
# AWS

In Amazon Web Services (AWS), an IAM User is used by applications, scripts, or services to access AWS resources. This document will run through creating an IAM User with access keys. The access keys are used for programmatic access to AWS services.

IAM Users provide a secure and manageable way for your applications to access AWS resources. Instead of using your root AWS account, you can create a specific identity for your application, reducing security risks and improving accountability.

As the creator of the IAM User, you and your organization retain full control over access to your environment; if access needs to be removed, you have the ability to remove access by the IAM User.

## Sign in to the AWS Management Console

Sign in to the [AWS Management Console](https://aws.amazon.com/) using your AWS account and locate the Identity and Access Management (IAM) service where identity and authentication are managed in AWS.

### Create a new IAM User

In the IAM dashboard, select "Users" from the left-hand menu and click the "Add user" button. Enter the following details:

- **User name**: how it will be identified in AWS. Feel free to choose something meaningful for this purpose that conforms with others.
- **Access type**: Select "Programmatic access" to generate access keys for your IAM User.

Once ready, click "Next: Permissions" to proceed.

### Attach policies

On the permissions page, select the policies that define what actions the IAM User can perform. At a minimum, you might want to attach the "AmazonEC2ReadOnlyAccess" policy to view EC2 resources.

Once policies are attached, click "Next: Tags" to proceed.

### Add tags (optional)

You can add tags to your IAM User for easier identification. Once tags are added, click "Next: Review" to proceed.

### Review and create

Review the details of the IAM User you are creating and click "Create user" to finish. Take note of the `Access key ID` and `Secret access key` displayed; you will need these later.

## Grant IAM User permissions

To allow your IAM User to see cost details of your resources, you will need to grant it the appropriate level of access.

### Sign in to the AWS Management Console

Sign in to the [AWS Management Console](https://aws.amazon.com/) using your AWS account and locate the AWS Identity and Access Management (IAM) service where permissions are managed in AWS.

### Add IAM policy

In the IAM dashboard, select "Policies" from the left-hand menu and click the "Create policy" button. Enter the following details:

- **Service**: Select "All services" to include all AWS services.
- **Actions**: Search for and include actions that allow viewing cost details.
- **Resources**: Specify the resources to which this policy applies.

Once the policy is created, you can attach it to your IAM User.

### Attach policy to IAM User

Go back to the IAM dashboard, select "Users" from the left-hand menu, and click on your IAM User. In the "Permissions" tab, click "Attach policies" and select the policy you created.

You have now configured your AWS environment to allow monitoring using cloudcondense.

Simple steps to enable your AWS cloud environment

Basic configuration (AWS)


# Azure

In Azure, a Service Principal is like a user identity with a specific role and permissions, but it's used by applications, scripts, or services to access Azure resources. This document will run through creating a Service Principal with a secret. The secret is a password or key that your application will use to authenticate itself when accessing Azure services.

Service Principals provide a secure and manageable way for your applications to access Azure resources. Instead of using your personal Azure account, you can create a specific identity for your application, reducing security risks and improving accountability. 

As the creator of the service principal, you and your organisation retain full control over access to your environment; if access needs to be removed, you have the ability to remove access by the service principal.

## Sign in to the Azure Portal

Sign in to the [Azure portal](https://portal.azure.com) using your Azure account and locate the Azure Active Directory (Azure AD) service where identity and authentication is managed in Azure.

### Create a new Application registration

In Azure Active Directory, select "App registrations" from the left-hand menu and click the "+ New registration" button. Enter the following details:

- **Application name**: how it will be identified in Azure AD. Feel free to choose something meaningful for this purpose that conforms with other 
- **Supported account type**: which accounts will be able to use this Service Principal. Generally, "Accounts in this organizational directory only" is a safe choice.

Once ready, click "Register" to create the application.

On the application's overview page, take note of and record the `Application (client) ID` to provide later.

### Generate a Client secret

A secret should be created to complete the credential set used to authenticate as that service principal. Navigate to "Manage" in the menu and select "Certificates & secrets". Under the "Client secrets" section, click on "+ New client secret" and provide the following details:

- **Description**: information relating to the usage of the secret. It is recommended that some wording around its use by this service be included
- **Expiration duration**: for what period the secret is valid; one year is commonly used however it is important to consider your internal security requirements. Also note that this informs when you will need to replace this secret.

Once submitted, the client secret will be displayed; copy and save it securely. A good option is to use Azure Key vault. You won't be able to see it again.

### Submit service principal details

Under development. In the meantime, consult your agency partner on how best to provide these details.

## Grant service principal permissions

To allow your service principal to see cost details of your resources, you will need to grant it the appropriate level of access. This can be done at the Management group or Subscription levels, depending on your access. For the purposes of this guide, the granting the service principal access to the subscription will be specifically covered, but the process would be similar for the Management group. 

### Sign in to the Azure Portal

Sign in to the [Azure portal](https://portal.azure.com) using your Azure account and locate the Subscriptions service where subscriptions are managed in Azure.

### Add role access to resources

In Subscriptions, click on the name of the Subscription name that you want to enrol. Select Access control (IAM) in the left hand menu, then click Add to Add a role assignment.

Two roles need to be added for the service principal for each Subscription, to allow for sufficient access:

| Role | Description |
|-|-|
| Reader | To allow the service principal to see the resource and basic metadata about it such as tags |
| Cost Management Reader | To allow the service principal to access the cost APIs in Azure |

To add each, click to highlight the role name when prompted to Add role assignment, then click Next. With Assign access to set to User, group, or service principal, click "+ Select members" to bring up the Select members side panel. Search for the name of the service principal you created above, and once found select it. Then click Next.

You will be presented with a Review screen with the information you have just provided. Confirm that it is correct, then click "Review + assign" to set the permission. Repeat for all roles you may need to add to this Subscription, and across all Subscriptions that need to be enrolled


Simple steps to enable your Azure cloud environment

Basic configuration (Azure)


# Google Cloud Platform

In Google Cloud Platform (GCP), a Service Account is used by applications, scripts, or services to access GCP resources. This document will run through creating a Service Account with a key file. The key file is a JSON file containing a private key that your application will use to authenticate itself when accessing GCP services.

Service Accounts provide a secure and manageable way for your applications to access GCP resources. Instead of using your personal GCP account, you can create a specific identity for your application, reducing security risks and improving accountability.

As the creator of the service account, you and your organization retain full control over access to your environment; if access needs to be removed, you have the ability to remove access by the service account.

## Sign in to the Google Cloud Console

Sign in to the [Google Cloud Console](https://console.cloud.google.com/) using your GCP account and locate the Identity and Access Management (IAM) service where identity and authentication are managed in GCP.

### Create a new Service Account

In the IAM & Admin section, select "Service accounts" from the left-hand menu and click the "+ CREATE SERVICE ACCOUNT" button. Enter the following details:

- **Service account name**: how it will be identified in GCP. Feel free to choose something meaningful for this purpose that conforms with other
- **Service account ID**: a unique ID for the service account
- **Role**: which roles will be assigned to this Service Account. Generally, "Project" > "Editor" is a common choice.

Once ready, click "Create" to create the service account.

On the service account's details page, take note of and download the key file containing the private key. This key file will be used later.

### Grant service account permissions

To allow your service account to see cost details of your resources, you will need to grant it the appropriate level of access. This can be done at the project level.

### Sign in to the Google Cloud Console

Sign in to the [Google Cloud Console](https://console.cloud.google.com/) using your GCP account and locate the IAM & Admin service where permissions are managed in GCP.

### Add IAM policy binding

In IAM & Admin, click on the name of the project that you want to enroll. Select IAM in the left-hand menu, then click "ADD" to add a new IAM policy binding.

Two roles need to be added for the service account, to allow for sufficient access:

| Role | Description |
|-|-|
| roles/viewer | To allow the service account to see the resource and basic metadata about it such as tags |
| roles/billing.viewer | To allow the service account to access the billing APIs in GCP |

To add each, click to highlight the role name when prompted to "Select a role," then click Next. With "Members" set to "Service account," enter the email address of the service account you created above, and once found select it. Then click "Save."

You will be presented with a summary screen with the information you have just provided. Confirm that it is correct, then click "ADD ANOTHER ROLE" to set the next permission. Repeat for all roles you may need to add to this project.

Simple steps to enable your Google Cloud environment

Basic configuration (GCP)


# What Is Cloud FinOps?

Cloud FinOps (short for Cloud Financial Operations) is a way for businesses to intelligently manage cloud spending. It helps teams across finance, technology, and operations work together to make sure the company is getting the most value out of what it spends in the cloud.

In simple terms, Cloud FinOps is like having a shared budget system for your cloud costs, where everyone from engineers to finance knows what they’re spending, why, and how to improve it.


# Why FinOps Matters

The cloud is flexible and fast, which is great—but it’s also easy to overspend if no one is watching. With FinOps, you can:

 Control and reduce cloud costs
 Improve forecasting and budgeting
 Make faster, smarter business decisions
 Hold teams accountable for their usage
 Align technology spending with business goals

Instead of just reacting to surprise bills, FinOps gives you real-time visibility and control.

# Key Benefits

| Benefit                 | What It Means for Your Business                                            |
| ----------------------- | -------------------------------------------------------------------------- |
| Cost Visibility     | Know exactly where your cloud money is going—by team, product, or project. |
| Team Accountability | Each team is responsible for their cloud usage and costs.                  |
| Optimised Spending  | Eliminate waste and save money without sacrificing performance.            |
| Faster Decisions    | Make quick, data-driven decisions about cloud investments.                 |
| Better Forecasting  | Plan ahead with more accurate cloud cost estimates.                        |


# How FinOps Works

FinOps is an ongoing process with three main phases:

## Inform

> See what you’re spending and where.

- Understand your cloud costs in detail.
- Break down spending by product, department, or environment.
- Share reports with the right stakeholders.

## Optimise

> Identify ways to spend more efficiently.

- Find unused or underused resources.
- Adjust to better pricing options (e.g., long-term commitments).
- Set budgets and limits to stay in control.

## Operate

> Make cost management part of everyday business.

- Build a culture of cost awareness.
- Encourage teams to monitor their own spending.
- Track results and keep improving over time.


# Who's Involved?

Cloud FinOps is not just for IT; it’s a team effort.

| Role                         | Responsibility                                    |
| ---------------------------- | ------------------------------------------------- |
| Finance                  | Sets budgets, tracks ROI, ensures accountability. |
| Engineering / IT         | Builds cost-efficient systems, monitors usage.    |
| Product Managers         | Understand cost impact of product features.       |
| Executives               | Oversee cloud strategy and financial goals.       |
| FinOps Team (if present) | Leads FinOps practices, tools, and reporting.     |


## Real-World Examples

- A retail company reduced its cloud bill by 30% by turning off unused resources during non-peak hours.
- A startup avoided over-budgeting by tracking cost per customer and adjusting cloud usage based on growth.
- A global enterprise used FinOps to allocate cloud spending to 50+ business units, improving financial transparency.



# Best Practices

## Ask for regular cost reports

Review them just like you would a departmental budget.

## Encourage teams to tag their resources

This helps track and assign cloud costs accurately.

## Align cloud spending with business KPIs

Look at costs in relation to revenue, usage, or customer growth.

## Set clear budgets and monitor against them

Use alerts to stay ahead of potential overruns.

## Foster collaboration

Invite finance and tech to the same table when discussing new projects.


## Challenges You Might Face

| Challenge                  | What It Means                                       |
| -------------------------- | --------------------------------------------------- |
| Unclear cloud bills    | Hard to know who spent what without good reporting. |
| Lack of accountability | Teams may not feel responsible for cloud usage.     |
| Too much data          | Reports can be overwhelming or too technical.       |
| Resistance to change   | New processes take time to adopt.                   |

FinOps addresses these by creating structure, shared responsibility, and easy-to-use tools.


# Final Thoughts

FinOps helps organisations use the cloud strategically—not just technically. With better visibility, shared responsibility, and continuous optimisation, FinOps ensures that every dollar spent in the cloud supports business growth and success.

> 💬 "If you’re spending money in the cloud, FinOps is not optional—it’s essential."


Learn about why Cloud FinOps matters and what it means for your business

Frequently asked questions