# AWS
Source: https://docs.yasu.cloud/guides/connect-aws
Complete guide to connect your AWS account to Yasu for cost analysis and optimization
Connect your **AWS account** to Yasu using our secure CloudFormation template. This one-click deployment creates a read-only IAM role that enables Yasu to analyze your cloud costs and provide optimization recommendations.
## Prerequisites
Before connecting your AWS account, ensure you have:
* **Administrative access** to your AWS account (or permissions to create IAM roles and CloudFormation stacks)
* **Cost Explorer enabled** in your AWS account
* Access to the AWS Console
**Security First:** Yasu uses a cross-account IAM role with read-only permissions. We cannot modify or delete any of your AWS resources.
## Quick Setup via CloudFormation
The fastest way to connect your AWS account is through our pre-configured CloudFormation template.
1. Log in to your Yasu dashboard at [app.yasu.cloud](https://app.yasu.cloud)
2. Go to **Settings** → **Integrations**
3. Click **Connect AWS**
You'll be redirected to AWS CloudFormation with our template pre-loaded.
1. **Review the stack name** — A unique name is generated for you (e.g., `YasuIntegration-abc123`)
2. **Review the parameters** — These are automatically filled in:
* `YasuCustomerId` — Your unique Yasu customer ID
* `YasuExternalId` — A secure token for cross-account access
* `BucketName` — S3 bucket for Cost and Usage Reports
* `ReportName` — Name for your AWS CUR report
3. **Scroll to the bottom** and check the acknowledgment box:
> ☑️ I acknowledge that AWS CloudFormation might create IAM resources.
4. Click **Create stack**
**Do not modify the parameters** — They are pre-configured to work with your Yasu account.
The CloudFormation stack typically completes in **2-3 minutes**. You can monitor the progress in the AWS Console:
* **CREATE\_IN\_PROGRESS** — Stack is being created
* **CREATE\_COMPLETE** — Stack created successfully
Once complete, Yasu automatically detects the connection and begins syncing your data.
Return to your Yasu dashboard. You should see:
* ✅ **Connection status**: Active
* ✅ **AWS Account ID**: Your connected account
* ✅ **Data sync**: In progress
Your first cost-saving insights will appear within **5-10 minutes** after connection.
## What the CloudFormation Template Creates
Our template creates the following resources in your AWS account:
### 1. Cross-Account IAM Role
A read-only IAM role that allows Yasu to access your cost and resource data:
```
arn:aws:iam::YOUR-ACCOUNT-ID:role/YasuCostOptimizationRole
```
### 2. IAM Policies with Read-Only Permissions
The role includes two policies. The main policy (`YasuCostOptimizationPolicy`) grants read-only access across AWS services:
| Service | Permissions | Purpose |
| --------------------- | ------------------------------------------------------------- | ---------------------------------------- |
| Cost Explorer | `ce:Describe*`, `ce:Get*`, `ce:List*` | Cost and usage data |
| Compute Optimizer | `compute-optimizer:Describe*`, `compute-optimizer:Get*` | Right-sizing recommendations |
| EC2 | `ec2:Describe*`, `ec2:List*` | Instance, volume, and snapshot info |
| RDS | `rds:Describe*`, `rds:List*` | Database instance details |
| EKS | `eks:Describe*`, `eks:List*` | Kubernetes cluster info |
| Lambda | `lambda:Get*`, `lambda:List*` | Function configurations |
| S3 | `s3:GetBucketLocation`, `s3:GetBucketTagging`, `s3:List*` | Storage bucket information |
| CloudWatch | `cloudwatch:Get*`, `cloudwatch:List*`, `cloudwatch:Describe*` | Utilization metrics |
| Organizations | `organizations:Describe*`, `organizations:List*` | Account structure |
| Savings Plans | `savingsplans:Describe*` | Savings plan coverage |
| Trusted Advisor | `trustedadvisor:Get*`, `trustedadvisor:List*`, `support:*` | AWS recommendations |
| Cost Optimization Hub | `cost-optimization-hub:Get*`, `cost-optimization-hub:List*` | Consolidated AWS savings recommendations |
A second policy (`YasuCloudWatchMetricsReadOnly`) grants read access to Container Insights logs and Auto Scaling metrics.
The policies below are from template version `v0.0.1`. For the latest version, see the [CloudFormation template](https://yasu-public.s3.eu-central-1.amazonaws.com/root/yasu-cf-template-v0.0.1.json).
Key statements:
**YasuBillingReadOnly** — Read-only access to billing, cost, and resource data:
```json theme={null}
{
"Sid": "YasuBillingReadOnly",
"Effect": "Allow",
"Action": [
"application-autoscaling:Describe*",
"aws-portal:ViewBilling",
"aws-portal:ViewUsage",
"budgets:Describe*",
"budgets:View*",
"ce:Describe*",
"ce:Get*",
"ce:List*",
"cloudwatch:Get*",
"cloudwatch:List*",
"cloudwatch:Describe*",
"cloudfront:GetDistribution",
"cloudfront:GetDistributionConfig",
"cloudfront:ListDistributions",
"cloudfront:ListTagsForResource",
"compute-optimizer:Describe*",
"compute-optimizer:Get*",
"cost-optimization-hub:Get*",
"cost-optimization-hub:List*",
"cur:Describe*",
"directconnect:Describe*",
"ec2:Describe*",
"ec2:List*",
"ecr:Describe*",
"ecr:List*",
"eks:Describe*",
"eks:List*",
"elasticache:List*",
"elasticfilesystem:Describe*",
"elasticloadbalancing:Describe*",
"es:Describe*",
"es:List*",
"glacier:Describe*",
"kafka:Describe*",
"kafka:List*",
"lambda:Get*",
"lambda:List*",
"organizations:Describe*",
"organizations:List*",
"pi:Describe*",
"pi:Get*",
"pi:List*",
"pricing:*",
"rds:Describe*",
"rds:List*",
"redshift:Describe*",
"redshift:List*",
"route53:Get*",
"route53:List*",
"s3:GetBucketLocation",
"s3:GetBucketTagging",
"s3:List*",
"sagemaker:Describe*",
"sagemaker:List*",
"savingsplans:Describe*",
"sqs:List*",
"ssm:Describe*",
"ssm:List*",
"support:*",
"tag:Get*",
"tag:GetResources",
"trustedadvisor:Get*",
"trustedadvisor:List*"
],
"Resource": "*"
}
```
**YasuContainerInsightsReadOnly** — Container Insights log access:
```json theme={null}
{
"Sid": "YasuContainerInsightsReadOnly",
"Effect": "Allow",
"Action": [
"logs:List*",
"logs:Describe*",
"logs:StartQuery",
"logs:StopQuery",
"logs:Filter*",
"logs:Get*"
],
"Resource": "arn:aws:logs:*:*:log-group:/aws/containerinsights/*"
}
```
**YasuContainerMetricsAccess** — Auto Scaling and CloudWatch metrics:
```json theme={null}
{
"Sid": "YasuContainerMetricsAccess",
"Effect": "Allow",
"Action": [
"autoscaling:Describe*",
"cloudwatch:Describe*",
"cloudwatch:Get*",
"cloudwatch:List*"
],
"Resource": "*"
}
```
### 3. Cost and Usage Report (CUR)
An S3 bucket and CUR configuration for detailed billing data:
* **Bucket**: `yasu-cur-{unique-id}`
* **Report granularity**: Daily
* **Format**: Parquet (optimized for analysis)
## What Yasu Will Scan
Once connected, Yasu analyzes your AWS environment for optimization opportunities:
### Cost Optimization Insights
* **Idle EC2 Instances** — Running instances with low CPU/network utilization
* **Oversized Instances** — Instances that can be downsized based on usage patterns
* **Unattached EBS Volumes** — Volumes not connected to any instance
* **Old EBS Snapshots** — Snapshots older than retention policies
* **Unused Elastic IPs** — Static IPs not associated with running resources
* **Idle RDS Instances** — Databases with minimal connections or queries
* **Underutilized Lambda** — Functions with excess memory allocation
* **S3 Storage Classes** — Buckets that could benefit from lifecycle policies
### Savings Opportunities
* **Reserved Instance Coverage** — Recommendations for RI purchases
* **Savings Plans** — Compute and EC2 Savings Plan opportunities
* **Spot Instance Candidates** — Workloads suitable for Spot pricing
## Cost Optimization Hub Recommendations
Yasu surfaces recommendations from **AWS Cost Optimization Hub (COH)** — AWS's own consolidated recommendation engine. COH brings rightsizing, idle-resource, Reserved Instance, and Savings Plans recommendations across your organization into one place, each with an estimated monthly saving.
COH recommendations are read through the AWS Cost Optimization Hub API. Enabling it does not add to your AWS bill.
Two things must be true for COH recommendations to appear in Yasu:
1. **Cost Optimization Hub is enabled** (opted in) in your AWS account.
2. The **Yasu IAM role has `cost-optimization-hub` read permissions** — included in the current CloudFormation template.
### Enroll in Cost Optimization Hub
Cost Optimization Hub is an opt-in AWS service. Enable it once from your **management (payer) account** so recommendations cover your whole organization.
1. Open the **AWS Billing and Cost Management** console
2. In the left navigation, select **Cost Optimization Hub**
3. Click **Enable Cost Optimization Hub** (or **Get started**)
4. Confirm the opt-in
```bash theme={null}
aws cost-optimization-hub update-enrollment-status \
--status Active \
--region us-east-1
```
From your management account, add `--include-member-accounts` to enroll the entire organization:
```bash theme={null}
aws cost-optimization-hub update-enrollment-status \
--status Active \
--include-member-accounts \
--region us-east-1
```
Cost Optimization Hub is a global service — its API lives in **us-east-1**, so run the command with `--region us-east-1`. After enrolling, AWS can take up to **24 hours** to generate the first recommendations.
If you're a **new customer**, that's all you need — the CloudFormation template you deployed already grants Yasu the read permission, so COH recommendations appear automatically once AWS has generated them.
## Existing Customers: Add the Cost Optimization Hub Permission
If you connected your AWS account **before August 2026**, your Yasu IAM role was created from an earlier template that did **not** include Cost Optimization Hub permissions. The template has since been updated, so you need to refresh your role once to add:
```
cost-optimization-hub:Get*
cost-optimization-hub:List*
```
Without these permissions, Yasu cannot read Cost Optimization Hub, and COH recommendations will not appear.
Choose either option below.
### Option A — Update your CloudFormation stack (recommended)
Update your existing Yasu stack to the latest template. Your parameters and role ARN stay the same; only the permissions change.
1. Open **AWS CloudFormation**
2. Select your existing Yasu stack (named `yasu-*` or `YasuIntegration-*`)
3. Click **Update** → **Replace existing template**
4. Under **Amazon S3 URL**, paste:
```
https://yasu-public.s3.eu-central-1.amazonaws.com/root/yasu-cf-template-latest.json
```
5. Click **Next** through the parameter and options screens — **keep all existing parameter values**
6. On the review screen, check **I acknowledge that AWS CloudFormation might create IAM resources**
7. Click **Update stack**
Replace `YOUR-STACK-NAME` with your stack's name (find it in the CloudFormation console):
```bash theme={null}
aws cloudformation update-stack \
--stack-name YOUR-STACK-NAME \
--template-url https://yasu-public.s3.eu-central-1.amazonaws.com/root/yasu-cf-template-latest.json \
--parameters \
ParameterKey=YasuID,UsePreviousValue=true \
ParameterKey=YasuHandshakeID,UsePreviousValue=true \
ParameterKey=YasuIamRole,UsePreviousValue=true \
ParameterKey=ReportName,UsePreviousValue=true \
ParameterKey=BucketName,UsePreviousValue=true \
ParameterKey=YasuPingbackArn,UsePreviousValue=true \
ParameterKey=TemplateVersion,UsePreviousValue=true \
ParameterKey=TemplateUrl,UsePreviousValue=true \
--capabilities CAPABILITY_IAM \
--region us-east-1
```
The update completes in **1–2 minutes**, ending in status **UPDATE\_COMPLETE**. Nothing else in your account changes — the role keeps the same ARN, and Yasu stays connected throughout.
### Option B — Add the permission manually
If you'd rather not update the stack, add the two actions to the role's policy directly:
1. Open **IAM → Roles** and find `YasuCostOptimizationRole-*`
2. Open the attached **YasuCostOptimizationPolicy-**\* policy and click **Edit**
3. Add these two actions to the `Action` list:
```json theme={null}
"cost-optimization-hub:Get*",
"cost-optimization-hub:List*"
```
4. Click **Save changes**
A manual edit is overwritten the next time the CloudFormation stack updates. Option A keeps your role in sync with the template going forward.
### Then enroll in COH
Adding the permission lets Yasu **read** Cost Optimization Hub, but AWS only generates recommendations once COH is **enabled**. If you haven't already, [enroll in Cost Optimization Hub](#enroll-in-cost-optimization-hub) as described above.
## Data Sync Schedule
| Data Type | Initial Sync | Ongoing Sync |
| ------------------- | --------------- | ------------- |
| Cost data | Last 12 months | Daily |
| Resource inventory | Current state | Every 6 hours |
| Utilization metrics | Last 14 days | Daily |
| Recommendations | Within 24 hours | Weekly |
## Troubleshooting
**Common causes:**
1. **Insufficient permissions** — Ensure you have `cloudformation:*`, `iam:*`, and `s3:*` permissions
2. **S3 bucket name conflict** — The bucket name must be globally unique; try again to generate a new name
3. **Service limits** — Check if you've hit IAM role limits
**Solution:** Delete the failed stack and try the connection again from Yasu.
**What to check:**
1. Verify the CloudFormation stack status is `CREATE_COMPLETE`
2. Check that the stack wasn't rolled back
3. Ensure the callback URL is accessible (no VPN/firewall blocking)
**Solution:** Wait 5 minutes, then refresh. If still pending, delete the stack and reconnect.
**What to check:**
1. **Cost Explorer is enabled** — Go to AWS Billing → Cost Explorer → Enable
2. **Sufficient history** — Cost Explorer needs \~24 hours to populate after first enable
3. **IAM permissions** — Verify the role has `ce:*` permissions
**Solution:** Enable Cost Explorer if needed, then wait 24 hours for data to populate.
**What to check:**
1. **Regional coverage** — Some resources may be in regions not yet scanned
2. **API rate limits** — Large accounts may take longer to fully scan
3. **Missing permissions** — Verify all Describe permissions are in place
**Solution:** Wait for the full sync cycle (up to 6 hours for large accounts).
## Connecting Multiple AWS Accounts
If you have multiple AWS accounts (e.g., production, staging, development), you can connect each one:
1. Go to **Settings** → **Integrations**
2. Click **Connect AWS** for each additional account
3. Deploy the CloudFormation stack in each account
**AWS Organizations:** If you use AWS Organizations, connect the management account first for organization-wide visibility.
## Next Steps
Add your Google Cloud accounts for multi-cloud visibility.
Add your Microsoft Azure accounts for multi-cloud visibility.
# Azure
Source: https://docs.yasu.cloud/guides/connect-azure
Complete guide to connect your Microsoft Azure account to Yasu for cost analysis and optimization
Connect your **Azure account** to Yasu by creating a Service Principal with read-only permissions. This enables Yasu to analyze your cloud costs and provide optimization recommendations.
**Security First:** Yasu uses a Service Principal with read-only permissions. We cannot modify, create, or delete any Azure resources.
## Subscription-Level Setup (All Billing Account Types)
This guide covers connecting Azure subscriptions to Yasu using subscription-level RBAC roles. This setup method works for **all Azure billing account types**, including:
* **Pay as You Go** (Individual subscriptions)
* **Microsoft Customer Agreement (MCA)**
* **Enterprise Agreement (EA)**
* **Azure Cloud Solution Provider (CSP)**
**Universal Setup:** Subscription-level RBAC roles provide access to cost data and resources for all billing account types. Simply create a Service Principal and assign roles at the subscription scope - no billing account ID or enrollment number is required.
## Prerequisites
Before connecting your Azure account, ensure you have:
* **Administrative access** to your Azure subscription (or permissions to create Service Principals and assign RBAC roles)
* **Subscription Owner or User Access Administrator** role to assign permissions
* Access to Azure Portal or Azure CLI
* PowerShell or Azure CLI installed (for automated setup)
## Quick Setup via Azure CLI
The fastest way to connect your Azure account is through Azure CLI commands.
1. Log in to your Yasu dashboard at [app.yasu.cloud](https://app.yasu.cloud)
2. **Create a workspace** (if you haven't already):
* After logging in, you'll be prompted to create a new workspace
* Enter your workspace name and click **Create**
* You'll be redirected to the **Onboarding** page
3. On the **Onboarding** page, Click the **Connect** button next to Azure
This opens the Azure connection dialog with step-by-step instructions.
In the dialog, you'll see an Azure CLI command to create a Service Principal:
1. **Copy the command** from the dialog (it is pre-filled with your account ID)
2. **Open Azure Cloud Shell** or your local terminal with Azure CLI installed
3. **Paste and run the command**
The command creates a Service Principal named `yasu-cost-optimizer-{your-account-id}` and returns a JSON output like:
```json theme={null}
{
"appId": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
"displayName": "yasu-cost-optimizer-...",
"password": "XXXX-XXXXXXXXXXXXXXXXXXXXXXXXXXXX",
"tenant": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
}
```
4. **Copy the entire JSON output** and paste it into the text box in the dialog — the credentials will be auto-filled from it
5. Click **Next**
**Important:** Save this output securely. The `password` (client secret) is only shown once and cannot be retrieved again.
The dialog will prompt you to enter the subscription ID where your Azure resources are hosted:
1. **Enter your Azure Subscription ID** in the provided field
2. The dialog will **automatically regenerate** the three role assignment commands with your subscription ID and App ID filled in
3. **Copy the commands** for your platform (Bash/Linux/macOS or PowerShell)
4. **Run the commands** in your Azure terminal and wait for a successful response — they assign the following roles to your Service Principal:
* **Reader** — read access to subscription resources
* **Cost Management Reader** — access to cost and billing data
* **Advisor Reviews Reader** — access to Azure Advisor recommendations
**Multiple subscriptions:** If your resources span more than one subscription, change the subscription ID in the dialog to your second subscription and run all three commands again. Repeat for each additional subscription.
Role assignments may take up to 5 minutes to propagate. Wait a few minutes before proceeding.
Your credentials have been **auto-filled** from the JSON output you pasted in Step 1. Review the pre-filled values:
* **Tenant ID**
* **Service Principal App ID** (Client ID)
* **Client Secret**
Click **Connect**. Yasu will validate the connection and, once confirmed, automatically advance to the **Invite Members** step.
Yasu will automatically verify your connection:
* ✅ **Authentication test** - Verifies Service Principal credentials
* ✅ **Permission check** - Confirms required roles are assigned
This typically takes **10-30 seconds**. If validation fails, check your credentials and ensure role assignments have propagated (wait 5 minutes after assigning roles).
Once verified, the dialog will close and you'll see:
* ✅ **Azure connection**: Active
* ✅ **Onboarding progress**: Automatically advances to the next step
Your first cost-saving insights will appear within **5-10 minutes** after connection.
## Manual Setup via Azure Portal
If you prefer to set up the Service Principal manually through the Azure Portal:
1. Navigate to **Azure Portal** → **Microsoft Entra ID** (Azure Active Directory)
2. Go to **App registrations** → **+ New registration**
3. Set **Name**: `yasu-cost-optimizer-{your-account-id}`
4. Select **Accounts in this organizational directory only**
5. Click **Register**
6. **Copy the following values** (you'll need them later):
* **Application (client) ID**
* **Directory (tenant) ID**
1. In the app registration, go to **Certificates & secrets**
2. Click **+ New client secret**
3. Enter a **Description**: `Yasu Access Key`
4. Select **Expires**: Choose **24 months** (recommended)
5. Click **Add**
6. **Copy the secret Value immediately** - it won't be shown again
**Important:** If this secret expires, you'll need to create a new one and update it in Yasu before expiration. Set a reminder for 30 days before expiration.
The Service Principal needs the following roles at the **Subscription** scope:
1. Navigate to **Subscriptions** → Select your subscription
2. Go to **Access control (IAM)** → **+ Add** → **Add role assignment**
3. Assign each role one by one:
**Role 1: Reader**
* **Role**: Select **Reader**
* **Assign access to**: User, group, or service principal
* **Select members**: Search for and select your `yasu-cost-optimizer-*` app
* Click **Review + assign**
**Role 2: Cost Management Reader**
* Repeat the process with **Cost Management Reader** role
**Role 3: Monitoring Reader**
* Repeat the process with **Monitoring Reader** role
Role assignments may take up to 5 minutes to propagate. Wait a few minutes before testing the connection.
1. Return to the **Onboarding** page in Yasu
2. Click **Connect** next to Azure to open the connection dialog
3. Follow Steps 1-3 in the dialog:
* Create Service Principal using the provided Azure CLI command
* Assign roles using the provided commands (replace placeholders)
* Enter credentials: Tenant ID, Service Principal App ID, and Client Secret
4. Click **Connect Azure** to complete the connection
## What the Service Principal Needs
The Service Principal is granted the following **read-only** RBAC roles at the subscription scope:
| Role | Purpose | Permissions |
| -------------------------- | ------------------------------------ | ----------------------------------------------------------------- |
| **Reader** | Read all Azure resources | `*/read` |
| **Cost Management Reader** | Access cost and billing data | `Microsoft.Consumption/*/read`, `Microsoft.CostManagement/*/read` |
| **Advisor Reviews Reader** | Access Azure Advisor recommendations | `Microsoft.Advisor/*/read` |
## Troubleshooting
**Common causes:**
1. **Wrong tenant ID** - Verify you're using the correct Directory (tenant) ID
2. **Wrong client ID** - Check the Application (client) ID matches your app registration
3. **Wrong client secret** - The secret may have expired or been regenerated
4. **Secret expired** - Create a new client secret and update it in Yasu
**Solution:**
```powershell theme={null}
# Verify credentials work
az login --service-principal \
--username {client-id} \
--password {client-secret} \
--tenant {tenant-id}
# If failed, reset credentials
az ad app credential reset --id {client-id}
```
**What to check:**
1. **Missing role assignments** - Verify all three roles are assigned (Reader, Cost Management Reader, Advisor Reviews Reader)
2. **Role propagation delay** - Azure role assignments can take up to 5 minutes to propagate
3. **Wrong scope** - Ensure roles are assigned at the Subscription level, not Resource Group level
**Solution:**
```powershell theme={null}
# Check current role assignments
az role assignment list --assignee {client-id} --all
# Add missing role
az role assignment create \
--assignee {client-id} \
--role "Cost Management Reader" \
--scope "/subscriptions/{subscription-id}"
# Wait 5 minutes for propagation
```
**What to check:**
1. **Wrong subscription ID** - Verify the subscription ID is correct
2. **Service Principal not granted access** - The SP needs Reader role at subscription scope
3. **Subscription disabled** - Check subscription state in Azure Portal
**Solution:**
```powershell theme={null}
# List available subscriptions
az account list --output table
# Verify subscription exists and is enabled
az account show --subscription {subscription-id}
# Grant access to subscription
az role assignment create \
--assignee {client-id} \
--role "Reader" \
--scope "/subscriptions/{subscription-id}"
```
**What to check:**
1. **Cost Management API access** - Verify Cost Management Reader role is assigned at subscription scope
2. **Data delay** - Cost data may take 24-48 hours to appear after first connection
3. **Subscription billing** - Ensure the subscription has active billing and resources
4. **Role propagation** - Wait 5 minutes after assigning roles before testing the connection
**Solution:**
* Verify Cost Management Reader role is assigned at the subscription level
* Wait 24-48 hours for initial cost data sync
* Check that the subscription has incurred charges (not in free/trial period)
* For organization-wide cost visibility, consider using the MCA/EA/CSP setup guides
**What it means:** Too many API calls in a short time period.
**Solution:**
* Yasu automatically implements exponential backoff
* Large subscriptions may take longer to fully scan
* Wait for the full sync cycle (up to 6 hours for large subscriptions)
**What to do:**
1. Create a new client secret in Azure Portal (App Registration → Certificates & secrets)
2. Update the secret in Yasu before the old one expires:
* Go to **Settings** → **Integrations** → Your Azure connection
* Click **Update Client Secret** or **Retry connection**
* Enter the new secret value along with Tenant ID and Client ID
* Save changes
**Important:** Update the secret at least 30 days before expiration to avoid service interruption.
**What it means:** Cost data may take time to appear after connecting.
**Common causes:**
* Cost data typically takes 24-48 hours to appear after subscription creation
* Cost Management API may require additional time for first-time access
* Subscription may not have incurred any charges yet
**Solution:**
* Wait 24-48 hours after connecting for initial cost data sync
* Verify the subscription has active resources and billing activity
* Check that Cost Management Reader role is correctly assigned at subscription scope
* Ensure the subscription is not in a trial or free tier period
## Done!
That's it! You have successfully connected your Azure account to Yasu. Once verified, Yasu will start analyzing your Azure billing, resource usage, and performance metrics to provide optimization insights.
# Azure DevOps
Source: https://docs.yasu.cloud/guides/connect-azure-devops
Connect Azure DevOps to Yasu with a Personal Access Token so Yasu can post cloud cost-impact analysis on your pull requests
Connect **Azure DevOps** to Yasu with a **Personal Access Token (PAT)**. Yasu uses this token to register pull request webhooks (Service Hooks) on the repositories you select, and to post the cost-impact analysis back to each PR as a comment and a status check.
Comments and the status badge are authored by whichever user owns the PAT, so we recommend creating a dedicated **service-account user** (for example, `Yasu Bot`) rather than using a personal account.
For Microsoft's reference, see the [Azure DevOps personal access tokens docs](https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate).
## Prerequisites
Before you start, make sure:
* You use **Azure DevOps Services** (`https://dev.azure.com/your-org`).
* You can create (or already have) a user with access to the projects whose pull requests you want analyzed.
* That user can create a **Personal Access Token** in your organization.
By default, comments on your PRs appear under the name of the user who owns the PAT. Using a dedicated service-account user keeps Yasu's comments under a clear bot identity instead of a teammate's name.
## Permissions Yasu requests
Yasu asks for a PAT with the **minimum scopes** needed to analyze pull requests and post results. Create the token with exactly these four scopes:
| Scope | Access | Why Yasu needs it |
| ------------------------ | ------------ | ------------------------------------------------------------------------------- |
| **Code** | Read | Read the PR diff and the source files to estimate the cost impact of the change |
| **Code** | Status | Post the "Yasu cost analysis" status check on the pull request |
| **Pull Request Threads** | Read & write | Post the cost-impact comment and reply to `@yasu` mentions |
| **Project and Team** | Read | List the projects the user can access so you can pick repositories |
**What this token cannot do.** These scopes are read- and comment-only. A leaked PAT **cannot** push code, delete branches, force-merge or complete pull requests, change repository settings, or modify pipelines — it can only read code, post PR comments, and post the status check.
If your PAT screen doesn't show **Pull Request Threads** as its own checkbox, expand **Custom defined → Show all scopes**. As a fallback, **Code (Read & write)** plus **Code (Status)** also works.
## Steps
1. In Azure DevOps, open **Organization settings → Users**.
2. [Add a new user](https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/add-organization-users) with a display name like `Yasu Bot`.
3. Grant it access to the projects whose pull requests you want analyzed.
You can skip this step and use your own account, but PR comments will then appear under your name.
1. Sign in to Azure DevOps as the user that will own the token.
2. Click the **user-settings (gear) icon** in the top-right header and choose **Personal access tokens**.
3. Click **New Token** and set:
* **Name:** `Yasu`
* **Organization:** the organization you want to connect
* **Expiration:** choose a date that matches your security policy
* **Scopes:** select the four scopes from [Permissions Yasu requests](#permissions-yasu-requests)
4. Click **Create**.
5. Copy the token immediately and store it somewhere safe.
Azure DevOps shows the token value only once. If you lose it, create a new token.
1. In Yasu, go to **Integrations → Azure DevOps**.
2. Enter your **Organization URL** (`https://dev.azure.com/your-org`) and paste the **PAT**.
3. Click **Validate**, then **Connect**.
Yasu validates the token and lists the projects it can access.
1. Choose the projects and repositories you want Yasu to monitor.
2. Save the configuration.
Yasu registers the required pull request **Service Hooks** on those repositories so new and updated PRs are analyzed automatically.
1. Open a pull request in one of the selected repositories.
2. Wait for the webhook to reach Yasu.
3. Confirm that Yasu posts a **cost-impact comment** and a **status check**, and that the PR appears on the **PR Analysis** page in Yasu.
You can also mention `@yasu` in a PR comment to ask a follow-up question about the change.
## What Yasu does with this access
Once connected, Yasu:
* registers **Service Hooks** for pull request events on the repositories you selected;
* reads the **PR diff and affected files** to estimate the monthly cloud cost impact of the change;
* posts a **cost-impact comment** and a **status check** on the PR;
* responds to **`@yasu` mentions** in PR comments;
* shows every analyzed PR on the **PR Analysis** page in the Yasu dashboard.
Yasu never pushes code, completes or abandons pull requests, or changes repository or pipeline settings.
## Troubleshooting
Check that:
* the **Organization URL** is `https://dev.azure.com/your-org` (not a project or repo URL);
* the token has **not expired** or been revoked;
* the token was created for the **same organization** you entered;
* the token has the four scopes listed above (at minimum **Project and Team → Read** so Yasu can list projects).
Usually the token is missing a scope. Confirm:
* **Pull Request Threads → Read & write** (for the comment), and
* **Code → Status** (for the status check).
If **Pull Request Threads** isn't a separate checkbox, use **Code (Read & write)** plus **Code (Status)**. Recreate the token with the correct scopes, reconnect, and open or update the PR again.
Comments are authored by the user who owns the PAT. Create a dedicated service-account user (for example `Yasu Bot`), generate the PAT as that user, and reconnect so comments appear under the bot identity.
Yasu can only see projects the token owner can access. Grant the service-account user access to the project in **Organization settings → Users**, then reconnect or refresh the repository list.
# Bitbucket
Source: https://docs.yasu.cloud/guides/connect-bitbucket
Install the Yasu Forge app to get AI-powered PR cost analysis on your Bitbucket repositories
Connect **Bitbucket** to Yasu by installing the Yasu Forge app from the Atlassian Marketplace. Yasu analyzes pull requests for infrastructure cost impact and posts AI-powered review comments.
## Prerequisites
Before you start, make sure:
* You have **Admin** permission on the Bitbucket workspace where you want to install the app
* At least one repository contains Terraform, Pulumi, or other infrastructure-as-code files
## Steps
1. Log in to your Yasu dashboard at [app.yasu.cloud](https://app.yasu.cloud)
2. Go to **Settings** → **Integrations**
3. Click **Connect** next to Bitbucket
A new tab opens to the Atlassian Marketplace Forge install page.
1. Select the **workspace** you want to connect
2. Click **Install** to add the Yasu Forge app
3. Return to the Yasu tab when the installation is complete
The Forge app uses Atlassian's webtrigger architecture to securely communicate between Bitbucket and Yasu.
Back in Yasu, the page automatically detects the Forge app installation. When your workspace appears, click **Link Workspace** to complete the connection.
Detection typically takes 10–30 seconds. If it does not appear, click **Open Install Page Again** to verify the app was installed.
1. Browse the available repositories in your connected workspace
2. Click **Add** on the repositories you want Yasu to analyze
3. Click **Save Configuration**
Yasu will begin monitoring pull requests on the selected repositories.
1. Open or update a pull request that modifies infrastructure code in one of the selected repositories
2. Wait for the Yasu webhook to fire
3. Confirm the cost analysis comment appears on the PR
PR analysis comments typically appear within **1–2 minutes** of opening or updating a pull request.
## Troubleshooting
**Common causes:**
* A popup blocker is preventing the new tab from opening
* You do not have **Admin** permission on the Bitbucket workspace
**Solution:**
Allow popups for app.yasu.cloud in your browser settings. If you lack permissions, ask a workspace admin to install the app.
**Common causes:**
* The app was installed into a different workspace than expected
* The installation did not complete successfully
**Solution:**
Verify the app is listed in **Bitbucket** → **Workspace settings** → **Installed apps**. If it is not there, click **Connect** in Yasu again to restart the installation flow.
**What to check:**
1. Verify the repository is selected in Yasu's integration settings
2. Confirm the pull request modifies infrastructure-as-code files (Terraform, Pulumi, CloudFormation, etc.)
3. Check that the Forge app is listed as installed in your Bitbucket workspace settings
If the issue persists, disconnect and reconnect the Bitbucket integration from **Settings** → **Integrations**.
# GCP
Source: https://docs.yasu.cloud/guides/connect-gcp
Complete guide to connect your Google Cloud Platform account to Yasu for cost analysis and optimization
Connect your **GCP account** to Yasu by granting access to Yasu's service account with the necessary permissions. This connection enables Yasu to analyze your cloud costs and provide optimization recommendations.
For more detailed instructions on creating and managing Service Accounts and IAM roles in GCP, refer to the [official GCP IAM Documentation](https://cloud.google.com/iam/docs/roles-overview).
## How the billing structure works in GCP
GCP can be confusing when it comes to billing. To make it a little more clear, you configure your billing export to send the billing data into a project. When you use multiple projects, all billing data will accumulate into one billing account (which exports again to a project → BigQuery).
```mermaid theme={null}
flowchart TD
BA[Billing Account] --> P1[Project 1]
BA --> P2[Project 2]
BA --> P3[Project 3]
BQ[BigQuery] <--> P1
BA -- "BigQuery export" --> P1
```
## Steps to Connect
Before starting the connection process, make sure you have the following information ready:
**Required:**
* **GCP Project ID** - The project ID that hosts your BigQuery billing export dataset
* Format: `my-project-id` (not the project number)
* For **Organization scope**, Yasu auto-discovers all projects in the organization
**Required for Cost Analysis:**
* **Billing Account ID** - Required for accurate cost calculations
* Format: `01ABCD-2EFGH3-456IJK`
* Found in: GCP Console → Billing
* Example: `029B0D-80B502-B17C09`
* **BigQuery Billing Export Dataset** - Required for detailed cost analysis
* Dataset name where billing export is stored
* Format: `billing_data` or `billing_export_dataset`
* This is the BigQuery dataset containing your daily cost data
**Important:** You don't need to create your own service account. Instead, you grant access to Yasu's service account: `yasu-connector@yasu-437610.iam.gserviceaccount.com`
GCP works with BigQuery to update its price logging every few times a day. To set this up, see the following documentation:
Official Google Cloud documentation
Or navigate to the [Google Cloud Console Billing page](https://console.cloud.google.com/billing/) and click on **Billing export**. On this page, you can enable the exporting.
Make sure billing export is enabled before proceeding to the next steps, as Yasu requires access to BigQuery billing data.
Yasu needs the following **read-only** roles to gather cost, usage, and resource information. The principle of least privilege applies, so attach only what is required.
**Service Account Email:** `yasu-connector@yasu-437610.iam.gserviceaccount.com`
#### Grant Project-Level Permissions
1. Go to **GCP Console** → **IAM & Admin** → **IAM**
2. Select the project you want to scan
3. Click **"+ GRANT ACCESS"** (or **"+ ADD"**)
4. Under **"New principals"**, add:
```
yasu-connector@yasu-437610.iam.gserviceaccount.com
```
5. Under **"Select a role"**, add these roles:
* ✅ **Viewer** (`roles/viewer`) - Basic read access to project resources (covers Compute, Cloud SQL, GKE, and Monitoring read permissions)
* ✅ **Browser** (`roles/browser`) - Read access to browse the project hierarchy
* ✅ **Storage Object Viewer** (`roles/storage.objectViewer`) - For storage scanning (not included in Viewer)
* ✅ **BigQuery Data Viewer** (`roles/bigquery.dataViewer`) - For BigQuery scanning
* ✅ **BigQuery Job User** (`roles/bigquery.jobUser`) - For running BigQuery billing queries
* ✅ **Recommender Viewer** (`roles/recommender.viewer`) - For GCP recommendations
* ✅ **Billing Account Viewer** (`roles/billing.viewer`) - For cost calculations
6. Click **"SAVE"**
#### Organization-Level Permissions (for org scope only)
If you selected **Organization scope** in Yasu, grant these **additional** roles at the **organization level** (not project level):
1. Go to **GCP Console** → **IAM & Admin** → **IAM**
2. Switch to your **Organization** (top of the page)
3. Click **"+ GRANT ACCESS"**
4. Add `yasu-connector@yasu-437610.iam.gserviceaccount.com`
5. Add the role:
* ✅ **Browser** (`roles/browser`) - Allows Yasu to discover all projects in your organization
For organization scope, you still need to grant the project-level roles above on **each project** you want scanned (or use [IAM policy inheritance](https://cloud.google.com/iam/docs/granting-changing-revoking-access) by granting them at the org/folder level).
If you have BigQuery billing export configured, you need to grant dataset-level permissions:
1. Go to **GCP Console** → **BigQuery**
2. Select the project that hosts your billing export dataset
3. In the **Explorer** panel, find your billing dataset
4. Click the **three dots (⋮)** next to the dataset name
5. Click **"Share dataset"**
6. Click **"+ ADD PRINCIPAL"**
7. Under **"New principals"**, add:
```
yasu-connector@yasu-437610.iam.gserviceaccount.com
```
8. Under **"Select a role"**, select:
* ✅ **BigQuery Data Viewer** (`roles/bigquery.dataViewer`)
9. Click **"ADD"**
**Important:** Repeat this for each dataset you want Yasu to access.
Your projects must meet these requirements before connecting:
* ✅ **Projects must be active** (not deleted or suspended)
* ✅ **Billing must be enabled** (for accurate cost calculations)
* ✅ **Projects should have resources** (empty projects will show 0 results)
1. In Yasu, navigate to **Settings** → **Cloud Accounts** → **Add GCP Account** and click **Connect**.
2. **Step 1 — Scope**: Select **Project** (single project) or **Organization** (all projects in an org). For organization scope, enter your Organization ID.
3. **Step 2 — Billing**: Enter your **Billing Account ID** and **BigQuery Dataset ID** (format: `project-id.dataset_name`).
4. **Step 3 — Connect**: Verify the required roles are granted to Yasu's service account, then click **Connect**.
Yasu will automatically verify:
* Service account has the required permissions
* Required APIs are enabled
* BigQuery dataset is accessible
* Billing information is available
## Verification Steps
After connecting, Yasu will perform the following checks:
1. **Service Account Access Validation**
* Verifies Yasu's service account has the expected roles
* Confirms access to your projects
* Verifies the correct JSON key or Workload Identity binding
2. **Data Collection**
* Begins collecting **Billing** data from BigQuery
* Starts monitoring **Resource** metrics
3. **Parsing Collected Data**
* The collected data will be converted into Yasu's internal format for cost optimization and recommendation generation
4. **Integration Status**
* You will see a **green checkmark** when the connection is successful
* Optimization recommendations will begin appearing after the initial sync (usually within a few minutes)
## Common Issues and Quick Fixes
**What it means:** An API we need is not enabled in your project.
**Fix:**
1. Go to **APIs & Services** → **Library**
2. Search for the API mentioned in the error
3. Click **"Enable"**
4. Wait 1-2 minutes
5. Try connecting again in Yasu
**What it means:** Yasu's service account doesn't have the required permissions.
**Fix:**
1. Go to **IAM & Admin** → **IAM**
2. Find `yasu-connector@yasu-437610.iam.gserviceaccount.com`
3. Make sure it has all the roles listed in Step 3 above
4. If missing, add the required role
5. Try connecting again
**What it means:** Yasu's service account can't access your BigQuery billing dataset.
**Fix:**
1. Go to **BigQuery** → Select your billing dataset
2. Click **three dots (⋮)** → **"Share dataset"**
3. Add `yasu-connector@yasu-437610.iam.gserviceaccount.com`
4. Grant **BigQuery Data Viewer** role
5. Click **"ADD"**
6. Try connecting again
**What it means:** Either:
* Your project has no resources (this is normal), OR
* Resources are in a different project
**Fix:**
* Verify you provided the correct project ID
* Check if resources exist in the project
* If resources exist but aren't found, contact support
## Security and Privacy
**Security Considerations**
* ✅ **Read-Only Access:** Yasu's service account only has read permissions - we cannot modify or delete your resources
* ✅ **Secure Access:** Access is controlled through IAM roles you grant
* ✅ **No Data Sharing:** We do not share your data with third parties
* ✅ **You Control Access:** You can revoke access at any time by removing IAM roles from Yasu's service account
* ✅ **All roles follow the principle of least privilege**
* ✅ **Key security:** Keep your service account key file in a safe location
* ✅ **All API calls** are logged in your Google Cloud Audit Logs
* ✅ **Data encryption** in transit (TLS 1.2+) and at rest (AES-256)
## Done!
That's it! You have successfully connected your GCP account to Yasu. Once verified, Yasu will start analyzing your GCP billing, resource usage, and performance metrics to provide optimization insights.
# GitHub
Source: https://docs.yasu.cloud/guides/connect-github
Install the Yasu GitHub App to get AI-powered PR cost analysis on your repositories
Connect **GitHub** to Yasu by installing the Yasu GitHub App. Yasu analyzes pull requests for infrastructure cost impact and posts AI-powered review comments directly on your PRs.
## Prerequisites
Before you start, make sure:
* You have **Owner** or admin permission on the GitHub organization where you want to install the app
* At least one repository contains Terraform, Pulumi, or other infrastructure-as-code files
## Steps
1. Log in to your Yasu dashboard at [app.yasu.cloud](https://app.yasu.cloud)
2. Go to **Settings** → **Integrations**
3. Click **Connect** next to GitHub
You will be redirected to the GitHub App installation page.
1. Select the **organization** you want to connect
2. Choose **All repositories** or select specific repositories
3. Click **Install**
Yasu requests only the permissions needed to read pull request diffs and post review comments. It does not access your source code beyond PR changes.
After installation, you are automatically redirected back to Yasu. The GitHub connection appears with status **Active**.
If the connection does not appear immediately, refresh the page. Yasu detects the installed app automatically.
1. In the connected GitHub card, browse your available repositories
2. Click **Add** on the repositories you want Yasu to analyze
3. Click **Save Configuration**
Yasu will begin monitoring pull requests on the selected repositories.
1. Open or update a pull request that modifies infrastructure code in one of the selected repositories
2. Wait for Yasu to analyze the changes
3. Confirm the cost analysis comment appears on the PR
PR analysis comments typically appear within **1–2 minutes** of opening or updating a pull request.
## Troubleshooting
**Common causes:**
* You do not have **Owner** or admin permission on the GitHub organization
* Your organization has restrictions on third-party GitHub App installations
**Solution:**
Ask an organization owner to install the app, or check **Settings** → **Third-party access** in your GitHub organization to allow the Yasu app.
**Common causes:**
* The callback from GitHub has not completed yet
* A network interruption occurred during the redirect
**Solution:**
Wait 1–2 minutes and refresh the page. If the connection is still pending, uninstall the app from **GitHub** → **Settings** → **Applications** and reinstall it from Yasu.
**What to check:**
1. Verify the repository is selected in Yasu's integration settings
2. Confirm the pull request modifies infrastructure-as-code files (Terraform, Pulumi, CloudFormation, etc.)
3. Check that the GitHub App has read/write permissions on pull requests
If the issue persists, disconnect and reconnect the GitHub integration from **Settings** → **Integrations**.
# GitLab
Source: https://docs.yasu.cloud/guides/connect-gitlab
Create a GitLab group access token and connect GitLab to Yasu for bot-authored merge request reviews
Connect **GitLab** to Yasu with a **group access token**. Yasu uses this token to create and maintain project webhooks and to post merge request reviews as the GitLab bot user that GitLab creates for the token.
For GitLab's official reference, see the [GitLab group access token docs](https://docs.gitlab.com/user/group/settings/group_access_tokens/).
## Prerequisites
Before you start, make sure:
* You have the **Owner** role on the GitLab group you want to connect.
* You know the **GitLab instance URL**:
* GitLab.com: `https://gitlab.com`
* Self-hosted GitLab: `https://gitlab.your-company.com`
* Your GitLab plan supports **group access tokens**:
* GitLab.com: **Premium** or **Ultimate**
* GitLab Self-Managed / Dedicated: **any license**
GitLab.com **Free** and GitLab.com **trial** do not support group access tokens. If you are on one of those plans, the Yasu GitLab bot connection will not work.
## What to create in GitLab
Yasu expects a **group access token** with:
* **Role:** `Maintainer`
* **Scope:** `api`
Why these settings:
* `Maintainer` lets Yasu manage project webhooks and post merge request notes.
* `api` gives Yasu the API access required to read merge requests, configure hooks, and publish bot-authored comments.
## Steps
1. Sign in to GitLab.
2. Open the **group** you want Yasu to manage.
3. Copy either:
* the **group path** such as `yasucloud`, or
* the **group ID**
You will enter that value later in Yasu as **Group Path or ID**.
1. In GitLab, open your group.
2. Go to **Settings** → **Access tokens**.
3. Click **Add new token**.
4. Fill in the token:
* **Token name:** `Yasu Bot`
* **Expiration date:** choose a date that matches your security policy
* **Role:** `Maintainer`
* **Scope:** `api`
5. Click **Create group access token**.
6. Copy the token immediately and store it somewhere safe.
GitLab only shows the token value once. If you lose it, create a new token.
1. In Yasu, go to **Settings** → **Integrations** → **GitLab**.
2. In **Add Bot Connection**, fill in:
* **GitLab Instance URL**
* **Display Label** (optional)
* **Group Path or ID**
* **Bot Access Token**
3. Click **Add Bot Connection**.
When the token is valid, Yasu stores the connection and loads the repositories available to that group bot.
1. In the connected GitLab card, search or browse the repositories in the group.
2. Click **Add** on the repositories you want Yasu to monitor.
3. Click **Save Configuration**.
Yasu will create or update the required GitLab project webhooks for those repositories.
1. Open or update a merge request in one of the selected repositories.
2. Wait for the webhook to reach Yasu.
3. Confirm that the review comment is posted by the **GitLab bot user**, not by a personal account.
## Self-hosted GitLab
For self-hosted GitLab, the setup is the same:
* use your own **instance URL**
* create the **group access token** in that GitLab instance
* paste it into Yasu
On GitLab Self-Managed and GitLab Dedicated, group access tokens are available with any license according to GitLab's docs.
## Troubleshooting
Possible causes:
* you are not a **Group Owner**
* your GitLab.com plan is **Free** or **trial**
* your top-level group disabled creation of group/project access tokens
Check GitLab's token restrictions here:
[Group access token restrictions](https://docs.gitlab.com/user/group/settings/group_access_tokens/).
Check the token settings:
* the token is a **group access token**, not a personal access token
* the token has the **api** scope
* the token has not expired or been revoked
* the **Group Path or ID** matches the group the token belongs to
Usually this means the token role is too weak or the selected repositories are outside the connected group.
Use:
* **Role:** `Maintainer`
* **Scope:** `api`
Then reconnect the group token and save the repository configuration again.
# Jira
Source: https://docs.yasu.cloud/guides/connect-jira
Export cost-saving insights as Jira issues with one click
Connect **Jira** to Yasu to export cost-saving insights directly as Jira issues. Yasu uses Atlassian OAuth 2.0 to securely connect to your Jira site, converting insights into well-formatted issues with remote links back to Yasu.
## Prerequisites
Before you start, make sure:
* You have a **Jira Cloud** site with permission to authorize third-party OAuth apps
* You have a **Jira project** where issues should be created
Jira Server (on-premise) is not supported. Yasu connects to Jira Cloud only.
## Steps
1. Log in to your Yasu dashboard at [app.yasu.cloud](https://app.yasu.cloud)
2. Go to **Settings** → **Integrations**
3. Click **Connect** next to Jira
You will be redirected to the Atlassian OAuth consent screen.
1. Review the requested permissions
2. Click **Accept**
Yasu requests only the scopes needed to create issues and add remote links. It does not access other Atlassian products.
If you have access to multiple Atlassian sites, select the Jira site you want to connect. You will be automatically redirected back to Yasu.
After authorization, configure your default export settings:
* **Project** — The Jira project where issues will be created
* **Issue type** — Default issue type (e.g., Task, Story, Bug)
* **Priority** — Default issue priority
These defaults apply when exporting insights. You can override them per issue.
1. Go to any cost-saving insight in your Yasu dashboard
2. Click the **Export to Jira** button
3. Review the issue details and adjust project or issue type if needed
4. Confirm the export
The issue appears in your Jira project within seconds, formatted in Atlassian Document Format with a remote link back to the insight in Yasu.
## Troubleshooting
**Common causes:**
* Your Atlassian site has admin-level restrictions on third-party OAuth apps
* You do not have permission to authorize apps on the site
**Solution:**
Check with your Atlassian admin to confirm third-party OAuth apps are allowed. If your site uses SSO, ensure your session is active before authorizing.
**Common causes:**
* You do not have access to any Jira Cloud sites
* You are trying to connect Jira Server (on-premise), which is not supported
**Solution:**
Verify you have an active Jira Cloud subscription at [admin.atlassian.com](https://admin.atlassian.com). Yasu only supports Jira Cloud.
**Common causes:**
* Complex markdown formatting does not always map perfectly to Atlassian Document Format (ADF)
* The issue type may not support rich text descriptions
**Solution:**
Use a standard issue type (Task or Story) that supports rich text. If specific formatting is lost, edit the issue description directly in Jira after export.
# Linear
Source: https://docs.yasu.cloud/guides/connect-linear
Connect your Linear workspace to export cost-saving insights as Linear issues
Connect **Linear** to Yasu to export cost-saving insights directly as Linear issues. Yasu uses OAuth to securely connect to your Linear workspace, letting you push optimization recommendations into your team's existing workflow with one click.
## Prerequisites
Before you start, make sure:
* You have a **Linear workspace** with permission to authorize third-party OAuth apps
* You have a **team and project** in Linear where issues should be created
## Steps
1. Log in to your Yasu dashboard at [app.yasu.cloud](https://app.yasu.cloud)
2. Go to **Settings** → **Integrations**
3. Click **Connect** next to Linear
You will be redirected to the Linear OAuth consent screen.
1. Review the requested permissions:
* **Read access** to your workspace
* **Write access** to your workspace
2. Click **Authorize**
3. You will be automatically redirected back to Yasu
Yasu automatically refreshes the OAuth token. You do not need to re-authorize unless you explicitly revoke access in Linear.
After authorization, configure your default export settings:
* **Team** — The Linear team where issues will be created
* **Project** — The default project for new issues
* **Priority** — Default issue priority
* **Assignee** — Default assignee for exported issues
These defaults apply when exporting insights. You can override them per issue.
1. Go to any cost-saving insight in your Yasu dashboard
2. Click the **Export to Linear** button
3. Review the issue details and adjust team, project, or assignee if needed
4. Confirm the export
The issue appears in your Linear team within seconds, linked back to the original insight in Yasu.
## Troubleshooting
**Common causes:**
* Your Linear workspace has restrictions on third-party OAuth apps
* You do not have permission to authorize apps in the workspace
**Solution:**
Check with your Linear workspace admin to confirm third-party OAuth apps are allowed. If your workspace uses SSO, ensure your session is active before authorizing.
**Common causes:**
* The OAuth token has not fully propagated yet
* The authorized user does not have access to the expected teams
**Solution:**
Refresh the page. If the lists remain empty, disconnect the integration from **Settings** → **Integrations** and reconnect.
**Common causes:**
* Default team, project, or priority are not configured
* The selected assignee is not a member of the target team
**Solution:**
Go to **Settings** → **Integrations** → **Linear** and verify all default fields are set. Ensure the assignee belongs to the selected team.
# SSO with Microsoft Entra ID
Source: https://docs.yasu.cloud/guides/sso-azure
Step-by-step guide to configure SAML SSO with Microsoft Entra ID (Azure AD) for your Yasu workspace
Configure SSO for your Yasu workspace using **Microsoft Entra ID** (formerly Azure AD) as your identity provider.
Before starting, complete the [generic SSO setup prerequisites](/guides/sso-setup#prerequisites) and have the SAML configuration values from Yasu's SSO page ready.
1. Sign in to the [Azure Portal](https://portal.azure.com)
2. Navigate to **Microsoft Entra ID** → **Enterprise Applications**
3. Click **New Application** → **Create your own application**
4. Select **"Integrate any other application you don't find in the gallery (Non-gallery)"**
5. Name the application (e.g., "Yasu") and click **Create**
1. In the application, go to **Single sign-on** → select **SAML**
2. Under **Basic SAML Configuration**, click **Edit**:
* **Identifier (Entity ID)** → paste the Entity ID from Yasu's SSO page
* **Reply URL (Assertion Consumer Service URL)** → paste the ACS URL from Yasu's SSO page
3. Click **Save**
The default attributes are typically pre-configured correctly:
| Claim name | Value |
| -------------- | ------------------ |
| `emailaddress` | `user.mail` |
| `givenname` | `user.givenname` |
| `surname` | `user.surname` |
| `name` | `user.displayname` |
**To add group claims (optional):**
1. Under **User Attributes & Claims**, click **Add a group claim**
2. Select the group types to include (e.g., "Security groups" or "All groups")
3. Save the configuration
Group claims are required if you want to use [role mapping](/guides/sso-setup#role-mapping) to automatically assign Yasu roles based on Entra ID group membership.
1. Under **SAML Certificates**, click **Download** next to **Federation Metadata XML**
2. In Yasu, go to **Integrations** → **SSO Configuration** and click **Configure SSO**
3. Select **Microsoft Entra ID** as the identity provider
4. Enter your company domain
5. Upload or paste the downloaded Federation Metadata XML
6. Click **Add Domain**
1. In Azure Portal, go to the application's **Users and groups** page
2. Click **Add user/group**
3. Select the users or groups that should have access
4. Click **Assign**
Users assigned to the application can now sign in to Yasu via SSO. New users will be automatically provisioned via [JIT provisioning](/guides/sso-setup#just-in-time-jit-provisioning).
## Attribute Mapping Reference
When configuring [attribute mapping](/guides/sso-setup#configure-attribute-mapping-optional) in Yasu for Microsoft Entra ID, use these values:
| Yasu field | Entra ID attribute |
| --------------------- | ---------------------------------------------------------------- |
| Name attribute | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` |
| Picture attribute | *(not available by default)* |
| Groups/role attribute | `http://schemas.microsoft.com/ws/2008/06/identity/claims/groups` |
These are auto-configured when you select **Microsoft Entra ID** as the identity provider during setup.
# SSO with Google Workspace
Source: https://docs.yasu.cloud/guides/sso-google
Step-by-step guide to configure SAML SSO with Google Workspace for your Yasu workspace
Configure SSO for your Yasu workspace using **Google Workspace** as your identity provider.
Before starting, complete the [generic SSO setup prerequisites](/guides/sso-setup#prerequisites) and have the SAML configuration values from Yasu's SSO page ready.
1. Sign in to [Google Admin Console](https://admin.google.com)
2. Navigate to **Apps** → **Web and Mobile Apps**
3. Click **Add App** → **Add custom SAML app**
4. Enter an app name (e.g., "Yasu") and optionally upload a logo
5. Click **Continue**
On the **Google Identity Provider details** screen (step 2 of the wizard):
1. Click **Download Metadata** to save the IdP metadata XML file
2. Keep this file — you'll need it when configuring Yasu
3. Click **Continue**
Download the metadata now — you cannot retrieve it later without starting over.
1. **ACS URL** → paste the ACS URL from Yasu's SSO page
2. **Entity ID** → paste the Entity ID from Yasu's SSO page
3. **Name ID format** → select **EMAIL**
4. **Name ID** → select **Basic Information > Primary email**
5. Click **Continue**
Set up attribute mapping as follows:
| Google Directory attribute | App attribute |
| --------------------------------- | ------------- |
| Basic Information > Primary email | `email` |
| Basic Information > First name | `firstName` |
| Basic Information > Last name | `lastName` |
Optionally, add group membership:
1. Click **Add mapping** under **Group membership**
2. Select the groups to include
3. Set the app attribute name to `groups`
Group membership mapping is required if you want to use [role mapping](/guides/sso-setup#role-mapping) to automatically assign Yasu roles based on Google Workspace groups.
Click **Finish**.
1. On the app details page, go to **User access**
2. Select the organizational units that should have access
3. Set **Service status** to **ON for everyone** (or selected OUs)
4. Click **Save**
1. In Yasu, go to **Integrations** → **SSO Configuration** and click **Configure SSO**
2. Select **Google Workspace** as the identity provider
3. Enter your company domain
4. Upload or paste the metadata XML you downloaded in Step 2
5. Click **Add Domain**
Users in the enabled organizational units can now sign in to Yasu via SSO. New users will be automatically provisioned via [JIT provisioning](/guides/sso-setup#just-in-time-jit-provisioning).
## Attribute Mapping Reference
When configuring [attribute mapping](/guides/sso-setup#configure-attribute-mapping-optional) in Yasu for Google Workspace, use these values:
| Yasu field | Google attribute |
| --------------------- | ---------------- |
| Name attribute | `name` |
| Picture attribute | `picture` |
| Groups/role attribute | `groups` |
These are auto-configured when you select **Google Workspace** as the identity provider during setup.
# SSO with Okta
Source: https://docs.yasu.cloud/guides/sso-okta
Step-by-step guide to configure SAML SSO with Okta for your Yasu workspace
Configure SSO for your Yasu workspace using **Okta** as your identity provider.
Before starting, complete the [generic SSO setup prerequisites](/guides/sso-setup#prerequisites) and have the SAML configuration values from Yasu's SSO page ready.
1. Sign in to the [Okta Admin Console](https://admin.okta.com)
2. Go to **Applications** → **Applications** → **Create App Integration**
3. Select **SAML 2.0** and click **Next**
4. Name the application (e.g., "Yasu") and click **Next**
1. **Single sign-on URL** → paste the ACS URL from Yasu's SSO page
2. **Audience URI (SP Entity ID)** → paste the Entity ID from Yasu's SSO page
3. **Name ID format** → select **EmailAddress**
4. **Application username** → select **Email**
Under **Attribute Statements (Optional)**, add:
| Name | Value |
| ------------- | ------------------ |
| `email` | `user.email` |
| `FirstName` | `user.firstName` |
| `LastName` | `user.lastName` |
| `displayName` | `user.displayName` |
Under **Group Attribute Statements (Optional)**, add:
| Name | Filter | Value |
| -------- | ------------- | ----- |
| `groups` | Matches regex | `.*` |
This sends all group memberships. You can use a more specific filter to limit which groups are sent. Group attribute statements are required if you want to use [role mapping](/guides/sso-setup#role-mapping).
Click **Next**, then select your feedback option and click **Finish**.
1. On the application page, go to the **Sign On** tab
2. Under **SAML Signing Certificates**, click **Actions** → **View IdP metadata**
3. Copy all the XML content (or right-click and save)
4. In Yasu, go to **Integrations** → **SSO Configuration** and click **Configure SSO**
5. Select **Okta** as the identity provider
6. Enter your company domain
7. Paste the metadata XML
8. Click **Add Domain**
1. Go to the **Assignments** tab of the Okta application
2. Click **Assign** → **Assign to People** or **Assign to Groups**
3. Select the users or groups and click **Assign** → **Done**
Assigned users can now sign in to Yasu via SSO. New users will be automatically provisioned via [JIT provisioning](/guides/sso-setup#just-in-time-jit-provisioning).
## Attribute Mapping Reference
When configuring [attribute mapping](/guides/sso-setup#configure-attribute-mapping-optional) in Yasu for Okta, use these values:
| Yasu field | Okta attribute |
| --------------------- | -------------- |
| Name attribute | `displayName` |
| Picture attribute | `profileUrl` |
| Groups/role attribute | `groups` |
These are auto-configured when you select **Okta** as the identity provider during setup.
# SSO with OneLogin
Source: https://docs.yasu.cloud/guides/sso-onelogin
Step-by-step guide to configure SAML SSO with OneLogin for your Yasu workspace
Configure SSO for your Yasu workspace using **OneLogin** as your identity provider.
Before starting, complete the [generic SSO setup prerequisites](/guides/sso-setup#prerequisites) and have the SAML configuration values from Yasu's SSO page ready.
1. Sign in to the [OneLogin Admin Portal](https://app.onelogin.com/admin)
2. Go to **Applications** → **Applications** → **Add App**
3. Search for **SAML Custom Connector (Advanced)** and select it
4. Name the application (e.g., "Yasu") and click **Save**
1. Go to the **Configuration** tab
2. Set the following fields:
* **Audience (EntityID)** → paste the Entity ID from Yasu's SSO page
* **ACS (Consumer) URL Validator** → paste the ACS URL from Yasu's SSO page (escape dots with `\.`)
* **ACS (Consumer) URL** → paste the ACS URL from Yasu's SSO page
3. **SAML nameID format** → select **Email**
4. Click **Save**
Go to the **Parameters** tab and add the following fields (click the **+** to add each):
| Field name | Value | Include in SAML assertion |
| ------------- | ---------------------- | ------------------------- |
| `email` | Email | ✅ |
| `name` | First Name + Last Name | ✅ |
| `displayName` | User.DisplayName | ✅ |
| `memberOf` | MemberOf | ✅ |
The `memberOf` parameter sends group memberships in the SAML assertion. This is required if you want to use [role mapping](/guides/sso-setup#role-mapping). Ensure that the users are assigned to the relevant groups in OneLogin under **Users** → **Groups**.
Click **Save** after adding all parameters.
1. Go to the **More Actions** dropdown (top-right) → **SAML Metadata**
2. This downloads the metadata XML file
3. In Yasu, go to **Integrations** → **SSO Configuration** and click **Configure SSO**
4. Select **OneLogin** as the identity provider
5. Enter your company domain
6. Paste or upload the metadata XML
7. Click **Add Domain**
1. Go to the **Users** tab of the OneLogin application
2. Use **Roles** or individual assignment to grant access:
* Via **Roles**: Go to **Users** → **Roles**, create or edit a role, and add the Yasu app to it
* Via **Users**: Go to **Users** → **Users**, select a user, go to **Applications**, and click **+** to assign the Yasu app
3. Click **Save**
Assigned users can now sign in to Yasu via SSO. New users will be automatically provisioned via [JIT provisioning](/guides/sso-setup#just-in-time-jit-provisioning).
## Attribute Mapping Reference
When configuring [attribute mapping](/guides/sso-setup#configure-attribute-mapping-optional) in Yasu for OneLogin, use these values:
| Yasu field | OneLogin attribute |
| --------------------- | ------------------ |
| Name attribute | `User.DisplayName` |
| Picture attribute | `User.PhotoURL` |
| Groups/role attribute | `memberOf` |
These are auto-configured when you select **OneLogin** as the identity provider during setup.
# SSO Setup Guide
Source: https://docs.yasu.cloud/guides/sso-setup
Configure SAML Single Sign-On for your Yasu workspace so team members can authenticate using your organization's identity provider
Yasu supports SAML 2.0 Single Sign-On (SSO), allowing your team members to sign in using your organization's identity provider (IdP) — such as Okta, Microsoft Entra ID, Google Workspace, or OneLogin.
Users sign in with their corporate credentials
New users are automatically added to your workspace on first SSO sign-in
Name and profile picture are synced from your IdP on each login
Automatically assign Yasu roles based on IdP group membership
## Prerequisites
Before configuring SSO, ensure you have:
* A Yasu workspace with a subscription plan that includes SSO
* **Admin or Owner** access to the Yasu workspace
* **Admin access** to your identity provider (Okta, Azure AD, Google Workspace, etc.)
## Generic Setup (Any SAML 2.0 Provider)
This guide works with any SAML 2.0 compatible identity provider.
1. Sign in to Yasu and navigate to your workspace
2. Go to **Integrations** → **SSO Configuration**
3. Copy the three SAML configuration values displayed on the page:
* **Entity ID / Issuer** — The unique identifier for Yasu as a service provider
* **ACS URL (Assertion Consumer Service)** — Where your IdP sends the SAML response after authentication
* **NameID Format** — `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`
1. In your identity provider's admin console, create a new SAML 2.0 application
2. Configure the following settings:
* **ACS URL / Reply URL / Single Sign-On URL** → paste the ACS URL from Step 1
* **Entity ID / Audience URI / Identifier** → paste the Entity ID from Step 1
* **NameID Format** → set to `emailAddress`
3. Configure attribute statements to send:
* `email` — the user's email address (required)
* `name` or `displayName` — the user's full name (recommended)
* `groups` or `memberOf` — group memberships (optional, for role mapping)
After saving the SAML application configuration in your IdP, download the **IdP Metadata XML** file. This XML file contains your IdP's certificate, SSO endpoint, and entity ID.
1. On the SSO Configuration page, click **Configure SSO**
2. In the setup dialog:
* **Identity Provider** — Select your IdP from the dropdown (Okta, Microsoft Entra ID, Google Workspace, OneLogin, or Custom)
* **Company Domain** — Enter the email domain for SSO authentication (e.g., `company.com`). Users with this email domain will be redirected to your IdP.
* **SAML Metadata XML** — Upload the XML file or paste the metadata content directly
3. The metadata is validated automatically — look for the green "Metadata Valid" indicator with the detected Entity ID
4. Click **Add Domain** to save
Expand the configured provider to access attribute mapping settings:
1. **Name attribute** — The SAML attribute name that contains the user's display name (e.g., `displayName`, `name`)
2. **Picture attribute** — The SAML attribute name that contains the user's avatar URL (e.g., `photoUrl`, `picture`)
3. **Groups/role attribute** — The SAML attribute name that contains group memberships (e.g., `groups`, `memberOf`)
4. Click **Save Attribute Mapping**
When you select a known IdP (Okta, Azure, Google, OneLogin) during setup, attribute mappings are auto-configured with sensible defaults. You only need to adjust these if your IdP uses non-standard attribute names.
Role mapping lets you automatically assign Yasu roles based on IdP group values:
1. In the **Role Mapping** section of the expanded provider
2. Enter the **IdP group value** — the exact group name as sent by your IdP (e.g., `Engineering`, `Admins`)
3. Select the **Yasu role** — either **Member** or **Owner**
4. Click **Add**
5. Repeat for additional group-to-role mappings
When a user signs in via SSO, Yasu checks their groups attribute against these mappings and assigns the corresponding role. Primary account owners cannot be downgraded via role mapping.
## Provider-Specific Guides
Follow the step-by-step guide for your identity provider:
Configure SSO with Azure AD / Entra ID
Configure SSO with Google Workspace
Configure SSO with Okta
Configure SSO with OneLogin
For other SAML 2.0 providers (JumpCloud, Ping Identity, etc.), follow the [Generic Setup](#generic-setup-any-saml-20-provider) guide above.
## Role Mapping
Role mapping allows you to automatically assign Yasu workspace roles based on group memberships from your identity provider.
### How it works
1. When a user signs in via SSO, Yasu reads the **groups attribute** from the SAML assertion
2. The attribute name is configurable (default: `groups`, `memberOf`, etc.) via attribute mapping
3. Yasu checks the group value against your configured role mappings
4. If a match is found, the user's role is updated accordingly
### Setting up role mapping
1. Navigate to **Integrations** → **SSO Configuration**
2. Expand the configured SSO provider
3. First, ensure the **Groups/role attribute** is set correctly in the Attribute Mapping section
4. In the **Role Mapping** section:
* Enter the IdP group value exactly as your IdP sends it (case-sensitive)
* Select the Yasu role (**Member** or **Owner**)
* Click **Add**
### Example mappings
| IdP group value | Yasu role | Description |
| ----------------- | --------- | ---------------------------------- |
| `Engineering` | Member | All engineers get member access |
| `Platform-Admins` | Owner | Platform admins get owner access |
| `FinOps-Team` | Owner | FinOps team leads get owner access |
**Important notes:**
* **Primary owners are protected** — The primary account owner's role cannot be downgraded via role mapping
* **First match wins** — If a user belongs to multiple groups with different role mappings, the role is determined by the first matching group
* **No match = no change** — If none of the user's groups match a mapping, their existing role is preserved
* **Case-sensitive** — Group values must match exactly as sent by your IdP
## Just-In-Time (JIT) Provisioning
JIT provisioning automatically adds new users to your Yasu workspace when they first sign in via SSO.
### How it works
1. A user with an email matching your SSO domain signs in through your identity provider
2. After successful authentication, Yasu checks if the user already has a membership in your workspace
3. If not, Yasu automatically:
* Creates a membership with the **Member** role (unless role mapping assigns a different role)
* Syncs the user's profile (name, picture) from the IdP
* Redirects the user to the workspace
**What admins need to know:**
* **No manual invitations needed** — Any user who authenticates through your IdP is automatically provisioned
* **Control access at the IdP** — To prevent someone from accessing Yasu, remove them from the SAML application in your IdP
* **Existing users are linked** — If a user already signed up with Google OAuth or email/password and then signs in via SSO, their accounts are automatically merged
* **Billing impact** — JIT provisioning may increase your seat count if you're on a per-seat plan
## Troubleshooting
**Cause:** The uploaded/pasted content is not valid SAML metadata XML.
**Solution:**
* Ensure you downloaded the **IdP Metadata XML** (not a certificate or other file)
* Open the XML file in a text editor and verify it starts with `` element
* For Azure: download the **Federation Metadata XML**, not the certificate
* For Okta: use **View IdP metadata** from the Sign On tab
* For Google: download metadata from step 2 of the SAML app wizard
**Cause:** The user's email domain doesn't match the configured SSO domain, or JIT provisioning failed.
**Solution:**
* Verify the **Company Domain** in Yasu matches the user's email domain exactly
* Check that the user is assigned to the SAML application in your IdP
* Ensure the SAML assertion includes a valid email in the NameID
**Cause:** Attribute mapping or role mapping is misconfigured.
**Solution:**
* Verify the **Groups/role attribute** name in Attribute Mapping matches what your IdP actually sends
* Check that the **IdP group value** in Role Mapping exactly matches the group name (case-sensitive)
* In your IdP, verify that group claims are included in the SAML assertion
* For Azure: ensure you added a group claim under User Attributes & Claims
* For Okta: ensure you configured Group Attribute Statements
* For Google: ensure you added group membership mapping
**Cause:** A provider for this domain is already configured.
**Solution:** Delete the existing provider first, then reconfigure. Note that deleting a provider will revoke access for SSO-only users.
**Expected behavior.** When an SSO provider is deleted:
* Users who only authenticated via SSO are removed from the workspace
* Users who also have other sign-in methods (email/password, Google OAuth) retain access
* The primary account owner is never removed
**Cause:** Attribute mapping may not match your IdP's attribute names.
**Solution:**
* Check the **Name attribute** and **Picture attribute** in Attribute Mapping
* Common attribute names by provider:
* **Okta:** `displayName`, `profileUrl`
* **Azure:** `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name`
* **Google:** `name`, `picture`
* **OneLogin:** `User.DisplayName`
**Cause:** Misconfigured ACS URL or Entity ID in your IdP.
**Solution:**
* Double-check that the **ACS URL** and **Entity ID** in your IdP exactly match the values shown on Yasu's SSO page
* Ensure the SAML application is active/enabled in your IdP
* Check that the signing certificate has not expired
# .yasuignore File
Source: https://docs.yasu.cloud/guides/yasuignore
Exclude files and directories from Yasu's PR cost analysis using a .yasuignore file
Control which files Yasu analyzes in your infrastructure-as-code repositories by adding a `.yasuignore` file. This lets you exclude specific Terraform files or directories from cost analysis and PR reports.
## Overview
When the Yasu agent analyzes a pull request, it scans for Terraform files (`.tf` and `.tfvars`) to estimate cost impacts. In some cases, you may want to exclude certain files — for example, development environment overrides, sandbox configurations, or test fixtures that don't represent real infrastructure costs.
The `.yasuignore` file works similarly to `.gitignore`: you define glob patterns, and any matching files are skipped during analysis.
## Setup
Add a `.yasuignore` file to the **root** of your repository:
```bash theme={null}
touch .yasuignore
```
Open the file and add patterns for files or directories you want to exclude:
```text theme={null}
# Ignore all .tfvars files
*.tfvars
# Ignore dev environment
environments/dev/**
```
```bash theme={null}
git add .yasuignore
git commit -m "Add .yasuignore to exclude files from cost analysis"
git push
```
The `.yasuignore` file only needs to be committed once to your default branch (e.g. `main`). It will automatically apply to all future PR analyses.
## Pattern Syntax
The `.yasuignore` file supports standard glob patterns:
| Pattern | Description |
| ----------------------- | ------------------------------------------------- |
| `*.tfvars` | Ignore all `.tfvars` files in any directory |
| `backend.tf` | Ignore a specific file by name |
| `environments/dev/**` | Ignore everything in a directory |
| `environments/dev/*.tf` | Ignore `.tf` files in a specific directory |
| `**/test/**` | Ignore files in any `test` directory at any depth |
| `modules/legacy/**` | Ignore an entire module directory |
### Comments and blank lines
Lines starting with `#` are treated as comments. Blank lines are ignored.
```text theme={null}
# This is a comment
*.tfvars
# Sandbox environments
sandbox/**
environments/dev/**
```
## Examples
### Ignore variable override files
```text theme={null}
# Variable overrides often contain dev-specific values
# that inflate cost estimates
*.tfvars
*.tfvars.json
```
### Ignore non-production environments
```text theme={null}
# Only analyze production infrastructure costs
environments/dev/**
environments/staging/**
environments/sandbox/**
```
### Ignore legacy or deprecated modules
```text theme={null}
# These modules are being decommissioned
modules/legacy-vpc/**
modules/deprecated-*/**
```
### Ignore test fixtures
```text theme={null}
# Test terraform files used in CI
**/test/**
**/tests/**
**/fixtures/**
```
## How It Works
When a pull request is opened or updated:
1. Yasu checks for a `.yasuignore` file in the repository
2. If found, the patterns are parsed and applied to filter out matching files
3. Filtered files are excluded from:
* The PR diff analysis
* Infracost cost estimation
* The generated cost report posted as a PR comment
Files excluded by `.yasuignore` will not appear in Yasu's PR cost report at all — they are completely skipped from the analysis pipeline.
## Supported Platforms
The `.yasuignore` file works with both supported Git providers:
* **GitHub** — The file is fetched directly via the GitHub API
* **Bitbucket** — The file is fetched via the Yasu Bitbucket Forge app
## Troubleshooting
Ensure the file is:
* Named exactly `.yasuignore` (note the leading dot)
* Located at the **root** of the repository (not in a subdirectory)
* Committed to the repository (not just a local file)
* Present on the default branch (`main` or `master`)
Patterns use glob syntax with `matchBase` enabled, meaning:
* `*.tfvars` matches `terraform.tfvars` and also `environments/dev/vars.tfvars`
* For directory-specific matching, use full paths like `environments/dev/*.tf`
* Use `**` for recursive matching across nested directories
Comment out all patterns with `#` or rename the file. The analysis will process all files as usual when no valid patterns are found.
# Welcome to Yasu
Source: https://docs.yasu.cloud/index
The AI-powered cloud cost optimization platform that helps you cut cloud spending by 30-40%
**Build Fearlessly. Your AI Co-pilot Has The Costs Covered.**
Companies lose **30% of their cloud budget** to invisible waste—that's 6-8 months of runway for startups. Yasu uncovers and blocks this waste using AI agents that work 24/7.
## What You'll Find in These Docs
This documentation covers everything you need to get started with Yasu and maximize your cloud cost savings:
* **Getting Started** — Connect your cloud accounts and start receiving insights in minutes
* **Dashboard & Insights** — Understanding your cost data and AI-powered recommendations
* **Shift-Left Cost Prevention** — Catch expensive mistakes before they reach production
* **Integrations** — Connect Yasu to GitHub, Slack, and your CI/CD pipelines
* **API Reference** — Build custom workflows with the Yasu API
Connect your first cloud account and start saving in under 5 minutes.
## What Yasu Does
Yasu is an **AI-powered FinOps platform** that provides complete visibility into your cloud costs across AWS, Azure, and GCP—all in one unified dashboard.
Our platform tracks and optimizes three core areas:
* **Cost Visibility** — Real-time spending data, forecasts, and service-level breakdowns
* **AI-Powered Insights** — Automated recommendations with estimated savings for each optimization
* **Shift-Left Prevention** — Cost gates and PR integration to prevent expensive mistakes before deployment
**Why Shift-Left?** Catching a costly misconfiguration during code review is **10x cheaper** than fixing it in production. Yasu integrates directly into your development workflow.
## How Yasu Works
Yasu connects to your cloud accounts via secure, read-only access and continuously analyzes your infrastructure for optimization opportunities.
**Autonomous AI Agents** — Unlike static rule-based tools, Yasu uses self-learning AI agents that understand your business context and make intelligent cost-saving recommendations.
**Multi-Cloud Unified View** — Whether you're on AWS, Azure, GCP, or all three, Yasu consolidates your costs into a single dashboard with consistent metrics.
**Non-Disruptive Integration** — Yasu integrates seamlessly into your existing workflows through GitHub webhooks, Slack notifications, and CI/CD pipelines.
## How Yasu Helps
Get real-time cost feedback in your IDE and CI/CD. Understand the cost impact of your code before deployment.
Elevate your FinOps practice without expanding your team. Automate cost optimization at scale.
Improve gross margins, get accurate forecasting, and maximize ROI on cloud investments.
Monitor implemented savings with before/after comparisons and annual projections.
## Key Capabilities
* **Quick Wins** — Actionable insights with one-click implementation
* **Cost Gates** — Block expensive changes from reaching production
* **Budget Tracking** — Compare actual spend against planned budgets
* **Green Impact** — Track your carbon footprint reduction alongside cost savings
* **AI Copilot** — Talk to Yasu in plain English to get answers about your cloud costs
## Results Our Customers See
| Metric | Result |
| ---------------------------- | ---------- |
| Average Cost Savings | **31%** |
| Recommendation Adoption Rate | **70%+** |
| Engineering Hours Saved | **8,000+** |
| Cloud Costs Under Management | **\$70M+** |
Connect your cloud accounts and start optimizing in minutes.
# Quickstart
Source: https://docs.yasu.cloud/quickstart
Get started with Yasu and start saving on cloud costs in minutes
## Get started in five steps
Connect your cloud accounts and start receiving cost-saving insights right away.
Sign up for Yasu at [app.yasu.cloud/auth/sign-up](https://app.yasu.cloud/auth/sign-up).
You can sign up with your email or use Google/GitHub SSO for faster onboarding.
After signing up, you'll be prompted to create your first **workspace**. A workspace is where your team collaborates on cloud cost optimization.
Select your cloud provider to start analyzing your costs.
![]()
**Connect AWS via CloudFormation**
Click **Connect AWS** and you'll be redirected to AWS CloudFormation with our template pre-loaded.
![]()
1. Review the stack name and parameters (pre-filled for you)
2. Scroll to the bottom and check the acknowledgment box
3. Click **Create Stack**
Yasu uses **read-only access** to analyze your AWS costs and resources. We never make changes to your infrastructure.
**Verify the connection**
Once the CloudFormation stack completes, Yasu automatically detects the connection. You'll see the verification screen:
![]()
The CloudFormation template creates an IAM role with permissions to:
* Read Cost Explorer data
* List resources across services
* Access CloudWatch metrics
**Connect GCP via OAuth**
Click **Connect GCP** to start the OAuth flow.
![]()
1. Sign in with your Google account that has access to the GCP project
2. Select the project(s) you want to connect
3. Grant the required permissions
Yasu requests **read-only access** to your GCP billing and resource data. We never make changes to your infrastructure.
Yasu will request access to:
* Billing account data
* Project resource information
* Compute and storage metrics
**Connect Azure via Service Principal**
Click **Connect Azure** and follow the step-by-step dialog.
1. **Create a Service Principal** — Copy the Azure CLI command from the dialog and run it in Azure Cloud Shell
2. **Assign roles** — Run the three role assignment commands (Reader, Cost Management Reader, Advisor Reviews Reader)
3. **Enter credentials** — Paste your Tenant ID, App ID, and Client Secret into the dialog
Yasu uses a **read-only** Service Principal. We cannot modify, create, or delete any Azure resources.
The Service Principal is granted:
* **Reader** — Read access to subscription resources
* **Cost Management Reader** — Access to cost and billing data
* **Advisor Reviews Reader** — Access to Azure Advisor recommendations
For detailed instructions, see the [Azure connection guide](/guides/connect-azure).
After connecting your cloud account, configure which AI agents you want to activate. These agents continuously analyze your infrastructure for cost-saving opportunities.
![]()
Select the agents that match your optimization goals:
* **Cost Analyzer** — Identifies idle and underutilized resources
* **Right-Sizing Agent** — Recommends optimal instance sizes
* **Reserved Instance Advisor** — Finds RI and Savings Plan opportunities
You can enable or disable agents at any time from Settings.
Collaborate with your team by inviting members to your workspace.
![]()
Enter email addresses of team members you want to invite. They'll receive an invitation to join your Yasu workspace.
You can manage team members and permissions later from **Settings** → **Members**.
Once setup is complete, you'll land on your dashboard where cost-saving insights start appearing.
![]()
Your dashboard shows:
* **Current spend** — Real-time cloud cost tracking
* **Quick Wins** — AI-powered savings recommendations
* **Forecast** — Predicted costs for the coming month
* **Services breakdown** — Costs by cloud service
Most users see their first cost-saving recommendations within **5 minutes** of connecting.
## Next steps
Understand your cost breakdown and spending trends.
See AI-powered recommendations and implement savings.
Catch costly mistakes before they reach production.
Get notifications about savings opportunities in Slack.
**Need help?** Contact us at [support@yasu.cloud](mailto:support@yasu.cloud) or use the chat widget in the app.