Docs / Cloud Accounts / Billing Permissions for FinOps Data

Billing Permissions for FinOps Data

Published · Last updated: June 2026 · 3 min read

Overview

The CloudAIPilot FinOps module shows cloud spending, detects cost anomalies, and surfaces waste reduction recommendations. To pull cost and usage data from your cloud provider, CloudAIPilot requires specific billing read permissions on your connected cloud account.

This article lists the exact role or policy required for each provider.

Required Permissions by Provider

AWS

Attach the AWSBillingReadOnlyAccess managed policy to the IAM role used by CloudAIPilot. This grants the following permissions needed for FinOps data:

  • ce:GetCostAndUsage
  • ce:GetCostForecast
  • ce:GetDimensionValues

Important: AWS Cost Explorer must be explicitly activated in your AWS Billing Console before CloudAIPilot can ingest cost data. Cost Explorer is not enabled by default on new AWS accounts.

GCP

Grant the roles/billing.viewer role (also called Billing Account Viewer) to your service account.

Important: This role must be assigned at the Billing Account level in the GCP Console (Billing → Account Management → Permissions), not at the project level. Assigning at the project level will always report as "denied" in the permission check.

Azure

Assign the Cost Management Reader role to the Service Principal at the Subscription level. This grants:

  • Microsoft.CostManagement/query/action
  • Microsoft.Consumption/usageDetails/read

DigitalOcean

DigitalOcean billing data is accessible with a standard Full Access Personal Access Token. No additional billing role or separate setup is required.

Verifying Billing Permissions

To confirm billing permissions are correctly configured:

  1. Go to Cloud Accounts and click on the account.
  2. Click Verify Permissions.
  3. Look at the FinOps & Billing row — it should show Granted.

If it shows Missing, add the role or policy listed above for your provider and run the check again.

Data Freshness

Cloud providers delay final billing data — AWS by up to 24 hours. CloudAIPilot displays a Data Freshness timestamp in the FinOps dashboard so you can see when the last cost sync occurred.

Related Articles