Getting Started

Create a cross-account IAM role that trusts our worker account and attach the read-only policy below. Discovery uses ReadOnlyAccess; remediation modes additionally require explicit Allow statements per action type.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "TurboFinOpsDiscovery",
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",
        "rds:Describe*",
        "eks:List*", "eks:Describe*",
        "lambda:List*", "lambda:Get*",
        "ecs:List*", "ecs:Describe*",
        "ecr:Describe*",
        "elasticloadbalancing:Describe*",
        "cloudwatch:GetMetricStatistics",
        "ce:GetCostAndUsage",
        "pricing:GetProducts",
        "tag:GetResources"
      ],
      "Resource": "*"
    }
  ]
}

Create an Entra ID app registration, generate a client secret, and assign Reader at the subscription scope. For remediation, additionally assign Contributor on the resource groups TurboFinOps may act on.

# 1. Create app registration
az ad app create --display-name "TurboFinOps Discovery"

# 2. Create service principal
APP_ID=$(az ad app list --display-name "TurboFinOps Discovery" --query "[0].appId" -o tsv)
az ad sp create --id $APP_ID

# 3. Assign Reader at subscription scope (discovery)
SUB_ID=$(az account show --query id -o tsv)
az role assignment create \
  --assignee $APP_ID \
  --role "Reader" \
  --scope "/subscriptions/$SUB_ID"

# 4. Generate client secret (paste into Connections > Azure)
az ad app credential reset --id $APP_ID --years 2

Create a service account with the Viewer role at the project level and download a JSON key. Discovery uses Viewer; remediation requires Compute Admin or narrower roles depending on action type.

# 1. Create service account
gcloud iam service-accounts create turbofinops-discovery \
  --display-name="TurboFinOps Discovery"

# 2. Grant Viewer at project scope
PROJECT_ID=$(gcloud config get-value project)
SA_EMAIL="turbofinops-discovery@$PROJECT_ID.iam.gserviceaccount.com"
gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member="serviceAccount:$SA_EMAIL" \
  --role="roles/viewer"

# 3. Generate JSON key (paste into Connections > GCP)
gcloud iam service-accounts keys create ./tfo-key.json \
  --iam-account=$SA_EMAIL