SUPPORTED CLOUDS

Multi-cloud, stated honestly.

We connect read-only to your clouds. Azure is the most mature path; AWS and Google Cloud are shown with explicit readiness and evidence limitations.

Provider	Status	How it connects	Coverage
Microsoft Azure	Production-ready	Read-only service principal (Reader + Cost Management Reader)	Production Azure analysis · daily cost sync · weekly price catalog · evidence-backed detector families
Amazon Web Services	Readiness-gated	Read-only IAM role (external ID)	Cost and inventory evidence where configured · coverage varies by permissions
Google Cloud	Readiness-gated	BigQuery billing export · Workload Identity Federation	BigQuery billing-export analysis · inventory evidence where configured

Provider coverage matrix · last reviewed 2026-07-12

Coverage is stated by capability, not by logo. Azure has the strongest production coverage. AWS and Google Cloud paths depend on verified read-only access, billing export, inventory, and metric evidence.

Costframe provider coverage by capability for Azure, AWS, and Google Cloud.
Capability	Azure	AWS	Google Cloud
Cost inventory	Available Resource Graph and Cost Management evidence.	Readiness-gated Cost Explorer and read-only inventory evidence where configured.	Readiness-gated Billing export and read-only project inventory evidence where configured.
Idle and unused resources	Available VM, disk, network, load balancer, and platform idle signals.	Partial EC2, EBS, Elastic IP, load balancer, NAT, and storage signals where evidence is available.	Partial Compute, persistent disk, static IP, forwarding rule, NAT, and SQL signals where evidence is available.
Rightsizing	Available VM and SQL utilization where metrics are available.	Partial EC2 rightsizing depends on collected metric evidence.	Partial Compute rightsizing depends on collected metric evidence.
Reservations and commitments	Available Reservation gap estimate from stable compute spend.	Partial Savings Plan or Reserved Instance coverage signal where configured.	Partial Committed Use Discount coverage signal where billing export supports the analysis.
Security and governance signals	Partial Read-only resource posture and governance signals from audit evidence.	Partial Read-only IAM, logging, exposure, and governance signals when permissions allow.	Partial Read-only IAM, logging, exposure, and governance signals when permissions allow.
Native provider recommendations	Partial Advisor comparison where recommendation evidence is available.	Not checked yet Native recommendation APIs are not presented as coverage yet.	Not checked yet Native recommendation APIs are not presented as coverage yet.
Reports and exports	Available PDF, CSV, email, and share workflows use safe report metadata.	Partial PDF and CSV outputs reflect available AWS evidence and limitations.	Partial PDF and CSV outputs reflect available GCP evidence and limitations.
Known exclusions	Known exclusion No write remediation or resource-level cost movement snapshots.	Known exclusion No write remediation, webhook delivery, or new scanner engines.	Known exclusion No write remediation, webhook delivery, or new scanner engines.

Read-only trust boundary

Provider data enters Costframe. Provider writes do not.

Provider APIs

Read APIs, billing exports, inventory, metrics

Costframe normalizer

Org-scoped records, evidence freshness, detector inputs

Evidence Ledger

Checked signals, missing signals, confidence, price math

Review boundary

Tickets, reports, and guidance leave Costframe for human approval

Blocked boundary: Costframe does not import provider write clients for customer tenant operations and does not execute cloud changes.

Interactive architecture diagrams

Inspect the system boundary from provider API to verified report.

Hover, focus, or tap a diagram. Motion is restrained and respects reduced-motion settings.

Read APIs feed evidence. Write APIs stay outside Costframe.

Billing, inventory, metrics, and recommendation APIs are used only where configured and permitted.

01Provider APIs
02Read-only client
03Org-scoped store
04Evidence Ledger

Provider readiness details

Permissions, APIs, unsupported boundaries, and setup timeline.

This is the provider proof layer. It explains what Costframe can read, what remains blocked, and when a provider path is ready for evidence-backed findings.

Azure

Production-ready

Permissions: Reader + Cost Management Reader on selected subscriptions or scopes.
Supported APIs: Resource inventory, Cost Management ActualCost, Azure Monitor utilization, Retail Prices where available.
Unsupported: Owner, Contributor, deployment, resize, delete, write, and customer application payload access.
Readiness: Ready when service principal roles validate and first cost/inventory sync completes.
Setup timeline: Register app → assign scopes → validate connection → run audit → review Evidence Ledger.

AWS

Readiness-gated

Permissions: Read-only IAM role with customer-controlled external ID.
Supported APIs: Cost and inventory evidence where account access, billing data, and metrics are configured.
Unsupported: Mutation APIs, account administration, write remediation, and broad parity claims.
Readiness: Ready only after billing, inventory, metric coverage, and account scope are confirmed.
Setup timeline: Confirm account scope → configure role → validate evidence → pilot audit → document limits.

Google Cloud

Readiness-gated

Permissions: Workload Identity Federation or restricted service account plus billing-export access.
Supported APIs: BigQuery billing export analysis and inventory evidence where configured.
Unsupported: Automatic project changes, incomplete billing export inference, and unsupported service parity claims.
Readiness: Ready only after billing export, dataset access, project scope, and metric evidence are verified.
Setup timeline: Confirm billing export → configure identity → validate dataset → pilot audit → document limits.

Important Support Parameters

Azure is the production-ready path with supported resource analysis, SKU context from the price catalog where available, cost sync, and reports.
AWS and GCP are readiness-gated provider paths. Their evidence quality depends on verified account/project access, billing-export configuration, and available metrics.
Other providers are not supported at this time.

Telemetric Connection Pipeline

App Setup

Assign Scopes

Grant Reader + Cost Management Reader scopes to selected subscriptions.

Encrypted Key

Wizard validates principal credentials. Keys are encrypted instantly with AES-256-GCM.

Recurring Sync

Cost data syncs daily, list prices weekly. Audits run on your plan’s schedule.

SECURITY SCOPE PROTOCOLS

Strict boundary isolation.

Ingested Scope (Read-Only)

Subscription GUIDs & metadata
Subscription categorization and tenant boundary isolation.
Resource inventory properties
Virtual Machine core sizes, SKU indexes, locations, and capacity plans.
Cost Management ActualCost records
Reconciling raw daily spend details with negotiated subscription discount rates.
Workload CPU utilization counters
Daily average and maximum CPU utilization for compute and SQL workloads.

Strictly Out of Scope

Application Database contents
Costframe does not request application database credentials or payload-query access.
OS filesystems & SSH/RDP keys
No VM-level agents or runtime access credentials are ever requested.
Identity registries & user profiles
Provider integrations are for cloud cost, inventory, and selected governance evidence—not directory profile scraping.
Write Operations of any scope
No deploy, create, modify, scale, or terminate code paths exist.

Get started with multi-cloud auditing

Connect approved cloud accounts read-only, run review scans, and analyze savings candidates with provider limits stated up front.

Provider

Status

How it connects

Coverage

Microsoft Azure

Production-ready

Read-only service principal (Reader + Cost Management Reader)

Production Azure analysis · daily cost sync · weekly price catalog · evidence-backed detector families

Amazon Web Services

Readiness-gated

Read-only IAM role (external ID)

Cost and inventory evidence where configured · coverage varies by permissions

Google Cloud

Readiness-gated

BigQuery billing export · Workload Identity Federation

BigQuery billing-export analysis · inventory evidence where configured

Capability

Azure

AWS

Google Cloud

Cost inventory

Available

Resource Graph and Cost Management evidence.

Readiness-gated

Cost Explorer and read-only inventory evidence where configured.

Readiness-gated

Billing export and read-only project inventory evidence where configured.

Idle and unused resources

Available

VM, disk, network, load balancer, and platform idle signals.

Partial

EC2, EBS, Elastic IP, load balancer, NAT, and storage signals where evidence is available.

Partial

Compute, persistent disk, static IP, forwarding rule, NAT, and SQL signals where evidence is available.

Rightsizing

Available

VM and SQL utilization where metrics are available.

Partial

EC2 rightsizing depends on collected metric evidence.

Partial

Compute rightsizing depends on collected metric evidence.

Reservations and commitments

Available

Reservation gap estimate from stable compute spend.

Partial

Savings Plan or Reserved Instance coverage signal where configured.

Partial

Committed Use Discount coverage signal where billing export supports the analysis.

Security and governance signals

Partial

Read-only resource posture and governance signals from audit evidence.

Partial

Read-only IAM, logging, exposure, and governance signals when permissions allow.

Partial

Read-only IAM, logging, exposure, and governance signals when permissions allow.

Native provider recommendations

Partial

Advisor comparison where recommendation evidence is available.

Not checked yet

Native recommendation APIs are not presented as coverage yet.

Not checked yet

Native recommendation APIs are not presented as coverage yet.

Reports and exports

Available

PDF, CSV, email, and share workflows use safe report metadata.

Partial

PDF and CSV outputs reflect available AWS evidence and limitations.

Partial

PDF and CSV outputs reflect available GCP evidence and limitations.

Known exclusions

Known exclusion

No write remediation or resource-level cost movement snapshots.

Known exclusion

No write remediation, webhook delivery, or new scanner engines.

Known exclusion

No write remediation, webhook delivery, or new scanner engines.

Provider data enters Costframe. Provider writes do not.

Provider APIs

Read APIs, billing exports, inventory, metrics

Costframe normalizer

Org-scoped records, evidence freshness, detector inputs

Evidence Ledger

Checked signals, missing signals, confidence, price math

Review boundary

Tickets, reports, and guidance leave Costframe for human approval

Blocked boundary: Costframe does not import provider write clients for customer tenant operations and does not execute cloud changes.