Cost sources

A cost source reads one cost export: an AWS Data Export, a GCP billing export or an Azure cost export. It has its own keyless credential, apart from your asset sources. Billing rarely matches how you connect accounts: single AWS accounts are often billed through their management account, and a GCP billing account can pay for projects in several organizations.

Cost sources are optional. Without one, a workspace shows its assets and changes but no cost.

What a cost source covers

A cost source imports every row of its export and links each to its account and asset, whichever asset source holds them. An account that's in no asset source still shows in cost reports, as not connected. Each cost source page lists the accounts it covers, and each asset source page shows which cost source covers each account.

Each billing account or scope is connected once per workspace. When two exports bill the same account, such as a member account's own Data Export beside its management account's, the one you connected first keeps it, and the other shows a warning, so no cost is counted twice.

Syncs and permission checks

Each cost source syncs once a day, and whenever you ask. Every export is mapped to FOCUScolumns, so costs from all three clouds sit in one model. Clouds keep correcting a month for days after it ends, for credits and refunds, so each sync rewrites the current and the previous month. A missing permission shows as a warning on the cost source, and never stops asset collection.

Firewalls

AssetHermit reaches your clouds from a few fixed addresses, which each workspace's settings list under Network. A storage account, a VPC Service Controls perimeter or anything else that admits callers by address needs them; when one turns AssetHermit away, the permission check says so and lists them beside the fix. Each region has its own addresses, shared with other workspaces there, so an allowlist admits AssetHermit, not one workspace: the role or identity you grant is what limits access to yours. We keep the addresses fixed, and tell a workspace's admins if they ever change.

Plan limits

Kinds