# Connect to Oracle ## Oracle Integration Overview {% hint style="warning" %} **Note**: This topic covers a new capability that is currently in beta and will replace the existing topic in the future. If this functionality is not yet available in your account, contact Finout support at to enable it. {% endhint %} Integrating Finout with Oracle Cloud Infrastructure (OCI) allows you to ingest, analyze, and optimize your Oracle cloud costs within Finout. Once connected, you can track OCI usage, monitor spending trends, allocate costs across teams and cost centers, and gain full visibility into your Oracle environment alongside your other cloud providers. Finout supports two integration methods: * [**Console-Based Integration**](#console-based-integration) – Manual setup through the OCI Console. * [**CLI-Based Integration**](#cli-based-integration) – Automated setup using the Oracle CLI, recommended for faster onboarding and repeatable configuration. This guide walks you through both methods so you can choose the approach that best fits your organization’s security model and operational preferences. ## Console-Based Integration ### 1. Create a New Group for Finout Access permissions in Oracle are assigned to groups. Create a separate group for Finout to ensure access only to the necessary billing resources. 1. Go to the OCI navigation menu → **Identity & Security** → **Domains** → \ → **Groups** (in the right-hand menu). {% hint style="info" %} **Note**: If you choose to use a domain other than “Default” to set up the integration user make sure that both the user and group are contained in the same domain. {% endhint %}
2. Click **Create Group**.
3. Fill in the **Group Name** and add some **Description**.
4. Click **Create.** ### 2. Add a Policy to a Group Assign a policy to the group for accessing cost reports. In OCI, group permissions are managed through policies. By assigning a policy to the Finout group, you ensure that all its members can access only what the group policies allow. 1. Go to the OCI navigation menu → **Identity & Security** → **Policies**.
2. Click **Create policy**.
3. Choose a **name** for the policy that clearly indicates its purpose for accessing cost reports. 4. In the policy builder box at the bottom of the screen, activate the **Show manual editor** button and enter the following statements:

Note: Save your tenancy for step 5.

* Statement 1:

Important: The following statement is not an example. You need to run this statement exactly as it is shown below.

\ \&#xNAN;*`define tenancy usage-report as ocid1.tenancy.oc1..aaaaaaaaned4fkpkisbwjlr56u7cj63lf3wffbilvqknstgtvzub7vhqkggq`*\ This specifies the tenancy for usage reports, which is in a bucket owned by Oracle. * Statement 2:\ \&#xNAN;*`endorse group to read objects in tenancy usage-report`*\ Replace *``* with the name of the group created for Finout. If you want your own groups/users to access the cost reports as well, add another policy with the relevant *``*.

Examples:

  • If you chose the “Default” domain:
    endorse group default to read objects in tenancy usage-report
  • If you chose a custom domain named “finoutdomain”:
    endorse group finoutdomain/default to read objects in tenancy usage-report
5. Click **Create**.
### 3. Create a User for Finout 1. Go to the OCI navigation menu → **Identity & Security** → **Domains** → **Users**.
2. Click **Create User**.
3. Fill in the name and email of the Finout user. 4. Assign the user to the new Finout group you created in [step 1](#h_60fc961389) by selecting the appropriate box under the **Groups** section. {% hint style="info" %} **Note**: This setup ensures that a Finout user will have access only to the specified policies, specifically the cost reports bucket. It's important to avoid selecting the administrator option and instead choose only the group dedicated to Finout for proper access control. {% endhint %} 5. Click **Create**.

Note: You can Edit the user capabilities and limit to only API keys.

### 4. Generate an API Key Generate an API key to enable Finout users to access the reporting bucket via the Oracle API key. For detailed instructions, refer to the official Oracle documentation [here](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm#two). **Create an API key pair in the OCI console to enable API signing for the Finout user:** 1. Ensure an administrator user is logged into Oracle, as only administrators can perform these steps. 2. Navigate to **Identity & Security** → **Domains** → \ → **Users**, and click the Finout user to access their profile.
3. Navigate to the **Resources** section in the bottom left screen and select **API keys**.
4. Make sure that the **Paste a public key** pair is chosen.
5. Click **Download Private Key** and save the key in a local directory. 6. A configuration is displayed. Click on the copy button below the text box and paste it into a local file editor (save for step 5).

Note: The Oracle documentation offers alternative methods for generating the key. Ensure that you have the complete configuration details as outlined in the following step.

### 5. Generate a Public Key from Finout 1. In Finout, navigate to **Settings > Cost Centers** and click **Add cost center**.\ The **Connect Accounts** window appears.
2. In **Oracle Cloud**, click **Connect Now**.\ The **Select connection method** appears.
3. Select **Console**.\ You are brought to the **Connect to OCI** step.
4. Copy the **Public key** and return to Oracle. ### 6. Obtain the Configuration File Information
1. Click **Add API Key**.
2. **Paste the Public key** obtained from Finout in the previous step. 3. A configuration is displayed. Click on the copy button below the text box and paste it into a local file editor (save for the next step).
{% hint style="info" %} **Note**: The Oracle [documentation](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm#two) offers alternative methods for generating the key. Ensure that you have the complete configuration details as outlined in the following step. {% endhint %} ### 7. Integrate Oracle with Finout
1. Back in Finout, fill in the relevant fields from the "Configuration file preview" text box that you copied in the previous step.

Note: Finout generates the key pair for you. Finout securely stores the private key, and you receive the public key, which you can copy and paste into the OCI Console.

2. Click **Complete Integration**.\ The cost center is created. ## CLI-Based Integration {% hint style="info" %} **Note**: The CLI script is currently supported on macOS and Linux only. If you are using Windows, please follow the Oracle Console setup instead. {% endhint %} ### 1. Select Connection Method 1. In Finout, navigate to **Settings > Cost Centers** and click **Add cost center**.\ The **Connect Accounts** window appears.
2. In **Oracle Cloud**, click **Connect Now**.\ The **Select connection method** appears.
3. Click **CLI**.\ You are brought to the **Set Up CLI Parameters**. ### 2. Install and Authenticate the CLI 1. Install OCI command line as instructed in the [Oracle official docs](https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/cliinstall.htm). Skip this step if you already have the OCI command line installed. 2. Authenticate. You have two options: * Follow the authentication guide in the [Oracle official docs](https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/cliinstall.htm#configfile). * Authenticate using the browser by running `oci session authenticate`\

Note: Before running the authentication command, ensure that any existing OCI configuration files are removed, as they may have been left over from a prior integration run.

1. This will open a browser window in which you will need to authenticate. 2. Once authentication is complete, you will have a file named `rm -rf ~/.oci/config` containing all the necessary configuration, including a temporary authentication token. 3. Run a small test to see if you are authenticated: * oci --auth security\_token iam availability-domain list 4. Choose the domain 1. Print domains ``` OCI_TENANCY=$(awk -F'=' '/^tenancy/ { gsub(/ /, "", $2); print $2; exit }' ~/.oci/config) && \ oci iam domain list \ --compartment-id "$OCI_TENANCY" \ --all \ --auth security_token \ --query 'data[].{name:"display-name", id:id, url:url}' \ --output table ``` 2. Ensure that it looks like: ``` +--------------------------------------------------------------------------------+-------------+----------------------------------------------------------------------------+ | id | name | url | +--------------------------------------------------------------------------------+-------------+----------------------------------------------------------------------------+ | ocid1.domain.oc1..aaaaaaaaxnavpemxob22rbpw73f77kplggcozle5pppj6prsdznykjp2urbq | Default | https://idcs-d24ab4d562c6425398a8ddf963660fbf.identity.oraclecloud.com:443 | | ocid1.domain.oc1..aaaaaaaa46euetfik5sqk4zvnia7v6l2kpb3cgypzd4bmhpmwi2rvhqnztha | finout-cost | https://idcs-6bd3f87141924f1995523f8ec5662c67.identity.oraclecloud.com:443 | +--------------------------------------------------------------------------------+-------------+----------------------------------------------------------------------------+ ``` 3. Pick one and use it below as OCI\_DOMAIN\_NAME. 5. A key is generated: * The public key will be used as the value in FINOUT\_PUB\_KEY. * The private key will be saved when saving the credentials to the cost center to authenticate in the data pipelines. 6. Provide the input details as instructed previously, then run the script provided below. Once the execution is complete, please review the results and extract the necessary details from the output, as shown in the example format:
``` ----------------------- User ID: ocid1.user.oc1..aaaaaaaaj7xn352us5bj74ew4pfkkebfbtrsfkgnhbmbikofdprpdavzca4q API Key fingerprint: 6e:b5:43:46:aa:6e:6f:0d:50:68:f6:f2:a6:f0:4e:bb Tenancy: ocid1.tenancy.oc1..aaaaaaaalzf62oj3gqksyjc6jiee7na3m7ne7ebvecslrbk6xfhqgrlqbrka Region: us-ashburn-1 ----------------------- ``` 7. Fill the form. ### 3. Set Up CLI Parameters
1. In Finout, review and adjust the CLI parameters below, then run the generated script. 2. Update the editable fields at the top of the script: * FINOUT\_USERNAME - ask the user for the name of the user we will create for him. * Can only contain: A-Z, a-z, 0-9, hypen(\`-\`), period(\`.\`), underscore(\`\_\`), plus sign (+) and at sign (@) * FINOUT\_EMAIL - ask the user for the email for the user we will create for him * Make sure it’s a valid email * FINOUT\_FIRST\_NAME and FINOUT\_LAST\_NAME - same * GROUP - IAM group name they wish to create the use at: * Choose a group name, but it must consist of letters, numbers, dots, dashes, and underscores. * OCI\_POLICY\_NAME - Policy name they wish to create (this is the one that allows the group to read the OCI usage reports) * FINOUT\_PUB\_KEY- * Generate a pair of public/private keys, similar to those commands: * z - this creates a private key file * openssl rsa -pubout -in finout\_user\_private.pem -out finout\_user\_public.pem - this extracts the public key from the private key file.

Note: Group names may contain only letters, numbers, dots (.), dashes (-), and underscores (_).

3. Copy the generated script. Run this script in your terminal to set up the OCI integration. 4. Click **Next**. ### 4. Run the Script in the CLI 1. Copy and run the script below into a file called oci-setup.sh (this contains your own specific one-time public key in the script):\ `chmod +x oci-setup.sh`\ `./oci-setup.sh`\ \
This option uses a single CLI script to automatically create all required OCI resources, reducing setup time and minimizing configuration errors. **What the script does:** * Creates or reuses an IAM group * Creates or reuses a read-only IAM policy for cost and usage reports * Creates or reuses an IAM user in the selected identity domain * Adds the user to the group * Uploads the public API key provided by Finout * Outputs all required identifiers for Finout {% hint style="info" %} **Note**: If resources already exist, they will be reused. If not, they will be created. {% endhint %} 2. Copy the following values from the CLI script: * User ID * API Key Fingerprint * Tenancy * Region ### 5. Connect to OCI
1. Back in Finout, fill in the values from the CLI. 2. Click **Complete Integration**.\ The integration is completed. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.finout.io/billing-integrations/cloud-providers/connect-to-oracle.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.