Cloud accounts

OpsNexus reads your cloud accounts to build the resource inventory, the cost views and budgets and the list of managed Kubernetes clusters. Every connection is read-only. OpsNexus never creates, changes or deletes anything in a connected cloud account.

Cloud accounts belong to the current project. Each project connects its own accounts.

#Supported clouds

#Connect an account

You need full access to the Cloud module to connect or remove accounts. See Access control.

To connect an account:

1. Open Cloud in the sidebar, then choose the cloud (AWS, Azure, Google Cloud or Oracle Cloud), or stay on Overview.
2. Click Connect account.
3. Pick the cloud, enter an Account name (unique in the project) and choose the Sign-in method.
4. Fill in the fields for that method (see the sections below).
5. Click Connect and sync.

The account appears in the accounts table with the status Syncing all regions…. The first sync runs in the background worker and can take a few minutes for a large AWS account. The page refreshes on its own when it finishes.

Secret fields (secret keys, client secrets, private keys, external IDs) are stored in the OpsNexus secret store, not in the database. See Secrets and variables.

#AWS

#Sign-in methods

• access key signs in with an IAM user's access key.
• instance role uses the default AWS credential chain of the OpsNexus worker, for example an EC2 instance profile on the host that runs OpsNexus.
• Role to assume (for example arn:aws:iam::123456789012:role/OpsNexusReadOnly) makes OpsNexus call sts:AssumeRole first. Use it to read another AWS account. Add an External ID if the role's trust policy requires one.

Regions takes a comma-separated list such as ap-south-1, us-east-1. Leave it empty or enter all to scan every region enabled for the account. Unknown region names are ignored and listed as a warning.

#Required permissions

Attach the AWS managed policy ReadOnlyAccess plus ce:GetCostAndUsage to the IAM user or role.

For per-resource cost (used by Cost by VPC and cluster cost) also add ce:GetCostAndUsageWithResources and turn on Resource-level data at daily granularity in AWS Billing and Cost Management preferences.

If you prefer a narrower policy, these are the calls the collector makes:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "OpsNexusInventory",
      "Effect": "Allow",
      "Action": [
        "sts:GetCallerIdentity",
        "ec2:DescribeRegions",
        "ec2:DescribeInstances",
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:DescribeRouteTables",
        "ec2:DescribeInternetGateways",
        "ec2:DescribeVpcPeeringConnections",
        "ec2:DescribeTransitGatewayAttachments",
        "ec2:DescribeVpnGateways",
        "ec2:DescribeNatGateways",
        "ec2:DescribeVolumes",
        "ec2:DescribeVpcEndpoints",
        "rds:DescribeDBInstances",
        "lambda:ListFunctions",
        "eks:ListClusters",
        "eks:DescribeCluster",
        "ecs:ListClusters",
        "ecs:DescribeClusters",
        "dynamodb:ListTables",
        "elasticloadbalancing:DescribeLoadBalancers",
        "sqs:ListQueues",
        "sns:ListTopics",
        "ecr:DescribeRepositories",
        "secretsmanager:ListSecrets",
        "tag:GetResources",
        "s3:ListAllMyBuckets",
        "route53:ListHostedZones",
        "cloudfront:ListDistributions",
        "ce:GetCostAndUsage",
        "ce:GetCostAndUsageWithResources"
      ],
      "Resource": "*"
    }
  ]
}

secretsmanager:ListSecrets returns secret names only. OpsNexus never reads secret values.

A missing permission does not fail the whole sync. OpsNexus skips that piece, keeps going, and reports the exact permission in the account's status, for example RDS: missing permission rds:DescribeDBInstances in 4 regions.

#Reading other AWS accounts

To read several AWS accounts from one set of credentials:

1. In each target account, create a role (for example OpsNexusReadOnly) with the permissions above.
2. Let the IAM user or role that OpsNexus signs in with assume it. Add an sts:ExternalId condition to the trust policy if you want one.
3. Connect each target account in OpsNexus with the same credentials, its own Role to assume and the External ID.

#Azure

Sign-in method: service principal.

Give the service principal these roles on each subscription:

• Reader for resources and VM power state.
• Cost Management Reader for cost.

Without Reader, the sync fails with an access-denied error. Without Cost Management Reader, resources still sync and the account shows a cost warning.

#Google Cloud

Sign-in method: service account.

To prepare the project:

1. Enable the Cloud Asset API in each project.
2. Grant the service account Cloud Asset Viewer on each project.
3. For cost, set up the billing export to BigQuery (Billing, then Billing export, then BigQuery).
4. Grant the service account BigQuery Data Viewer on the billing dataset and BigQuery Job User on the billing project.
5. Enter the export table in Billing export table.

Without a billing export table, resources still sync and the account shows a note telling you to set one.

#Oracle Cloud

Sign-in method: api key.

Put the API user in a group (for example OpsNexus) and add these policy statements:

allow group OpsNexus to inspect all-resources in tenancy
allow group OpsNexus to read usage-reports in tenancy

#How syncing works

A sync reads resources and cost for one account and replaces what OpsNexus had for it.

• When: right after you connect the account, every 60 minutes for every enabled account, and when you click Sync in the accounts table.
• Cost window: each sync re-reads the last 90 days of daily cost, because providers can still correct recent days.
• Resources: resources that the cloud no longer returns are removed. If one part of the scan failed (a denied permission or an unreachable region), OpsNexus keeps the last known resources for that part instead of dropping them.
• AWS timeouts: each AWS call has short timeouts. If a region cannot be reached, the rest of that region is skipped for this sync and a warning is shown.
• Budgets: budgets are checked after each sync. See Cost and budgets.

You need modify access to the Cloud module to click Sync. A second click while a sync is running does nothing.

The schedule and cost window come from these settings. See Environment variables.

#Account status

The accounts table shows Account, Cloud, Resources, This month (usage cost before credits), Status and Synced.

A cost problem, such as a missing Cost Management Reader role, is shown as a separate line under the status.

If the worker restarts in the middle of a sync, the account shows error after 30 minutes with the message "The last sync was interrupted". Click Sync to run it again.

#Change or remove an account

There is no edit form for a connected account. To change its credentials, regions or subscriptions, remove it and connect it again.

To remove an account:

1. Click Remove on the account's row.
2. Type the account name to confirm and click Disconnect.

OpsNexus deletes the account, its stored credentials, and its resource and cost history. Nothing changes in the cloud account itself. Connecting and removing accounts are recorded in the audit log.