# cloud-cost identity

The CP9 multi-cloud cost report inventories AWS, GCP, Aliyun, and Azure without storing access keys. Each scope in `.github/cloud-cost-scopes.json` needs a keyless, read-only identity that only the locked GitHub workflow can assume.

## Who

Scope-account admin (SSO / ADC / Azure CLI / CloudSSO). A GitHub repo admin must create environment `cloud-cost-report` with no deployment branch restriction so feature branches can prove the identity before merge. AWS, Aliyun, and Azure bind the environment subject for this floor.

## When

Adding or enabling a scope in `.github/cloud-cost-scopes.json`.

## Floor

Read [`../live-floor.md`](../live-floor.md) and run those steps.

GitHub identity: repo `tidbcloud/controlplane9`, environment `cloud-cost-report`, workflow `.github/workflows/cloud-cost-report.lock.yml`, and any branch ref. Subject: `repo:tidbcloud/controlplane9:environment:cloud-cost-report`. Providers with a workflow claim bind that exact path; AWS, Aliyun, and Azure rely on the environment subject. Identity name `cp9-cloud-cost-report`.

| Cloud | Identity | Grants |
|---|---|---|
| AWS | GitHub OIDC `token.actions.githubusercontent.com` plus role `cp9-cloud-cost-report` | `ReadOnlyAccess`, `AWSBillingReadOnlyAccess` |
| GCP | SA + WIF pool/provider `cp9-cloud-cost-report` / `github` | Viewer, Cloud Asset Viewer, Service Usage Consumer, billing-account Viewer |
| Aliyun | RAM OIDC plus role `cp9-cloud-cost-report` | `ReadOnlyAccess`, `AliyunBSSReadOnlyAccess` |
| Azure | Entra app `cp9-cloud-cost-report-<scope_id>`, SP, federated credential `github-cloud-cost-report` | subscription Reader, Cost Management Reader |

Present OIDC/role stays. GCP stays `list_price` until a billing export is reviewed. AWS payer/CUR access is whatever the selected account's existing bucket policy already allows.

## Completion

Name table for the selected `scope_id`. Present GitHub OIDC is `left-in-place`. Run the workflow's OIDC preflight from the intended branch. Record the non-secret identity in `.github/cloud-cost-scopes.json`; enable the scope after the preflight passes.