The CloudZero User Hub

Welcome to the CloudZero user hub. You'll find comprehensive guides and documentation to help you start working with CloudZero as quickly as possible, as well as support if you get stuck. Let's jump right in!

Get Started    

Account Connection

All about letting CloudZero access your cloud provider data

Currently, CloudZero supports connecting AWS and Snowflake accounts.

AWS

👍

Cut the chase, just show me the policy!

Don't have time to read the docs? No problem! Here are the policy templates our role will use for either a payer and resource account connection

CloudZero Permissions

Connecting an AWS account allows CloudZero to read data from that account into our application. CloudZero accesses your AWS accounts using a delegated access role from our AWS account (#061190967865) to yours with permissions designed to limit our read-only access to only those parts of the system we require for operation.

📘

About CloudZero's Access to your AWS Accounts

CloudZero is a different type of Cloud Cost Management solution and requires permissions beyond the typical cost and usage data. By using metadata on how your AWS environment is operating, the services that you are using, and how they are being used CloudZero can boost tag coverage, identify more complex anomalies and highlight the specific resources and changes that are responsible for cost changes in your environment.

All of CloudZero's permissions are Read-Only
We have no access to data except where explicitly authorized (for example the S3 bucket where your cost and usage report is stored)

Summary of Permissions:

  • Master Payer Account

    • Our access is required to function
    • Access to the Cost and Usage, Billing and Organizations API
    • Access to the Cost and Usage S3 bucket where reports are stored
    • Access to CloudWatch Metrics, and list/read-only metadata service API's
  • Resource (child) Accounts

    • Our access is optional, required for waste and root cause analysis
    • Access to CloudWatch Metrics, and list/read-only metadata service API's

We use CloudFormation to automate the provisioning process and our CloudFormation templates and IAM policies are completely open source and available for review at https://github.com/Cloudzero/provision-account

We also require the following AWS services to be configured before configuring CloudZero:
AWS Organizations with consolidated billing enabled
AWS Cost and Usage Report enabled within your AWS Payer account (sometimes also called your AWS Master account

🚧

A note on what accounts to connect first

For most features to work you'll need to connect your AWS account that holds your Master Payer Account so that we can get access to your billing data. It is strongly suggested that you connect your Master Billing Account first.

📘

Multiple Master Billing Accounts

CloudZero fully supports organizations with multiple Master Payer Accounts, just connect them all to get a consolidated view of your spending.

To connect an account follow these steps:

1.Open the Account Connections page

The Account Connections page can be found by going to the "gear" on the sidebar and selecting "Account Connections" or alternatively going to https://app.cloudzero.com/organization/onboard-accounts

2. Connect your account

On the Account Connections page you can see currently connected Cloud Accounts. To connect new AWS accounts, select “Connect Cloud Accounts” then select “AWS” as the Cloud Provider. You have three options for connecting accounts.

  1. Deploy from the AWS Console via the CloudZero CloudFormation template
  2. Deploy the CloudZero CloudFormation template via the CLI (useful for scripting large number of organizations.)
  3. Manually connect an account yourself.

The first method is the easiest, and is outlined below.

3. Connecting via the AWS Console

Type an account name, this name will be the name for this account that appears in the CloudZero console going forward.

📘

Note on account naming

The name must conform to AWS naming conventions (lowercase, dashes, without spaces or periods)

4. Redirect to AWS

Click "Connect Automatically" to launch the AWS console.

📘

Please ensure that you are logged into the correct AWS account

You an open a new tab and log into the AWS console if necessary.

5. Create stack

Scroll to the bottom of the page, check the two boxes in the "Capabilities" section, and then hit "Create Stack"

6. Confirm

AWS generally takes ~5 minutes to deploy the necessary permissions to allow CloudZero to ingest the information it needs.

Once complete you'll see your AWS account listed on the CloudZero Cloud Accounts page.

The status column will be green or red and show the overall connection status. The links column shows what CloudZero found in the account. The possible values are:

a. Resource Owner – AWS API access is enabled for this account. All connected accounts will be resource owners.
b. Payer – The master organization billing account with Cost & Usage reporting enabled
c. CloudTrail Owner – CloudTrail configuration enabled but the destination S3 bucket is located elsewhere (audit account)
d. Audit – Both an enabled CloudTrail configuration and its destination S3 bucket are located in this account

You can connect any other accounts you want at this point with the same process

Snowflake

Connect CloudZero to your Snowflake accounts to include Snowflake cost data alongside other Cloud cost information in the Explorer and to receive anomaly alerts on Snowflake spend. Connecting a Snowflake account allows CloudZero to read data from that account into our application. CloudZero accesses your Snowflake data via a share from your account to our Snowflake account using Secure Data Sharing.

📘

About CloudZero's Access to your Snowflake Accounts

All of CloudZero's permissions are Read-Only
We have no access to data except where explicitly authorized (for example, the data you explicitly share with CloudZero). The SQL script we offer through the application does require write permissions, just to create the read-only resources for you.

Summary of Permissions:

  • Roles
    • CLOUDZERO_COPY_BILLING_DATA_ROLE: role that can read data and execute sync procedure
  • Databases
    • CLOUDZERO_SHARED_DATA: database that sits between your billing views and the share with CloudZero
  • Procedures
    • CLOUDZERO_COPY_BILLING_DATA: stored procedure to sync data periodically from the billing tables/views
  • Tables/Views
    • METERING_HISTORY
    • METERING_DAILY_HISTORY
    • DATABASE_STORAGE_USAGE_HISTORY
    • STAGE_STORAGE_USAGE_HISTORY
  • Shares
    • CLOUDZERO_SHARE: shares data from CLOUDZERO_SHARED_DATA database with CloudZero Snowflake account

1. Open the Account Connections Page

The Account Connections page can be found by going to the "gear" on the sidebar and selecting "Account Connections" or alternatively going to https://app.cloudzero.com/organization/onboard-accounts

2. Connect Your Account

On the Account Connections page you can see currently connected Cloud accounts. To connect new Snowflake accounts, select “Connect Cloud Accounts” then select “Snowflake” as the Cloud Provider. You will need to fill in your Snowflake Account Information into the form:

  • Snowflake Account ID: the value returned from running SELECT LOWER(CURRENT_ACCOUNT()) in your Snowflake account.
  • Name: user-friendly name for your account in CloudZero
  • Snowflake Account Region: the value returned from running SELECT LOWER(CURRENT_REGION()), for now only ’aws_us_east_1’.
  • Cost Per Credit: Your Snowflake account’s Capacity Credit Price on the bill.
  • Cost Per TB Month: Your Snowflake account’s Capacity Storage Price on the bill.
  • Effective Cost Date: The date on which the “Cost Per” values became effective.

Click Save

3. Create Share in your Snowflake Account

After clicking save in the previous step, a SQL script will appear in a text box.

  • Copy the SQL script.
  • Paste it into a Snowflake worksheet in your account.
  • Review the Script
  • Select the All Queries Checkbox
  • Click Run to create and share the necessary data with CloudZero

🚧

Go get a coffee!

This script can take a while to run if you haven’t used these billing tables before. Our experience shows that first use can take 3+ hours; however, subsequent uses usually take minutes.

4. Return to the Account Connections Page

Refresh the table to see the status of your Snowflake account. Once we discover the share created in (3), the status will update from “Establishing Connection” to “Account Connected Successfully”. You can hover over the "Data Share" pill in the Links column, which will show information about Snowflake data share. Discovery can take up to an hour. It can take up to a day to synchronize new accounts before you see cost data in the Explorer.

Updated 25 days ago


Account Connection


All about letting CloudZero access your cloud provider data

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.