Creating a service principal

The following guide will show you how to set up your account to allow Costi to access it in a secure manner. To do this We will create a Service Principal for Costi.

1. Use Azure CLI to set the active subscription - Run the following command: az account set --subscription ""

2. Use Azure CLI to Create the Service Principal - Run the following command: az ad sp create-for-rbac -n "Costi" --create-cert

3. You should get a response similar to the one below:
   
   Creating a role assignment under the scope of "/subscriptions/"
   {
   "appId": "XXX",
   "displayName": "Costi",
   "fileWithCertAndPrivateKey":" "/path/to/certificate/tmp123abc_v.pem"
   "name": "http://Costi",
   "password": "YYY",
   "tenant": "ZZZ"
   }

4. Please save the response. We will need some of the properties - they are needed later in the registration step

​

Create billing export

1. There are two methods:

   1. A - Traditional - Billing export - You control what CloudHiro can see, but billing data is available for up to 3 months  in the past.

   2. B - New method - billing API - CloudHiro can Access up to 12 months of billing data in the past. 

​

Method A - Billing export

1. There is an Azure guide for this.
    

2. Create a storage account for Costi to be able to read from.
    

3. Create a billing exports at the highest level possible (billing account preferred), that will export CSV files to the storage account. Do not export at “Tenant management group” or any other management group. Billing account level or subscription level.
   A total of 6 exports should be created:

   1. Daily export - month to date - it will run automatically each day.

      1. Amortized cost (1)

      2. Actual cost (2)

   2. One-time export of the last 2 months before the current month - each one of them will run 1 time.

      1. Previous month (i.e. we are in July, meaning June)

         1. Amortized cost (3)

         2. Actual cost (4)

      2. 2 months ago (i.e. we are in July, meaning May)

         1. Amortized cost (5)

         2. Actual cost (6)
             

4. Please note: The entire billing path must include two components.

   1. The month of the export is in the ‘YYYYMM’ format, this is usually the Azure default.

   2. The string ‘amor’ in the path of the export contains the amortized data, for example - directory or container has the “amor” string in it.
       

5. To automate the process - you can use the following powershell script

​

Method B - Billing API:

​

1. Just grant the “Enrollment reader” permission to the service principal - Add it manually or  you can use the following script (haven’t been tested)

​

Add role assignments

1. You can use this script from the azure CLI to quickly assign the role to all subscriptions.

2. If you did not use the script, navigate to Subscriptions -> Access Control (IAM) -> Role Assignments.  ​​Add the following role assignments to the service principal:

   1. ​Reader

   2. Billing Reader

   3. For the Storage accounts that all the billing exports:​​​​

      1. Reader and Data Access

      2. Storage Blob Data Reader

​Register to CloudHiro

1. Register here.  Please note: If you are using a reseller, either use the reseller-provided link to register or add “?partner=[reseller-name]” to the end of the URL above. If you did not, our support can re-allocate your account to your reseller later on

2. You will need the following values from the previously saved response to complete the registration form:

   1. ​Client ID - “appId“ use XXX

   2. Certificate - “fileWithCertAndPrivateKey”

   3. Tenant Id - “tenant” use ZZZ​

3. ​After registering to CloudHiro, confirm the email you got and login.

​​

Add subscription and permissions for Auto-RI management

Auto-RI is our automated Reservation Management.

1. Create a new subscription for our purchases. If you already have a subscription for purchases, you can use that one.

2. Grant Reservations Administrator at the Tenant level. Azure’s manual on how to add permissions at the tenant level -  use this link,

3. Grant Reservations Purchaser on the subscription you have created above.

4. Grant Reservations Reader to all the tenant to see all reservations purchased.

5. Please note: Auto-RI requires the billing export from the previous section (method A or B). 

​

Add Log analytics permissions guide

1. After creating the service principal, go to the app registration of the service principal created → API permissions → add a permission → api’s my organization uses → log analytics API → add data.read permission.

​

Configure Billing Export & Azure-RI in CloudHiro

1. Login to your CloudHiro account.

2. Go to system->settings and update the four fields required for Bill CSV Location & the Azure RIs Subscription ID field. Update all at once. If you do not have a subscription ID, you can simply use 123 as a placeholder.

​

That’s it!

We are done setting up. You can now ask your partner for a tour of CloudHiro and the CloudHiro visualizer.

​

Required permissions summary for CloudHiro's service principal