Permissions by provider
Each provider you connect gives CloudYali one credential. This page lists what that credential is and where it needs access; each provider's page lists every role, policy or endpoint in full.
| Provider | What you give CloudYali | Where it needs access | Full list |
|---|---|---|---|
| AWS | An IAM role, created by CloudYali's CloudFormation stack. CloudYali assumes it with an external ID | Each account you connect. For an AWS Organization, the management account, then each member account through a StackSet | AWS permissions |
| Google Cloud | A service account key | BigQuery Data Viewer and BigQuery Job User for the billing export; Cloud Asset Viewer for resources; Browser on the organization to find its projects | Google Cloud permissions |
| Azure | A service principal with a client secret | Storage Blob Data Reader on the export's storage account; Reader on each subscription | Azure permissions |
| Anthropic | An Admin API key | The Anthropic organization | Anthropic permissions |
| OpenAI | An admin key (sk-admin-…) | The OpenAI organization | Connect OpenAI |
| Cursor | A team Admin API key with the admin:* scope | The Cursor team | Connect Cursor |
| Fastly | An API token with Global:Read scope, from a user with the Billing role | The Fastly account's invoices | Connect Fastly |
Anthropic, OpenAI and Cursor admin keys can manage the organization or team as well as read it. CloudYali calls only their read endpoints; each provider's page lists them.
Optional access
| Provider | Role | Without it |
|---|---|---|
| Google Cloud | Monitoring Viewer | CloudYali's own rightsizing rules are skipped |
| Azure | Monitoring Reader | CloudYali's own rightsizing rules are skipped |
Not connected from the console
Databricks and Microsoft Teams cannot be connected from the Integrations page yet. To connect either, contact support@cloudyali.io.
Related
Was this page helpful?