--- updatedAt: 2026-09-03T04:22:24.000Z agentTools: projectIndex: https://docs.cloudchipr.com/llms.txt --- # Read-Only Access Requirements This page describes what access permissions that Cloudchipr needs for collecting billing and usage metrics. Start with read-only access to use Cloudchipr's visibility, billing, cost optimization, and task-management features without allowing resource changes. Move an account or provider to a read-write role only when it does not host production or mission-critical data and you need to use actions. Read-only access supports Billing Explorer, dashboards, inventory, utilization metrics, recommendations, budgets, anomaly detection, alerts, and task management. ## Principles * **Read-only.** The access described on this page cannot create, modify, or delete resources in your environment. * **No access keys or secrets.** Cloudchipr does not use AWS access keys, GCP service account key files, or Azure client secrets. Connections use role-based access control: you grant a role to an identity, and no long-lived credentials are shared. Databricks and Snowflake are the exceptions, and are covered in the table below. * **Agentless, except Kubernetes.** Cloudchipr reads data through each provider's APIs; it does not install anything in your workloads. In-cluster Kubernetes monitoring runs an agent that collects usage metadata and metrics and sends them to Cloudchipr to analyze container costs and workload utilization. *** ## What read-only access requires, by platform | Platform | Identity Cloudchipr uses | Read-only grant | Scope | Authentication | Admin needed to set up | | ---------- | ---------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------- | ----------------------------------------------- | | AWS | An IAM role in your account that Cloudchipr assumes cross-account | A read-only IAM role created by the [`read.json`](https://cloudchipr-cf-templates.s3.us-west-2.amazonaws.com/read.json) CloudFormation stack, plus `CloudchiprAccountReadAccessRole` in member accounts | Organization payer account or a single standalone account | `sts:AssumeRole` with a connection-specific `sts:ExternalId`. Cloudchipr does not create or store access keys | IAM administrator on the payer account | | GCP | A Cloudchipr-owned Google service account with roles in your organization | `Viewer`,

`Organization Role Viewer`, and `Browser` at the organization scope | Organization (recommended) or a single project | IAM policy binding. Cloudchipr does not export a service account key file | Organization Administrator or Project IAM Admin | | Azure | A Cloudchipr application identity instantiated as a service principal in **your** tenant | `Reader`,

`Storage Blob Data Reader` on **one dedicated storage account** that holds the billing export | `Reader` at a management group or on selected subscriptions. Grant the blob role on one storage account only | Microsoft Entra ID service principal | Owner or User Access Administrator | | Databricks | An account-level service principal that **you** create | `USE CATALOG`, `USE SCHEMA`, and `SELECT` on nine Unity Catalog `system` tables,

the `USER` workspace role | Databricks account and one workspace | OAuth client ID and secret that you issue to the service principal | Account Admin and Metastore Admin | | Kubernetes | An in-cluster agent installed through a Helm chart | Read access to Kubernetes | Per cluster | Cloudchipr API key | Cluster administrator and Helm v3 | | Snowflake | A role and warehouse created by the Cloudchipr setup script | A dedicated Snowflake user with RSA key-pair authentication; a dedicated X-Small warehouse; read-only access to Snowflake system usage data through `IMPORTED PRIVILEGES` and `MONITOR USAGE`; and a storage integration restricted to the designated Cloudchipr GCS location | Snowflake account | Account identifier and storage integration | `ACCOUNTADMIN` | *** ## What is collected, and what is not Cloudchipr reads the following data. ### Collected (read-only) * **Resource inventory and configuration:** type, size, region, tags, and running state of each resource * **Utilization metrics:** CPU, memory, disk, and network usage over time * **Billing and cost data:** cost and usage line items from your provider bill. AWS provides this data through a Cost and Usage Report or Data Export. Azure provides it through a Cost Management Export written to one dedicated storage account. GCP provides it through your billing data. ### Not accessed * **Storage contents:** Cloudchipr does not open files, objects, or backups. Azure is the exception: Cloudchipr reads cost and usage files from **one dedicated storage account that you create solely for the billing export**. It cannot access any other storage account in your tenant. * **Database contents:** Cloudchipr does not access database contents other than billing and usage data. * **Secrets:** Cloudchipr does not access material, keys, or certificates in Key Vault, Secrets Manager, or Secret Manager. * **Inside compute:** Cloudchipr does not access disk contents, memory, or running application data. * **Credentials:** Cloudchipr does not access users, logins, or application accounts.
See Security & Compliance for certifications and information about the wider security program. *** ## Revoking access Access ends the moment you remove the grant. No coordination with Cloudchipr is required. | Platform | How to revoke | | ---------- | -------------------------------------------------------------------------------------------------------------- | | AWS | Delete the Cloudchipr CloudFormation stack, and the `CloudchiprAccountReadAccessRole` roles in member accounts | | GCP | Remove the IAM policy binding for the Cloudchipr service account at the organization or project | | Azure | Remove the two role assignments, or delete the Cloudchipr enterprise application from your tenant | | Databricks | Delete the service principal. This removes its workspace assignment and every system table grant | | Kubernetes | Uninstall the Helm release, and revoke the API key | | Snowflake | Drop the role created by the setup script |