How CloudYali works
CloudYali reads billing and resource data from your clouds and AI tools and refreshes it on a fixed schedule. You see the results in the console, in email reports and alerts, and through AI assistants. CloudYali calls only read operations; it does not change your workloads or settings.
What CloudYali reads
Each source connects with its own credential, which you create in that provider and can revoke there at any time.
| Source | How CloudYali connects | What it reads |
|---|---|---|
| AWS | A cross-account IAM role, created by a CloudFormation stack | Cost & Usage Report, resource configuration |
| Azure | A service principal | Cost Management exports, resources |
| Google Cloud | A service account | The BigQuery billing export, Cloud Asset Inventory |
| Anthropic | An Admin API key | Usage and cost by model and workspace |
| OpenAI | An Admin key | Usage and cost by project and model |
| Cursor | A team Admin API key | Seat fees and on-demand usage |
| Databricks | A service principal with OAuth machine-to-machine credentials | System tables: billing and usage |
| Fastly | An API token with the Global:Read scope and the Billing role | CDN cost by service and region |
The exact permissions for each source are on its Integrations page.
How data moves through CloudYali
- Collect. CloudYali pulls each source's billing data once a day: AWS first, then Google Cloud and Microsoft Azure, then the AI and data tools. Cursor data is pulled every 6 hours. Resources are collected on a schedule.
- Store. Costs, resources and their history are kept for your organization. Other customers' data is never mixed in.
- Calculate. After the day's billing data arrives, CloudYali refreshes savings opportunities, checks each service's spend against its own baseline for anomalies, and updates budgets and commitment metrics.
- Show. The console reads the stored data. Anomaly and budget alerts go out by email as the day's checks find them; anomaly alerts also go to Microsoft Teams. The daily report follows. AI assistants read the same data, with the signed-in user's permissions.
How often data refreshes
| Data | Refreshes |
|---|---|
| AWS, Azure and Google Cloud billing | Once a day |
| Anthropic, OpenAI, Databricks and Fastly billing | Once a day, after the cloud billing |
| Cursor usage and seats | Every 6 hours |
| Google Cloud resources | Once a day |
| Azure resources | Once a day |
| AWS resources | On a schedule, starting as soon as you connect |
| Savings opportunities, cost anomalies, commitment metrics | Once a day, after the billing data |
| Email reports | Daily |
Recent figures can still change. Providers keep adding and correcting charges after the usage, and each daily sync reads a window again: the whole current month for AWS and Azure, the last 15 days for Google Cloud. See Data freshness.
What CloudYali does not do
- No write access. CloudYali calls only read operations. On AWS, Azure and Google Cloud it uses read-only access: the AWS stack you create adds CloudYali's read-only role, a report bucket and a Cost & Usage Report, and AWS permissions lists every action. Anthropic, OpenAI and Cursor issue only admin keys, which can do more than read; CloudYali calls only their read endpoints.
- No prompts or responses. For AI tools, CloudYali reads usage and cost, not the content of requests.
- No wider access through AI assistants. An assistant connected through the MCP server sees only what the signed-in user can see in the console. See AI assistants.
Related
- Integrations: connect each source
- Cost Explorer: see spend by service, account or region, down to each resource
- Security at CloudYali
- Email reports
Was this page helpful?