Cloud cost

What you see

Open Cost in the top navigation. Before any cloud account is connected the right-sizing table estimates each server’s price from its vCPU and RAM. Once billing is connected you get:

• •Actual cost per server, ranked and heat-shaded, projected to a month from the last 14 days, with a callout such as "the top 2 servers (20% of the fleet) account for 71% of attributed spend".
• •A collapsible other resources bucket per provider for what cannot be tied to a server: volumes, snapshots, IPs, load balancers.
• •The right-sizing table’s cost column tagged actual when a billing match exists and estimate otherwise; the two are never mixed in one number.
• •Commitment savings for AWS: Savings Plan (Compute, 1-year, no upfront) and EC2 Reserved Instance recommendations from AWS’s own engine over the last 30 days, with the estimated monthly saving. Opservo never buys anything; you purchase in the AWS console.
• •A Monthly cost digest switch.

Connect AWS

Click Connect AWS, paste an access key ID, secret and region for an IAM user that has only the read-only policy shown on the card. The policy allows four Cost Explorer actions and nothing else:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "OpservoCostReadOnly",
    "Effect": "Allow",
    "Action": [
      "ce:GetCostAndUsage",
      "ce:GetCostAndUsageWithResources",
      "ce:GetSavingsPlansPurchaseRecommendation",
      "ce:GetReservationPurchaseRecommendation"
    ],
    "Resource": "*"
  }]
}

Workspace-wide monthly spend by service works straight away. Per-server figures need resource-level data, which AWS keeps for the last 14 days and only if you enable it: AWS Console → Billing and Cost Management → Cost Management Preferences → Cost Explorer → tick Hourly and Resource Level Data, on the payer (management) account. Data appears about 24 hours later. If it is not enabled, the Cost page tells you exactly that instead of showing an error. AWS charges roughly $0.01 per Cost Explorer API request.

A missing permission for the savings recommendations is reported per call with the action to add, so a policy trimmed by hand still shows what it can.

Connect Azure

Click Connect Azure and enter the Directory (tenant) ID, Application (client) ID, Client secret and Subscription ID of a service principal. The principal needs the Cost Management Reader role on the subscription. Opservo queries actual daily cost grouped by resource and service.

Connect Google Cloud

Google has no per-resource cost API, so Opservo reads your BigQuery billing export (Billing → Billing export → enable the detailed usage cost export). Click Connect Google Cloud, paste the billing export table id in the form my-project.billing_export.gcp_billing_export_resource_v1_… and the service account JSON key. The service account needs BigQuery Job User on the project and BigQuery Data Viewer on the export dataset. One parameterised query per refresh reads cost by resource and service with credits applied.

How a bill line finds its server

The agent reports the id the cloud bills under: the EC2 instance id, the Azure VM resource id, or the GCE instance name. Billing rows with that id attach to the server; rows for anything else go to other resources. On AWS, agents installed before this feature still match by their machine id, which is the instance id on EC2. A server enrolled after history has accumulated picks up its earlier rows on the next refresh.

Refresh cadence

Cost data is pulled once a day for every connected account. Refresh now on the Cost page pulls immediately. Right after connecting, the page says so until the first pull lands; click Refresh now to pull the first 14 days without waiting. Every refresh also records whether it succeeded and why not, so the page can say "no data because…" rather than stay blank.

Monthly digest

Turn on Monthly cost digest and on the 1st of each month (UTC) your notification channels receive a plain-text summary: last month’s total with the month-over-month change, the top 5 servers with their prior figure, the biggest mover, the other-resources bucket, and any commitment savings on the table. Send me this month’s digest now sends the month-to-date version immediately. See alerts and channels for where it is delivered.

Who can do what

Cost intelligence is part of the Growth plan and above. Connecting, disconnecting and refreshing a cloud account, and changing the digest, need the owner or admin role, and connect and disconnect are written to the audit log. Credentials are stored encrypted for the whole workspace and are never shown again in full. Any role can read the Cost page.