Documentation
What the tool does, the access it asks of each provider and how it protects your data.
Overview
FinOps Move2Cloud brings the costs of your cloud accounts into one view and helps you reduce them: spend of the month, end-of-month forecast, 12-month history, budgets with alerts, priced savings recommendations, shared dashboards and PDF or CSV exports.
Sovereign providers
American providers
The tool reads your costs and your inventory; it neither changes nor deletes anything at your providers.
Why FinOps Move2Cloud
Most FinOps tools were designed first for AWS, Azure and Google Cloud. FinOps Move2Cloud was designed for sovereign clouds, and positions itself as the reference for tracking and optimising their costs, without giving up the American clouds you also use.
- Sovereign clouds read natively: OVHcloud Public Cloud projects (instances, volumes, Kubernetes, managed databases), Scalingo apps and add-ons, Scaleway projects. At Scalingo, which does not publish its current consumption, the current month is estimated from the containers and add-ons running.
- Recommendations written for these clouds: non-production environments running permanently, Kubernetes pools without autoscaling, OVHcloud instances billed by the hour that would benefit from a commitment, oversized Scalingo containers, unused add-ons.
- A single view with AWS, Azure and Google Cloud: you compare what you spend with each, and follow the share of your budget entrusted to sovereign providers, region by region.
- A platform hosted in France: the application, its database and its backups at Scalingo, e-mails and exports at Scaleway, in Paris.
- Read-only access, verified then encrypted: the tool neither changes nor deletes anything at your providers.
- A French publisher, Move2Cloud, specialised in migrating to and running sovereign clouds: an interface and support in French and English, prices in euros.
Providers and the access they need
Each cloud account is connected with a read-only access that you create and keep the control of: removing it cuts the access at once.
Sovereign providers
- OVHcloudA token limited to reading Public Cloud projects (GET /cloud/project and its sub-paths).
- ScalingoAn API token. Scalingo does not offer a read-only token; the tool only reads.
- ScalewayAn API key of an IAM application that only has the BillingReadOnly and ProjectReadOnly permission sets.
American providers
- AWSA read-only role created by a ready-to-launch CloudFormation stack (costs, and optionally the inventory and AWS's recommendations), with no key to hand to us. Failing that, an IAM user limited to ce:GetCostAndUsage and ce:GetCostForecast.
- AzureThe FinOps Move2Cloud application, which you authorise in your Microsoft Entra ID directory, then to which you give the Cost Management Reader role on a management group or on the subscriptions to track, with no secret to hand to us. Failing that, your own application with a client secret. No Contributor or Owner role is needed. Depending on your Azure contract, access to costs may also depend on billing permissions.
- Google CloudA service account with the BigQuery Data Viewer role on the billing export's dataset and the BigQuery Job User role on its project. The tool only runs read queries on that export.
The step-by-step procedure of each provider, with screenshots, is in “Connecting a provider”, in the documentation of the console.
What is FinOps?
FinOps (a blend of “finance” and “DevOps”) is the practice that makes each team accountable for what the cloud it uses costs. In the cloud, spending is no longer an investment decided once a year: it is created every day, resource by resource, by the people who deploy. FinOps brings finance, engineering and the business together around the same figures, to decide quickly and knowingly.
The FinOps Foundation describes three phases, gone through in a loop:
- Inform: know what you spend, where, and on what, with costs allocated by project, team or environment;
- Optimise: reduce what is not used, resize what is oversized, commit to what runs permanently;
- Operate: set budgets, follow their gaps, and make the cost review a ritual, for example a monthly FinOps committee.
The goal is not to spend less at all costs, but to spend right: every euro should serve a use you have chosen.
Tracking costs day to day
The cloud is billed by use: a forgotten resource, a test environment left running or an unexpected surge in load shows on the bill a month later. Tracking costs continuously means seeing the drift while there is still time to act.
FinOps Move2Cloud reads your costs at each synchronisation, once a day by default, and shows you:
- the month's spend to date and the end-of-month forecast, compared with the previous month;
- twelve months of history, and the day-by-day record of the spend, to download as CSV;
- the breakdown by provider, by resource type, by region and by project or app;
- the savings to capture, priced when the data allows it.
All these views are exported as PDF or CSV, for accounting or a committee.
Why dashboards
Not everyone looks at the same figures: management wants the trend and the savings, a product team the cost of its applications, finance the gap to budget. A dashboard gives everyone the view that concerns them, without drowning them in the rest.
In FinOps Move2Cloud, a dashboard is made of blocks (spend, forecast, breakdowns, recommendations, budgets, alerts) on a chosen scope: a provider, a cloud account, an environment, projects. It is created from a template, from a sentence the AI shapes, or from a blank page.
It stays private until its author shares it, then is shared with chosen people or the whole team, or through a public link valid for 24 hours. It thus becomes the natural support of a FinOps committee or a management review.
Why budgets and alerts
A budget is only worth something if it warns you before the bill. That is the role of alerts: to flag a drift while there is still time to correct it.
In FinOps Move2Cloud, you set a global budget and a budget per project or app, with an alert threshold. An e-mail is sent:
- when the spend reaches the chosen threshold;
- when the end-of-month forecast announces an overrun, before it happens;
- when the budget is exceeded.
Each alert is sent once per month and per budget, to inform without tiring. The recipients are chosen per organisation, and a weekly summary can be sent to the team.
Tagging and cost allocation
Allocating costs means being able to say who each euro belongs to: which product, which team, which environment, which customer. It is the condition of fair internal chargeback and of shared accountability.
Good tagging practices:
- a small number of keys, always the same: environment, application, team, cost centre;
- values written the same way everywhere (prod, preprod, staging…), decided once and documented;
- tags set when resources are created, by the deployment tooling rather than by hand;
- a regular check of the share of spending that escapes allocation.
FinOps Move2Cloud allocates your costs according to the structure your providers bill: Public Cloud projects at OVHcloud, apps at Scalingo, projects at Scaleway and Google Cloud, accounts at AWS, subscriptions at Azure. The environment of each project (production, non-production) is inferred from its name, and can be corrected by hand. Tags set on resources are not read at this stage: a clear split into projects and a consistent naming convention already give a reliable allocation, and dashboards can be filtered on project names.
AI analysis
The tool's rules spot known waste. The AI complements them: it reads what you are billed, service by service and across all your providers, to bring out what no rule foresaw.
- At the top of the Recommendations page: a summary of your spending, the highlights of your bills, the recommendations to start with, and leads the rules do not cover. It is renewed when your bills or your recommendations change, at most once a day.
- For dashboards: you describe in one sentence the view you need, the AI proposes a dashboard that you check and adjust.
The AI advises, it does not put figures on things: the amounts shown remain those read from your providers, and the order of magnitude of an AI lead is flagged as an estimate to check.
It receives your cost data, stripped of your account numbers, of the names of your organisation and your team, and of any access credential. The details of the data sent and of the AI provider are in the privacy policy. The AI features are available when they are enabled on the platform, within the limits of your plan.
Security and privacy
- Cloud credentials verified then encrypted, never shown again.
- Read-only access at the providers.
- Password of at least 12 characters, with a lowercase letter, an uppercase letter, a digit and a special character.
- Two-factor authentication available to each user, and which the owner can require of the whole team.
- Permissions by role: a viewer changes nothing, the cloud accounts and the settings are reserved for the administrators and the owner, the subscription for the owner.
- Retained exports are personal: only their author has access to them.
- Each client's data is partitioned: no page or action reads the data of another account.
- The administration of the platform sees neither your costs nor your credentials.