into where and how these savings were made, broken down by service, account, and region.

## Achieved Savings Calculation- How it Works

When you resolve a ticket in OneLens, it doesn’t just close immediately. Instead, the ticket moves into a **Pending Verification** stage. During this time, OneLens watches the resource linked to that ticket to check if the recommended action was actually carried out.

This verification period lasts for **5 days** right after you mark the ticket as resolved.

### **What Happens During These 5 Days?**

OneLens continuously monitors the resource to detect specific types of changes that prove the recommended action was implemented. These changes include:

* **Pricing Variance:** Switching pricing models or instance types, such as moving from On-Demand to Reserved.
* **Provisioned Capacity Change:** Rightsizing or scaling down resources.
* **Resource Deletion:** Completely removing the resource.
* **Resource Stop:** Temporarily shutting down a running resource.
* **Resource Upgradation:** Detected when the previous usage type disappears, indicating a replacement or scale-up.

Once a qualifying change is detected, OneLens identifies the **Date of Change (DOC)** — the exact day the change first occurred. To confirm the change is stable and not a short-term fluctuation, it reviews usage data with a 3-day buffer before and after the DOC.

Then, OneLens calculates savings by comparing the resource’s cost over two periods:

* **Pre-Change Cost:** The average daily cost over the 7 days before the DOC.
* **Post-Change Cost:** The average daily cost over the 3 days following the DOC.

If no relevant change is found within the 5-day window, the ticket is automatically marked as **Auto Resolved** with zero achieved savings recorded.

### How Savings Are Calculated

Once the change is confirmed, OneLens calculates the achieved savings by comparing costs before and after the change:

1. **Pre-Change Cost:** It averages the daily cost of the resource over the 7 days before the DOC.
2. **Post-Change Cost:** It averages the daily cost over the 3 days following the DOC.
3. **Daily Savings:** Subtract the post-change daily cost from the pre-change daily cost.
4. **Monthly Savings:** Multiply the daily savings by 30 to estimate monthly  achieved savings.

{% hint style="warning" %}
Keep in mind, this is an estimate and actual monthly savings may vary due to fluctuations in usage patterns, pricing changes, or other factors.
{% endhint %}

{% hint style="success" %}

#### What Happens When Multiple Tickets Are Resolved by One Change?

Achieved savings are calculated at the **resource level**. This means OneLens measures the total savings from a single resource, regardless of how many tickets or policies were involved.

If one change addresses multiple tickets linked to the same resource, the savings from that change are combined into a single achieved savings value for that resource—avoiding double counting.
{% endhint %}

To see how realized savings are tracked and visualized, visit the [Achieved Savings page](/optimize-cost-savings-and-recommendations/saving-dashboard/view-achieved-savings) for a detailed walkthrough of the OneLens UI.


# View Achieved Savings

This page explains how achieved savings are displayed in the OneLens UI. Here is the detailed explanation on how you walk through the Achieved Savings page.

## Access Achieved Savings Page

1. **Log in** to the OneLens UI using your credentials.
2. From the **left sidebar**, go to the **Savings Dashboard** section.
3. At the top of the dashboard, click on **Achieved Savings** to open the page.

![](/files/Gc68l0uJY2CPHalbrZZo)

#### Number References

1. View
2. Time Range
3. Granularity Levels
4. Filters
5. Achieved Savings metrics
6. Tickets Resolved metrics
7. Unique Resource Optimized metrics

## Configuring the View

You have the flexibility to configure the data you see with several options:

#### View Option

Start with the **default view** for a quick overview or switch to a **custom view** to tailor the dashboard layout and focus.

<img src="/files/QqVUihoYNdoYYO1iOiW7" alt="" width="375">

{% hint style="success" %}

## Tip&#x20;

To learn how to save a customized view, [click here](/observe-visibility-and-insights/cost-reporting/cost-atlas/saved-views#how-to-save-a-view).
{% endhint %}

#### *Time Range* &#x20;

* **Predefined Range:** Quickly access relevant cost data by selecting a range such as “**Last 2 Weeks**” or “**Month-to-Date**”. &#x20;
* **Custom Range**: If you need to analyze costs over a specific period, define a custom date range to focus on the exact time frame. &#x20;

<figure><img src="/files/QPWeVbzagkpbLLlqFC1u" alt="" width="375"><figcaption></figcaption></figure>

#### Granularity Level  &#x20;

You can aggregate cost data in three different ways, depending on the granularity you need for your analysis: &#x20;

* **Daily** &#x20;
* **Weekly** &#x20;
* **Monthly** &#x20;

<figure><img src="/files/WcbNgaVsu4gsQ2A2xNcP" alt="" width="375"><figcaption></figcaption></figure>

#### Filters

Narrow down the data by applying various filters:

* **Account ID**: Focus on a specific AWS account.&#x20;
* **Region**: Limit results to a particular AWS region.&#x20;
* **Service**: Select an individual AWS service.&#x20;
* **Change Type**:&#x20;
  * **Application Changes**: Updates to app components.&#x20;
  * **Config Changes**: Infrastructure-level adjustments.&#x20;
  * **Decommissioning**: Terminating unused resources.&#x20;
  * **Scheduling**: Time-based cost-saving actions.&#x20;
* **Cost Saving Category**: Filter by the nature of the savings opportunity.&#x20;

![](/files/FPYdeggdJv0sWw6avaic)

## Key Metrics

The following metrics give you a clear overview of your savings progress and impact.

**Achieved Savings**

* The total savings you’ve realized through resource optimizations.

**Tickets Resolved**

* The number of cost-saving tickets you’ve resolved.

**Unique Resources Optimized**

* The number of distinct resources you’ve optimized to help reduce costs.

![](/files/CA71ri3hcut7ZSMRdkwP)

## Savings Breakdown

This section helps you see where your **Achieved Savings** have come from. The three pie charts display your savings broken down by:

1. **Service** – Shows which cloud services (e.g., EC2, S3, Lambda) contributed to your savings.
2. **Account** – Identifies which AWS accounts generated the savings.
3. **Region** – Highlights the regions where savings were realized.

![](/files/RW9tTk8H2YL3a9ZxdyGw)

### Deeper Analysis

Click the **Explore Breakdown** button in the top-right corner of any chart to view more detailed analysis for that dimension.

This opens a page with two views:

#### **Graph View**

* Track how your savings have evolved over time
* Switch between **Bar** or **Filled Area** charts
* Toggle between **Cumulative** (total savings over time) and **Distinct** (savings per time period) views.

{% hint style="success" %}

## **Hover Chart for Detailed Insights**

While exploring charts, <kbd>**hover over any area**</kbd> to instantly view detailed information for that segment.
{% endhint %}

#### **Table View**

* See detailed savings data by row
* Use the **Highlight** button in any row to highlight the corresponding data in the chart.

![](/files/kBFV4APGDldfQwA6t12E)

#### **Controls Your View**

At the top of the analysis page, you'll find controls to adjust what data is shown in both views:

* **Time Range**: Choose the timeframe to view your achieved savings
* **Granularity**: Decide whether you want to see the data grouped by day, week, or month.
* **Group By**: Switch between **Service**, **Account**, or **Region** to see savings from different perspectives.
* **Hide the Chart**: Toggle the chart visibility on or off depending on your preference for focusing on the table.

## Ticket Resolution Trend

Use this section to track how many cost-optimization tickets have been resolved across different dimensions and time periods.

### Group By

Choose how you want to break down the resolution trends:

* **By Overall**: View the total resolved tickets without segmentation.
* **By Region**: See where optimizations are happening across AWS regions.
* **By Service**: Understand which AWS services have the most resolved tickets.
* **By Account**: Compare ticket resolution activity by account.

### Chart Type

Customize how you view the trend visually:

* **Bar Chart**: Best for comparing ticket counts across categories.
* **Area Filled Chart**: Ideal for seeing overall trends and changes over time.

![](/files/3ZvyLTDwAZWhPcqAhixW)

## Achieved Saving vs Cost Trend

The **Achieved Savings vs Cost Trend** section lets you compare your **Achieved Savings**, **Actual Costs**, and **Expected Costs** over your selected period.

### Graph Visual

* **Achieved Savings**: View your total realized savings over time with an area graph, showing how your optimizations have impacted costs.
* **Actual Costs**: Track the actual costs you’ve incurred, helping you see how spending changes over the selected time frame.
* **Expected Cost**: The expected cost line lets you compare what your costs should have been, based on your usage and historical data.

#### **View Customization**

**Chart Type Toggle**

* **Bar Chart**: Choose the bar chart to compare data across specific periods.
* **Filled Area**: Select the filled area view to see trends more visually over time.

**Cumulative vs Distinct View:**

* **Cumulative**: Choose this view to see accumulated savings and costs over time.
* **Distinct**: Select this option to view data for individual time periods without accumulation.

![](/files/17ROWkxGRFw8wxd83CGH)

### Deeper Analysis

When you want a more detailed analysis, click the **Explore** button at the top right corner of the chart. This will open a new page with two available views:

1. **Graph View**: The graph shows the Achieved Savings, Actual Costs, and Expected Costs over time.
2. **Table View**: Below the graph, you can view the same data in a tabular format for easier comparison of individual data points.

{% hint style="success" %}

## Note

By clicking the **highlight button** in a table row, the corresponding data for that row is shown in the graph above. This allows you to visually analyze specific data points in more detail.
{% endhint %}

#### **Shared Configuration Options**

The following configuration options are shared between both graph and table views:

* **Time Range**: Set the desired time period for the analysis.
* **Granularity Level**: Choose the level of detail (Daily, Weekly, or Monthly).
* **Hide the Chart**: Toggle the chart visibility on or off depending on your preference for focusing on the table.

![](/files/p83ci4XJJZvupSoDobhw)


# Policy Violations

## Overview

Policy violations occur when your cloud resources deviate from **predefined OneLens cost-saving policies**. These breaches are automatically detected based on daily checks across your environment.

The **Policy Violations** page provides a centralized view of all such breaches, showing the violated policy, affected services, involved resources, and the potential savings associated with each violation.

## Exploring the Violation Dashboard

To begin with:

* **Log in** to the OneLens UI using your credentials.
* From the **left sidebar**, go to the **Policy Violation** section.

Here is how the main page looks:

<figure><img src="/files/OJ3ykN1yVOzrJLLQPPA1" alt=""><figcaption></figcaption></figure>

#### Number References

1. [View Option](#view-option)
2. [Filters](#filter)
3. Potential Savings
4. Achieved Savings
5. Violations Detected
6. Unique Resources
7. Search Bar
8. [Policy Table](#violated-policies-table)&#x20;

### View Option

You can start with pre-saved views or customize your own using filters.

* **Recent Tickets**: Shows tickets created in the **last 7 days**.
* **Quick Wins**: Filters for **low-risk**, **easy-effort** opportunities.
* **Waste**: Focuses on **unused resources**.
* **Graviton**: Surfaces opportunities to switch to Graviton instances (for AWS)
* **Savings Achieved**: Status marked as **Acted & Closed**.

<figure><img src="/files/Z3HT7nT5r0tnGgAx0LXE" alt="" width="365"><figcaption></figcaption></figure>

{% hint style="success" %}

## Tip&#x20;

To learn how to save a customized view, [click here](/observe-visibility-and-insights/cost-reporting/cost-atlas/saved-views#how-to-save-a-view).
{% endhint %}

### Filter

Refine your view using filters:

* **Account ID**: Focus on a specific cloud account.
* **Region**: Limit results to a particular cloud region.
* **Service**: Select an individual cloud service.
* **Cost Center**: Filter by your organizational cost centers.
* **Created Date**: Choose a time window for ticket creation.
* **Change Type**:
  * **Application Changes**: Updates to app components.
  * **Config Changes**: Infrastructure-level adjustments.
  * **Decommissioning**: Terminating unused resources.
  * **Scheduling**: Time-based cost-saving actions.
* **Cost Saving Category**: Filter by the nature of the savings opportunity.
* **Risk**:
  * **Low**: Low-risk, generally safe changes.
  * **High**: Higher risk may need review.
* **Effort**:
  * **Easy**: Quick wins with minimal effort.
  * **Medium**: Requires moderate effort or coordination.
  * **Hard**: Higher-effort tasks with broader impact.

<figure><img src="/files/JGue0fbT2VlFHn1v55Aa" alt=""><figcaption></figcaption></figure>

### Key Metrics

* **Potential Savings** – Combined estimated savings across all detected violations.
* **Achieved Savings** – Total savings already realized per month from resolved tickets.
* **Violations Detected** – Number of unique policies currently violated.
* **Unique Resources** – Total distinct resources involved in these violations.

### Violated Policies Table

Each violated policy is displayed as a row in the table, capturing key impact metrics:

* **Policy Name** – The name of the cost-saving policy that has been violated.
* **Service** – The cloud service associated with the policy (e.g., EC2, S3, Azure VM, GCP Compute Engine).
* **Potential Savings** – Estimated savings if the violation is addressed.
* **Achieved Savings** – Actual savings realized if actions have already been taken.
* **Resources Affected** – Number of unique resources that have triggered the violation.

{% hint style="success" %}
Click on any **Policy Name** to open its detailed violation view.
{% endhint %}

{% hint style="info" %}

## Next Step

To explore the tickets created under a specific violated policy, see\
[**Viewing Specific Policy Violations**](/optimize-cost-savings-and-recommendations/policy-violations/drill-down-into-policy-violations)
{% endhint %}


# Drill Down into Policy Violations

You can further drill down into any policy to get the detailed view of the individual tickets generated for specific resource violations, helping prioritize remediation and track cost optimization opportunities.

## Explore the Policy View

When you select a policy from the **Policy Violations** dashboard, you'll land on a dedicated page with:

* A list of all tickets raised under the selected policy.
* Resource-level insights with savings and status tracking.
* A toggle to **show/hide policy details.**
* A direct link to **open the policy configuration settings** if adjustments are needed.

<figure><img src="/files/AMdV1ahw4bbeWkrie0ma" alt=""><figcaption></figcaption></figure>

#### Number References

1. Policy Name
2. Policy ID
3. Show/Hide Policy Details Tab
4. Policy Configuration Tab
5. [Customize View Options](#view-option)
6. Search Box
7. [Filters](#filter)
8. [Export Report](#export-report)

### Customize the View

You can start with pre-saved views or customize your own using filters.

* **Recent Tickets**: Shows tickets created in the **last 7 days**.
* **Savings Achieved**: Status marked as **Acted & Closed**.

<figure><img src="/files/IySGnK9hqyp72GNEiCrE" alt="" width="366"><figcaption></figcaption></figure>

{% hint style="success" %}

## Tip&#x20;

To learn how to save a customized view, [click here](/observe-visibility-and-insights/cost-reporting/cost-atlas/saved-views#how-to-save-a-view).
{% endhint %}

### Filters to Refine

Refine your view using filters:

* **Account ID**: Focus on a specific AWS account.
* **Region**: Limit results to a particular AWS region.
* **Status**: Filter based on the ticket status.
* **Cost Center**: Filter by your organizational cost centers.
* **Created Date**: Choose a time window for ticket creation.

<figure><img src="/files/zS6dWhgkwKkyvb9Zf46B" alt=""><figcaption></figcaption></figure>

### Key Metrics at a Glance

Focused insights related to the selected policy based on the filters you chose:

* **Potential Savings** – Sum of potential savings for all open tickets under the policy.
* **Achieved Savings** – Realized savings from resolved tickets.
* **Violations Detected** – Number of tickets (violations) for this policy.
* **Unique Resources** – Distinct resources involved in these violations.

### Tickets Table

Each ticket in the table corresponds to a non-compliant resource and includes the following details:

* **Ticket ID** – Unique identifier for the violation.
* **Resource Identifier** – AWS-generated ID used to uniquely identify the impacted resource.
* **Account** – Cloud account where the violation was detected.
* **Recommendation** – Suggested remediation or optimization action.
* **Status** – Current state of the ticket (e.g., Open, In Progress, Closed).
* **Potential Savings** – Estimated savings if the recommendation is implemented.
* **Achieved Savings** – Actual savings realized if the recommendation has been applied.

<figure><img src="/files/dummimDnl9zokRdIu7fs" alt=""><figcaption></figcaption></figure>

### **Bulk Actions Available**

Each ticket row includes a checkbox. Select multiple tickets to:

{% tabs %}
{% tab title="Change Status" %}
To mark the Status as:

* **To Do**
* **In Progress**
* **Dismissed**
  {% endtab %}

{% tab title="Execute Runbook" %}

* To remediate violations directly from the interface.
  {% endtab %}
  {% endtabs %}

<figure><img src="/files/AR3jenelgjL5IojWYeir" alt="" width="305"><figcaption></figcaption></figure>

## Export Report

You can export cost reports for offline analysis or to share with stakeholders.\
The **Export** option is available at the **top left corner of every table view**.

You can choose from:

* **CSV** – Ideal for detailed data analysis and manipulation.
* **Excel** – Provides a structured spreadsheet version of the report.

A preview modal appears, showing:

* **Column Names** – The fields included in the export.
* **Identifications** – Brief explanations of what each column represents.

<figure><img src="/files/CJCaciYQkqV2NqSqsq0s" alt="" width="375"><figcaption></figcaption></figure>

Review the format and ensure it meets your requirements.

Click **Confirm Export** to download the file.

#### Sample Preview

Here is the preview of a sample exported report:

<figure><img src="/files/fGZ2NJ7N3kaST0abzAyA" alt=""><figcaption></figcaption></figure>


# S3 Optimization

## Overview

S3 Optimization gives you complete visibility into your Amazon S3 bucket costs and helps identify opportunities to reduce storage expenses. You can explore usage patterns, compare current and past costs, and evaluate storage policies across all visible buckets.

## Conditions for Bucket Visibility

A bucket will appear in the S3 Optimization dashboard only if the following conditions are met:

1. The bucket is in an **active state** (not deleted).
2. The **total cost exceeds $20** over the **last 30 days**.

Buckets that do not meet these criteria will be excluded from the analysis.

## Exploring S3 Dashboard

To access the S3 Optimization dashboard:

1. Log in to the OneLens UI.
2. In the left sidebar, navigate to **S3 Optimization**.

Here is how the main page will look:

<figure><img src="/files/qpEAEZ5kUOts8RM9TSjn" alt=""><figcaption></figcaption></figure>

### Customize View

You can tailor the dashboard view to focus on specific data:

#### View Options

You can start with pre-saved views or customize your own using filters.

<figure><img src="/files/4Zp6cTii1XcXsImSkt8A" alt="" width="355"><figcaption></figcaption></figure>

{% hint style="success" %}

## Tip&#x20;

To learn how to save a customized view, [click here](/observe-visibility-and-insights/cost-reporting/cost-atlas/saved-views#how-to-save-a-view).
{% endhint %}

#### Date Range&#x20;

* **Predefined Range:** Quickly access relevant cost data by selecting a range such as “**Last 2 Weeks**” or “**Month-to-Date**”.&#x20;
* **Custom Range**: If you need to analyze costs over a specific period, define a custom date range to focus on the exact time frame.&#x20;

<figure><img src="/files/U0WeNx4HcDSqdapp6KgA" alt="" width="375"><figcaption></figcaption></figure>

### Key Metrics

After customizing the view using filters and date range, you can view the following metrics:

* **Total S3 Buckets** – Number of buckets visible under current filters.
* **Total S3 Cost** – Aggregate cost of the visible buckets for the selected period.

### Table Representation

The table presents detailed cost and usage data for each visible bucket. The following columns are included:

| **Column Name**      | **Description**                                                 |
| -------------------- | --------------------------------------------------------------- |
| **Bucket Name**      | Name of the S3 bucket.                                          |
| **Account**          | AWS account to which the bucket belongs.                        |
| **Total Cost**       | Total cost incurred for the selected time range.                |
| **Previous Cost**    | Cost for the previous period of the same duration.              |
| **Delta**            | Change in cost compared to the previous period.                 |
| **Total Size**       | Total storage used in the bucket.                               |
| **Total Objects**    | Number of objects stored in the bucket.                         |
| **Storage Class**    | Predominant storage class in use (e.g., Standard, IA, Glacier). |
| **Storage Cost**     | Cost directly attributable to storage use.                      |
| **Lifecycle Policy** | Number of lifecycle policies associated with the bucket.        |
| **Versioning**       | Indicates whether versioning is enabled or disabled.            |

{% hint style="success" %}

#### Access Insights

Each row includes an **Insight** button. Clicking it takes you directly to the **Insights** page for deeper analysis.

To learn more about the kinds of insights available, [click here](/optimize-cost-savings-and-recommendations/s3-optimization/s3-insights).
{% endhint %}

## View Bucket Details

To view detailed information for a specific bucket, you can either:

* Click directly on the **bucket name** in the table, or
* Select **View Details** from the three horizontal dots at the end of the bucket row.

<figure><img src="/files/Vv8Nqst6xheWjUutvse0" alt="" width="80"><figcaption></figcaption></figure>

For a complete breakdown of what is available in the detailed view, see the[ Bucket Details page.](/optimize-cost-savings-and-recommendations/s3-optimization/detailed-view-of-buckets)


# Detailed View of Buckets

## Overview

Use this page to explore in-depth information about your S3 bucket—from costs and storage metrics to lifecycle configurations and open tickets. You’ll find everything you need to analyze and optimize your bucket to gain cost savings.

### Full Page View

You can refer to the following screenshot for a visual representation of the entire **View Bucket Details** page:

<figure><img src="/files/BJ4JsUzVF8xWxx9Uf1Tl" alt=""><figcaption></figcaption></figure>

**Tabs available:**

1. [**Bucket Details**](#bucket-details)
2. [**Cost History**](#cost-history)
3. [**Cost & Usage Breakdown**](#cost-and-usage-breakdown)
4. [**Insights**](#insights)
5. [**Open Tickets**](#open-tickets)

## Key Metrics

Get an at-a-glance view of your bucket’s core usage stats:

<figure><img src="/files/sDkNcbp2wGWUyZQxRUDd" alt="" width="563"><figcaption></figcaption></figure>

{% tabs %}
{% tab title="1. Last 30 Days Cost" %}
See how much this bucket has cost you over the past 30 days.
{% endtab %}

{% tab title="2. Previous Month Cost" %}
Review the total cost for the previous calendar month.
{% endtab %}

{% tab title="3. Bucket Size" %}
Check the current size of all data stored in this bucket.
{% endtab %}

{% tab title="4. Total Objects" %}
Know exactly how many objects are in your bucket.
{% endtab %}
{% endtabs %}

## Bucket Details

#### Resource Information

Understand where and how your bucket is running:

1. **Account** – View the AWS account associated with this bucket.
2. **Region** – Identify the AWS region hosting your bucket.
3. **Service** – Confirm the associated AWS service (always S3 here).
4. **Versioning Enabled** – See whether versioning is turned on.
5. **Lifecycle Policies** – Check if you’ve set any lifecycle management.
6. **Storage Classes** – Review the storage tiers used in your bucket.

<figure><img src="/files/yM28qbAf00lGUzwYa1xZ" alt="" width="563"><figcaption></figcaption></figure>

#### AWS Tags

Access the tags you’ve applied to your bucket—helpful for organizing resources and allocating costs.

<figure><img src="/files/iIntynUk2QzoPOJHvOiI" alt="" width="563"><figcaption></figcaption></figure>

#### Lifecycle Policies

Review the actual lifecycle policy applied to your bucket. You can:

* Copy the JSON file directly.
* Download the policy for your records or further analysis.

<figure><img src="/files/0cwWKMDXRlzFUvfw9Dpf" alt="" width="563"><figcaption></figcaption></figure>

## Cost History

Visualize how your bucket’s cost has changed over time.&#x20;

<figure><img src="/files/M4WnxtMM7H8hEFMQj2ht" alt="" width="563"><figcaption></figcaption></figure>

#### Chart Representation Types

You can switch between:

* Bar Graph
* Area Chart

#### Data Range

* **Custom Range**: If you need to analyze costs over a specific period, define a custom date range to focus on the exact time frame.
* **Predefined Range:** Quickly access relevant cost data by selecting a range such as “**Last 2 Weeks**” or “**Month-to-Date**”.&#x20;

#### Granularity

Choose how detailed you want the data:

* **Daily**
* **Weekly**
* **Monthly**

#### Group by Usage Type

**Toggle grouping** to break down the cost based on the usage type of the bucket.

#### Table Representation

Get a detailed cost table including:

* **Usage Type** – What kind of usage contributed to cost.
* **Usage Type Total** – The total cost for each usage type.
* **Dynamic Columns** – The table adjusts based on the granularity you select (daily, weekly, or monthly).

## [Cost & Usage Breakdown](/optimize-cost-savings-and-recommendations/s3-optimization/cost-and-usage-breakdown)

Drill down into specific cost categories to understand exactly where your money is going.&#x20;

To learn more, see the detailed documentation for the [Cost & Usage Breakdown page](/optimize-cost-savings-and-recommendations/s3-optimization/cost-and-usage-breakdown).

## [Insights](/optimize-cost-savings-and-recommendations/s3-optimization/s3-insights)

Get proactive insights into your bucket usage. To explore further, refer to the documentation for the [Insights page](/optimize-cost-savings-and-recommendations/s3-optimization/s3-insights).

## Open Tickets

See all tickets related to this bucket.


# Cost & Usage Breakdown

## Overview

The **Cost & Usage Breakdown** tab gives you full visibility into how your S3 bucket is incurring costs.

### Date Range

Use the date range selector at the top of the page to adjust the analysis period. All values update to reflect the selected time window.

<figure><img src="/files/BAK7LkT7e4wsHxSWBUo0" alt="" width="375"><figcaption></figcaption></figure>

## Breakdown by Cost Categories

The **Cost & Usage Breakdown** presents a unified table containing multiple cost components, each displaying:

* **Metric / Cost Component** – The category of the charge
* **Cost** – Total cost incurred during the selected date range
* **Value** – Corresponding usage metric (e.g., GB stored, number of requests, GB transferred)

{% hint style="success" %}

## TIP

Some rows include a View button that opens the respective metrics graphs for deeper analysis.
{% endhint %}

<figure><img src="/files/qCLTIBP19xyal61qKjsV" alt=""><figcaption></figcaption></figure>

{% hint style="danger" %}

## NOTE

**Only categories with actual cost or usage data** for the selected time range will appear in the table. **Empty or non-applicable categories** are **automatically excluded** to keep the view relevant and focused.
{% endhint %}

### Total Cost

| Component  | Description                                           |
| ---------- | ----------------------------------------------------- |
| Total Cost | Aggregated total S3 bucket cost across all categories |

### Storage Costs

| Subcategory                | Description                        |
| -------------------------- | ---------------------------------- |
| Standard                   | Standard storage class             |
| Standard-IA                | Infrequent Access                  |
| One Zone-IA                | One zone infrequent access         |
| Glacier                    | Long-term archive storage          |
| Glacier Deep Archive       | Cheapest, long-term archive        |
| Glacier Flexible Retrieval | Archive with flexible access       |
| Glacier Instant Retrieval  | Instant retrieval archive          |
| Express One Zone           | Single-zone, low-latency storage   |
| Reduced Redundancy         | Legacy option for lower durability |
| Intelligent Tiering        | Auto-tiering based on access       |

<details>

<summary>Storage Metrics View</summary>

Storage Metrics show how your bucket’s storage size and object count change over time. These insights help track growth and cost trends.

| **Graph Name** | **Metrics Displayed**         | **Description**                                                                                                                    |
| -------------- | ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| Total Storage  | Cost, Storage Size (GB), Time | Displays how much storage (in GB) is used over time and its associated cost. Helps identify growth trends and cost drivers.        |
| Object Count   | Object Count, Time            | Shows the total number of stored objects over time. Useful for understanding object-level data sprawl and management implications. |

</details>

### Requests & API Calls

| Subcategory                 | Description                    |
| --------------------------- | ------------------------------ |
| PUT Requests                | Upload object operations       |
| POST Requests               | Form-based uploads             |
| LIST Requests               | List bucket contents           |
| COPY Requests               | Copy objects within buckets    |
| GET Requests                | Read/download object           |
| SELECT Requests             | Query objects with S3 Select   |
| Multipart Upload Operations | Upload large objects in parts  |
| HEAD Requests               | Fetch object metadata          |
| Messaging Delete Operations | Delete object notification ops |

<details>

<summary>Request &#x26; API Calls Metrics View</summary>

This view helps you analyze the operational load on your bucket and the associated costs of API requests, segmented by request type.

#### Write & List Operations

| **Graph Name**            | **Metrics Displayed**     | **Description**                                                                                         |
| ------------------------- | ------------------------- | ------------------------------------------------------------------------------------------------------- |
| List Bucket               | Request Count, Time       | Shows the number and cost of `ListBucket` operations. Useful for identifying listing-heavy usage.       |
| Put Object                | Request Count, Cost, Time | Tracks `PutObject` requests, reflecting how often new data is uploaded and its cost implications.       |
| Copy Object               | Request Count, Cost, Time | Monitors `CopyObject` actions, used when duplicating objects. Helps track internal data movement costs. |
| Upload Part               | Request Count, Cost, Time | Captures multipart upload activity. Indicates frequency and cost of large object uploads.               |
| Initiate Multipart Upload | Request Count, Cost, Time | Shows how often multipart uploads are started. Helps detect incomplete uploads or cost spikes.          |
| Complete Multipart Upload | Request Count, Cost, Time | Tracks completions of multipart uploads. Used to assess efficiency and completion rate.                 |

#### Read Operations

| **Graph Name**      | **Metrics Displayed**     | **Description**                                                                                       |
| ------------------- | ------------------------- | ----------------------------------------------------------------------------------------------------- |
| Head Object         | Request Count, Time       | Displays metadata fetches (`HeadObject`). Indicates automated or monitoring access to stored objects. |
| Get Object          | Request Count, Cost, Time | Tracks object retrievals, critical for understanding download behavior and its financial impact.      |
| Read Object Tagging | Request Count, Time       | Shows tagging data fetches. Highlights costs tied to metadata access and governance practices.        |

</details>

### Data Transfer Costs

| Subcategory                     | Description                      |
| ------------------------------- | -------------------------------- |
| Intra-Region Data Transfer Out  | Transfers within the same region |
| Inter-Region Data Transfer Out  | Transfers across AWS regions     |
| Data Transfer Out via Internet  | Public internet transfers        |
| Data Transfer Out to CloudFront | Edge-optimized transfers         |

<details>

<summary>Data Transfer Metrics View</summary>

This view provides visibility into data movement trends, helping you assess cost implications and optimize your data transfer strategies.

| **Graph Name**                     | **Displays**                            | **Description**                                                                                                                                                                     |
| ---------------------------------- | --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Bucket to Internet Transfer**    | Transfer Cost, Transfer Size (GB), Time | Tracks the volume of data transferred from your S3 bucket to the internet, alongside its associated cost over time. Useful for identifying spikes in public access or data sharing. |
| **Cross-Region Outbound Transfer** | Transfer Size (GB), Time                | Visualizes the amount of data moved from your bucket to other AWS regions over time. Helps monitor inter-region sync activity.                                                      |

***

</details>

### Lifecycle Costs

| Subcategory         | Description                         |
| ------------------- | ----------------------------------- |
| Transitions         | Automatic storage class changes     |
| Early Deletion Fees | Charges for premature deletions     |
| Restore Requests    | Costs to restore from archive tiers |

### Replication Costs

| Subcategory               | Description                          |
| ------------------------- | ------------------------------------ |
| Replication Request Costs | Charges for cross-region replication |

### Intelligent Tiering Costs

| Subcategory                 | Description                 |
| --------------------------- | --------------------------- |
| Frequent Access Tier        | Regularly accessed objects  |
| Infrequent Access Tier      | Objects accessed less often |
| Archive Access Tier         | Long-term archival tier     |
| Deep Archive Access Tier    | Coldest storage tier        |
| Archive Instant Access Tier | Fast access to archive data |
| Monitoring & Automation     | Cost of tiering decisions   |

### Data Retrieval & Restore Costs

| Subcategory                  | Description                   |
| ---------------------------- | ----------------------------- |
| Data Retrieval               | Retrieval from archive tiers  |
| Data Restore                 | Restore request charges       |
| Bulk Retrieval Requests      | High-volume archive retrieval |
| Expedited Retrieval Requests | Faster access at higher cost  |

### Other Costs

| Component   | Description                    |
| ----------- | ------------------------------ |
| Other Costs | Any cost not categorized above |

Use this breakdown to understand your S3 costs in detail. For actionable recommendations, check the [**Insights**](/optimize-cost-savings-and-recommendations/s3-optimization/s3-insights) page next.


# S3 Insights

The **Insights** page identifies cost-saving opportunities for your S3 bucket. Insights are generated dynamically based on your bucket’s current setup and usage patterns. Only relevant insights are shown — so what you see is tailored to your buckets configuration.

### What You’ll See for Each Insight

Each insight provides:

* **Description**\
  A **concise summary** of the configuration issue and the opportunity detected.
* **Analysis**\
  A **data-backed explanation** of why the issue exists and how it affects cost.
* **Recommendation**\
  A **suggested action** to optimize your bucket configuration and reduce costs.
* **Benefits** *(optional)*\
  Some insights include a **Benefits** section outlining the potential impact of following the recommendation — **such as estimated savings**.
* **Create Ticket**\
  If you want to take action, click **Create Ticket** to open a ticket creation form with several fields already prefilled for your convenience.

  Further, Learn more about creating a ticket.

<figure><img src="/files/OJOvgR5yzg8n1Mbi2g7Y" alt=""><figcaption></figcaption></figure>

### Types of Insights You May Encounter

OneLens analyzes several best practices and inefficiencies. Depending on your configuration, you may see insights such as:

* **Inefficient Lifecycle Policies Driving Up Transition Costs**
* **Excessive Primary Storage Expenses**
* **Excessive Data Retrieval Expenses**
* **Surging Write Activity Charges**
* **Unrestricted Versioning: No Expiry Configured**
* **Surging Outbound Data Transfer Costs**
* **Consider Expiry on Incomplete Multipart Uploads**
* **Tier Down Non-Current Versions to Reduce Storage Expenses**
* **Reactivate the Inactive Lifecycle Policy to Reduce Costs**
* **The Charges for List Requests Are Steep**

Insights are refreshed daily based on the most recent data from your bucket. You can act on any recommendation immediately using the **Create Ticket** option provided on each insight card.


# AI Cost Optimization

> Reduce AI costs without compromising application quality or user experience.

AI Cost Optimization continuously analyzes your AI workloads and identifies opportunities to reduce spend across models, tokens, caching, infrastructure, and usage patterns. Instead of generic recommendations, OneLens provides actionable insights with estimated savings and clear remediation guidance.

***

### Why AI Cost Optimization?

AI costs grow quickly as applications scale.

Common reasons include:

* Using larger models than necessary
* Inefficient prompts
* Poor cache utilization
* Excessive output tokens
* Idle provisioned throughput
* Batch-eligible workloads running synchronously
* Outdated model versions
* Over-provisioned infrastructure

OneLens helps teams identify these opportunities early and optimize AI spend continuously.

***

### Optimization Categories

Recommendations are grouped into logical categories, making it easier to prioritize improvements.

* Token Optimization
* Model Optimization
* Infrastructure Optimization
* Workload Optimization

<figure><img src="/files/Hc89aPR90WPwAVauDaDc" alt=""><figcaption></figcaption></figure>

***

## Token Optimization

Reduce costs by improving how tokens are consumed.

Recommendations include:

#### Prompt Cache Optimization

Identify workloads with low cache hit rates and opportunities to improve prompt reuse.

***

#### Output Token Optimization

Detect applications generating unnecessarily long responses that increase costs.

Identify:

* Verbose prompts
* Excessive completion lengths
* High output-to-input ratios

***

#### Batch API Opportunities

Find workloads suitable for asynchronous batch processing to take advantage of lower pricing where supported.

Ideal for:

* Document processing
* Report generation
* Background workflows
* Bulk inference jobs

***

## Model Optimization

Ensure every workload uses the most cost-effective model.

#### Model Right-Sizing

Identify workloads where a smaller or less expensive model can deliver similar results.

Examples:

* GPT-4 → GPT-4o Mini
* Claude Opus → Claude Sonnet
* Large embedding model → Smaller embedding model

***

#### Model Version Management

Detect deprecated or older model versions still running in production.

Stay updated with supported models while improving cost efficiency.

***

#### Provisioned vs On-Demand Usage

Analyze traffic patterns to determine whether workloads would benefit from:

* On-Demand
* Flex
* Provisioned Throughput

This helps optimize both cost and performance.

***

## Infrastructure Optimization

Optimize the infrastructure supporting AI workloads.

#### Idle Fine-Tuned Models

Identify fine-tuned models with little or no inference traffic.

Remove unused resources and reduce operational costs.

***

#### Endpoint Right-Sizing

Analyze throughput and request volume to recommend appropriately sized inference endpoints.

***

#### Reserved Capacity Utilization

Detect underutilized reserved or provisioned capacity and identify opportunities to improve utilization.

***

## Workload Optimization

Recommendations tailored to different AI workloads.

#### Conversational AI

Improve:

* Cache utilization
* Model selection
* Output length
* Session efficiency

***

#### Agentic Workflows

Optimize:

* Recursive agent loops
* Multi-step execution
* Model routing
* Token consumption per workflow

***

#### RAG Applications

Identify opportunities to improve:

* Embedding model selection
* Chunk sizing
* Context length
* Retrieval efficiency

***

#### Coding Assistants

Optimize:

* Model selection
* Batch execution
* Prompt reuse
* Cache effectiveness

***

#### Document Processing

Identify batch-friendly workloads and reduce costs through asynchronous processing and optimized model selection.

***

### Estimated Savings

Every recommendation includes an estimate of its potential impact.

View:

* Monthly savings
* Annual savings
* Percentage reduction
* Recommendation priority
* Expected effort

This helps teams focus on changes that deliver the highest return.

***

### Prioritize Recommendations

Recommendations can be filtered by:

* Estimated savings
* Provider
* Team
* Project
* Environment
* Category
* Priority

This makes it easier to plan optimization initiatives across multiple teams.

***

### Track Optimization Progress

Monitor the status of every recommendation throughout its lifecycle.

Typical statuses include:

* Open
* Planned
* In Progress
* Completed
* Ignored

This provides visibility into realized savings and ongoing optimization efforts.

> 📸 **Screenshot:** Recommendation details

***

### Example Use Cases

#### Engineering

Reduce AI costs by selecting the right models, optimizing prompts, and improving cache efficiency.

#### Platform Teams

Optimize provisioned throughput, inference endpoints, and infrastructure utilization.

#### Product Teams

Deliver AI features at lower operating costs without affecting user experience.

#### Finance & FinOps

Track realized savings and measure the financial impact of optimization initiatives.

***

### Benefits

* Reduce AI spend without sacrificing quality.
* Identify optimization opportunities automatically.
* Prioritize recommendations based on business impact.
* Improve model and infrastructure efficiency.
* Continuously monitor AI cost optimization opportunities.

***

### Best Practices

* Review optimization recommendations regularly instead of waiting for monthly invoices.
* Prioritize high-impact recommendations with minimal implementation effort.
* Validate model right-sizing before rolling changes to production.
* Combine optimization insights with anomaly detection and budgets for proactive cost management.
* Track completed recommendations to measure realized savings over time.


# Kubernetes Optimization


# Insights




---

[Next Page](/llms-full.txt/1)