Read-Only Access Requirements

Start with read-only access to use Cloudchipr's visibility, billing, cost optimization, and task-management features without allowing resource changes. Move an account or provider to a read-write role only when it does not host production or mission-critical data and you need to use actions.

Read-only access supports Billing Explorer, dashboards, inventory, utilization metrics, recommendations, budgets, anomaly detection, alerts, and task management.

Principles

Read-only. The access described on this page cannot create, modify, or delete resources in your environment.
No access keys or secrets. Cloudchipr does not use AWS access keys, GCP service account key files, or Azure client secrets. Connections use role-based access control: you grant a role to an identity, and no long-lived credentials are shared. Databricks and Snowflake are the exceptions, and are covered in the table below.
Agentless, except Kubernetes. Cloudchipr reads data through each provider's APIs; it does not install anything in your workloads. In-cluster Kubernetes monitoring runs an agent that collects usage metadata and metrics and sends them to Cloudchipr to analyze container costs and workload utilization.

What read-only access requires, by platform

Platform	Identity Cloudchipr uses	Read-only grant	Scope	Authentication	Admin needed to set up
AWS	An IAM role in your account that Cloudchipr assumes cross-account	A read-only IAM role created by the `read.json` CloudFormation stack, plus `CloudchiprAccountReadAccessRole` in member accounts	Organization payer account or a single standalone account	`sts:AssumeRole` with a connection-specific `sts:ExternalId`. Cloudchipr does not create or store access keys	IAM administrator on the payer account
GCP	A Cloudchipr-owned Google service account with roles in your organization	`Viewer`, `Organization Role Viewer`, and `Browser` at the organization scope	Organization (recommended) or a single project	IAM policy binding. Cloudchipr does not export a service account key file	Organization Administrator or Project IAM Admin
Azure	A Cloudchipr application identity instantiated as a service principal in your tenant	`Reader`, `Storage Blob Data Reader` on one dedicated storage account that holds the billing export	`Reader` at a management group or on selected subscriptions. Grant the blob role on one storage account only	Microsoft Entra ID service principal	Owner or User Access Administrator
Databricks	An account-level service principal that you create	`USE CATALOG`, `USE SCHEMA`, and `SELECT` on nine Unity Catalog `system` tables, the `USER` workspace role	Databricks account and one workspace	OAuth client ID and secret that you issue to the service principal	Account Admin and Metastore Admin
Kubernetes	An in-cluster agent installed through a Helm chart	Read access to Kubernetes	Per cluster	Cloudchipr API key	Cluster administrator and Helm v3
Snowflake	A role and warehouse created by the Cloudchipr setup script	A dedicated Snowflake user with RSA key-pair authentication; a dedicated X-Small warehouse; read-only access to Snowflake system usage data through `IMPORTED PRIVILEGES` and `MONITOR USAGE`; and a storage integration restricted to the designated Cloudchipr GCS location	Snowflake account	Account identifier and storage integration	`ACCOUNTADMIN`

What is collected, and what is not

Cloudchipr reads the following data.

Collected (read-only)

Resource inventory and configuration: type, size, region, tags, and running state of each resource
Utilization metrics: CPU, memory, disk, and network usage over time
Billing and cost data: cost and usage line items from your provider bill. AWS provides this data through a Cost and Usage Report or Data Export. Azure provides it through a Cost Management Export written to one dedicated storage account. GCP provides it through your billing data.

Not accessed

Storage contents: Cloudchipr does not open files, objects, or backups. Azure is the exception: Cloudchipr reads cost and usage files from one dedicated storage account that you create solely for the billing export. It cannot access any other storage account in your tenant.
Database contents: Cloudchipr does not access database contents other than billing and usage data.
Secrets: Cloudchipr does not access material, keys, or certificates in Key Vault, Secrets Manager, or Secret Manager.
Inside compute: Cloudchipr does not access disk contents, memory, or running application data.
Credentials: Cloudchipr does not access users, logins, or application accounts.

See Security & Compliance for certifications and information about the wider security program.

Revoking access

Access ends the moment you remove the grant. No coordination with Cloudchipr is required.

Platform	How to revoke
AWS	Delete the Cloudchipr CloudFormation stack, and the `CloudchiprAccountReadAccessRole` roles in member accounts
GCP	Remove the IAM policy binding for the Cloudchipr service account at the organization or project
Azure	Remove the two role assignments, or delete the Cloudchipr enterprise application from your tenant
Databricks	Delete the service principal. This removes its workspace assignment and every system table grant
Kubernetes	Uninstall the Helm release, and revoke the API key
Snowflake	Drop the role created by the setup script