Connect a Provider#

Connecting a cloud provider is the single most important setup action — it unlocks Discovery, FinOps, Provisioning, Automation, and Monitoring across all three providers.

Reply CMP connects via read-only API calls using a dedicated service principal (Azure), IAM user (AWS), or service account (GCP). No changes are made to your existing infrastructure.

Note

Read-only vs read-write — Discovery and cost ingestion require read access to provider data; GCP also requires permission to run BigQuery query jobs. Automation (start/stop VMs, enforce tags) and provisioning require the relevant write permissions. Selecting a permission level in Reply CMP does not grant permissions in the cloud provider.

Before you start#

Open Tenant → Connections → Add Connection and select your provider. You will need the credentials created in the steps below.

Provider setup#

Prerequisites

  • Permission to register an application and create its client secret in the subscription’s Microsoft Entra tenant

  • Permission to assign Azure roles at subscription scope (for example, Owner or User Access Administrator), or an administrator who can assign them for you. An Entra application administrator role alone does not grant access to Azure subscriptions.

  • Your Subscription ID; the subscription must be in the Enabled state

Choose Global for Azure public cloud or China for Azure operated by 21Vianet. For China, create the app registration and assign subscription roles in portal.azure.cn; Global credentials cannot access a China subscription.

Steps

  1. Select the subscription’s directory, then go to Microsoft Entra ID → App registrations → New registration in the portal for the selected Azure instance.

  2. Name: e.g. reply-cmp-readonly; Supported account types: This directory only; no redirect URI

  3. Record: Application (client) ID and Directory (tenant) ID

  4. Go to Certificates & secrets → Client secrets → New client secret → set expiry → copy the secret Value immediately (shown only once). Use the Value, not the Secret ID, object ID or your Azure sign-in password.

  5. Go to Subscriptions → {your subscription} → Access control (IAM) → Add role assignment

    • For read-only: assign Reader to the application’s service principal at the subscription scope, not only on one resource group.

    • For read-write (Automation): assign Contributor instead.

  6. Confirm that subscription cost visibility is enabled for the billing agreement. For Enterprise Agreement (EA) subscriptions, ask the enterprise administrator to enable Account owners can view charges (AO view charges). For CSP/Azure Plan, ask the partner to enable the customer cost-visibility policy. Assigning Reader alone does not override these billing policies. CMP retrieves subscription costs through the Cost Management API; this connection does not require a billing export. See Cost Management access and CSP customer cost visibility.

  7. Enter the values in Reply CMP, select the matching Azure instance, then select Validate and Create Connection after validation succeeds. Validation checks authentication and whether the subscription is accessible and Enabled; it does not test cost retrieval or every Monitoring query.

See Create app credentials for the Microsoft Entra procedure.

Required fields in Reply CMP

Field

Where to find it

Connection name

Your choice

Azure instance

Global (default) or China

App ID

Application (client) ID from step 3

Subscription ID

From the Subscriptions blade

Tenant ID

Directory (tenant) ID from step 3

Client Secret

Value from step 4

Permission level

ReadOnly / ReadWrite

For API clients, set Properties.Instance to exactly "Global" or "China". Omitting this field preserves Global behaviour. Existing Azure connections remain Global; choosing China routes authentication, discovery, costs, Advisor, automation and monitoring to the China endpoints.

Azure China service and API-version availability can differ from Global. The selected subscription must support the requested service; choosing China does not enable unavailable services or change provider permissions. See Azure China service availability.

If validation or cost retrieval fails, see Azure Connection Errors.

Note

Monitoring queries — The Reader role is sufficient for all Azure Monitoring queries (Metrics, Alerts Management). For Log Analytics (KQL) queries, Reader also works when the workspace uses resource-centric access mode (the default for workspaces created after March 2019). If a workspace is configured to require workspace permissions (workspace-centric mode), additionally assign the Log Analytics Reader role to the app registration on that specific workspace.

Prerequisites

  • AWS Console access with permission to create an IAM user, assign policies and create access keys

  • Your Account ID (12-digit number, visible in the top-right of the AWS Console)

  • Access to the payer/management account to configure Cost Explorer data preferences, or an administrator who can configure them for you. Administrator access to a member account alone is not sufficient.

Important

Use an IAM user access key, not SSO session credentials. Reply CMP currently accepts an Access Key ID and Secret Access Key only; it does not support a Session Token or an SSO login. Keys beginning with ASIA are temporary credentials and require a Session Token, so they cannot be used in this form. Create a dedicated IAM user key beginning with AKIA instead. These long-term keys remain valid until deactivated or deleted; rotate them according to your organization’s policy. Do not create root-user access keys.

Steps

  1. If you start in the AWS access portal (IAM Identity Center / SSO), select the account and your assigned role to open the AWS Management Console. The portal’s Access keys window provides temporary session credentials; it is not where you create the key needed by Reply CMP.

  2. In the AWS Management Console, open IAM → Users → Create user. Use a dedicated name such as reply-cmp-readonly. Console sign-in is not required for this user.

  3. Attach policies:

    • For read-only: ReadOnlyAccess + AWSResourceExplorer2FullAccess (needed for Discovery)

    • For read-write (Automation): PowerUserAccess + AWSResourceExplorer2FullAccess

  4. Open the newly created IAM user → Security credentials tab → Access keys section → Create access key. Choose Application running outside AWS, if offered, or Other, then follow the prompts and create the key.

  5. Save the Access Key ID and Secret Access Key securely. AWS shows the secret only once; if it is lost, create a replacement key. Do not share the secret in screenshots, chat or support tickets.

  6. Enable AWS Resource Explorer. In the region you will select in Reply CMP, open Views, select a view and choose Actions → Set as default if no default view is configured. See Set a default view.

  7. Enable Cost Explorer, then configure daily resource-level cost data from the payer/management account (the account that pays the organization’s AWS bill):

    • Open Billing and Cost Management → Cost Management preferences.

    • Under Daily granularity, select Resource-level data at daily granularity.

    • In AWS services at daily granularity, select the services whose resource-level costs you want to include.

    • Select Save preferences. Allow up to 48 hours for the data settings to take effect, then retry validation in Reply CMP.

    This opt-in is required by Reply CMP’s connection check, which queries daily costs grouped by resource ID. Enabling Cost Explorer alone or granting the IAM user more permissions does not enable resource-level data. If you only manage a member account, ask the payer/management account administrator to complete this step. See Configure granular data in AWS.

  8. In Reply CMP, enter the account ID as xxxx-xxxx-xxxx, select the default region, and paste the IAM user’s Access Key ID and Secret Access Key. Select Validate, then Create Connection after validation succeeds.

See the AWS instructions for creating IAM user access keys and temporary versus long-term credentials.

Required fields in Reply CMP

Field

Where to find it

Connection name

Your choice

Account ID

Your 12-digit account number, formatted as xxxx-xxxx-xxxx

Access Key ID

IAM user key from step 5, beginning with AKIA

Secret Access Key

Matching secret from step 5, not your console password

Default Region

e.g. eu-west-1; Resource Explorer must have a default view in this region

Permission level

ReadOnly / ReadWrite

If validation fails, see AWS Connection Errors.

Note

Monitoring queries — The ReadOnlyAccess policy includes all permissions needed for Monitoring query types: CloudWatch Metrics (cloudwatch:GetMetricData, cloudwatch:ListMetrics), CloudWatch Alarms (cloudwatch:DescribeAlarms), and CloudWatch Logs Insights (logs:StartQuery, logs:GetQueryResults, logs:StopQuery). No additional policies are required.

Prerequisites

  • An active GCP project with billing enabled, and permission to create a service account/key, grant the roles below and enable APIs, or administrators who can perform those setup tasks

  • Access to configure the Cloud Billing account’s Detailed usage cost export and its destination BigQuery project/dataset. Project IAM administration alone does not grant billing-account administration. See Billing export setup and administrator permissions.

Steps

  1. Go to IAM & Admin → Service Accounts → Create service account → name e.g. reply-cmp-viewer.

  2. Grant the service account access at the correct scopes:

    • On the project to discover: roles/viewer and roles/cloudasset.viewer.

    • On the billing export dataset: roles/bigquery.dataViewer.

    • On the project hosting that dataset (the Billing project ID in Reply CMP): roles/bigquery.jobUser, or an equivalent role providing bigquery.jobs.create. Reply CMP runs its validation and cost queries in this project, even when it differs from the project being discovered. Dataset read access alone does not allow query jobs. See BigQuery query permissions.

  3. In the project to discover, open APIs & Services → Library and enable all APIs checked by Reply CMP:

    API

    Service ID

    BigQuery API

    bigquery.googleapis.com

    Cloud Asset API (Cloud Asset Inventory)

    cloudasset.googleapis.com

    Cloud Resource Manager API

    cloudresourcemanager.googleapis.com

    Service Usage API

    serviceusage.googleapis.com

    Recommender API

    recommender.googleapis.com

    Compute Engine API

    compute.googleapis.com

    Kubernetes Engine API

    container.googleapis.com

    Cloud SQL Admin API

    sqladmin.googleapis.com

    The connection check currently requires all eight, even if you do not use every service. The service account must also be able to list enabled APIs (serviceusage.services.list). If a custom role omits that permission, grant a role such as roles/serviceusage.serviceUsageViewer. If the billing dataset is in another project, enable BigQuery API there too. For Monitoring, also enable Cloud Monitoring API (monitoring.googleapis.com); it is not part of the connection check.

  4. In Billing → select the Cloud Billing account → Billing export → BigQuery export, enable Detailed usage cost export and select its destination project and dataset. Wait for Google to create the export table. Use the actual full table name, normally gcp_billing_export_resource_v1_<BILLING_ACCOUNT_ID>, retaining the generated billing-account suffix. The standard gcp_billing_export_v1_... table, pricing export and FOCUS export are not substitutes: the current cost queries use the detailed export’s resource.name and resource.global_name fields. See Detailed export schema.

  5. Open the service account → Keys → Add key → Create new key → JSON → download the key file. Upload the complete service-account JSON, not an API key, OAuth client file or gcloud user login credentials. If organization policy prevents key creation, ask your administrator to resolve the supported authentication setup; this form currently requires a service-account JSON key.

  6. In Reply CMP, enter the project ID to discover (not the numeric project number), the dataset name and the complete table name as separate fields. Set Billing project ID when the dataset is in another project; otherwise leave it empty. Upload the JSON key file, select Validate, then Create Connection after validation succeeds.

Validation checks project access/state, the eight APIs, Cloud Asset Inventory access, the dataset/table and a BigQuery query. It does not verify the full billing-table schema or guarantee that recent cost rows have arrived. Initial export delivery can take several hours; historical backfill can take up to five days. See Billing export data availability.

Required fields in Reply CMP

Field

Where to find it

Connection name

Your choice

Project ID

Project to discover: string project ID, not project number

Billing dataset name

Dataset name only, e.g. billing_export, without project or table

Billing table name

Full detailed export table name, including its billing-account suffix, without project or dataset

Billing project ID

Project hosting the billing dataset; optional only when it is the same as Project ID

Service account key file

Complete service-account JSON key downloaded in step 5

Permission level

ReadOnly / ReadWrite

If validation or cost retrieval fails, see GCP Connection Errors.

Note

Monitoring queries — The roles/viewer role already includes all permissions in roles/monitoring.viewer (monitoring.timeSeries.list, monitoring.alertPolicies.list, and related read operations). No additional roles are required for Monitoring.

What happens after connecting#

Tip

After saving the connection, Reply CMP runs an initial discovery scan. This takes 1–10 minutes depending on provider and account size. Discovery classifies resources as Full or CostOnly, enriches supported types with provider-specific metadata, and builds resource relationships where available. Cost availability depends on provider billing policies, data preparation and CMP refreshes. A successful credential test does not guarantee that cost data is already available; allow for the provider-specific setup and delays above.

Secrets are stored in Azure Key Vault, encrypted with AES-256. Secret values cannot be retrieved after saving — if you need to rotate credentials, update the connection with the new value.

Validating your connection#

The connection wizard runs a live provider test before saving. Azure checks authentication and subscription access/state; AWS additionally checks Resource Explorer and resource-level cost access; GCP additionally checks enabled APIs, Cloud Asset Inventory and a BigQuery query. If validation fails, the connection is not saved. Fix the credentials, permissions or provider configuration indicated by the error and retry.

Managing connections#

After connecting, go to Tenant → Connections to see:

Column

Meaning

Last discovery

Timestamp of the most recent resource scan

Last cost refresh

Timestamp of the most recent billing data pull

Expiry chip

Red = expired; action needed

Actions

Manual Launch Discovery and Refresh Cost Data buttons

Next steps#

Explore your inventory →

Review your first costs →