Connect to Oracle (Beta)

Oracle Integration Overview

Note: This topic covers a new capability that is currently in beta and will replace the existing topic in the future. If this functionality is not yet available in your account, contact Finout support at [email protected] to enable it.

Integrating Finout with Oracle Cloud Infrastructure (OCI) allows you to ingest, analyze, and optimize your Oracle cloud costs within Finout. Once connected, you can track OCI usage, monitor spending trends, allocate costs across teams and cost centers, and gain full visibility into your Oracle environment alongside your other cloud providers.

Finout supports two integration methods:

• Console-Based Integration – Manual setup through the OCI Console.

• CLI-Based Integration – Automated setup using the Oracle CLI, recommended for faster onboarding and repeatable configuration.

This guide walks you through both methods so you can choose the approach that best fits your organization’s security model and operational preferences.

Console-Based Integration

1. Create a New Group for Finout

Access permissions in Oracle are assigned to groups. Create a separate group for Finout to ensure access only to the necessary billing resources.

1. Go to the OCI navigation menu → Identity & Security → Domains → <Finout domain> → Groups (in the right-hand menu).

Note: If you choose to use a domain other than “Default” to set up the integration user make sure that both the user and group are contained in the same domain.

1. Click Create Group.

1. Fill in the Group Name and add some Description.

1. Click Create.

2. Add a Policy to a Group

Assign a policy to the group for accessing cost reports. In OCI, group permissions are managed through policies. By assigning a policy to the Finout group, you ensure that all its members can access only what the group policies allow.

1. Go to the OCI navigation menu → Identity & Security → Policies.

   
2. Click Create policy.

3. Choose a name for the policy that clearly indicates its purpose for accessing cost reports.

4. In the policy builder box at the bottom of the screen, activate the Show manual editor button and enter the following statements:

   Note: Save your tenancy for step 5.

   • Statement 1:

     Important: The following statement is not an example. You need to run this statement exactly as it is shown below.

     define tenancy usage-report as ocid1.tenancy.oc1..aaaaaaaaned4fkpkisbwjlr56u7cj63lf3wffbilvqknstgtvzub7vhqkggq This specifies the tenancy for usage reports, which is in a bucket owned by Oracle.

   • Statement 2: endorse group <group name> to read objects in tenancy usage-report Replace <group name> with the name of the group created for Finout. If you want your own groups/users to access the cost reports as well, add another policy with the relevant <group name>.

     Examples:

     • If you chose the “Default” domain: endorse group default to read objects in tenancy usage-report

     • If you chose a custom domain named “finoutdomain”: endorse group finoutdomain/default to read objects in tenancy usage-report

5. Click Create.

   

3. Create a User for Finout

1. Go to the OCI navigation menu → Identity & Security → Domains → Users.

   
2. Click Create User.

   
3. Fill in the name and email of the Finout user.

4. Assign the user to the new Finout group you created in step 1 by selecting the appropriate box under the Groups section.

Note: This setup ensures that a Finout user will have access only to the specified policies, specifically the cost reports bucket. It's important to avoid selecting the administrator option and instead choose only the group dedicated to Finout for proper access control.

1. Click Create.

   Note: You can Edit the user capabilities and limit to only API keys.

4. Generate an API Key

Generate an API key to enable Finout users to access the reporting bucket via the Oracle API key.

For detailed instructions, refer to the official Oracle documentation here.

Create an API key pair in the OCI console to enable API signing for the Finout user:

1. Ensure an administrator user is logged into Oracle, as only administrators can perform these steps.

2. Navigate to Identity & Security → Domains → <Finout user domain> → Users, and click the Finout user to access their profile.

   
3. Navigate to the Resources section in the bottom left screen and select API keys.

   
4. Make sure that the Paste a public key pair is chosen.

   
5. Click Download Private Key and save the key in a local directory.

6. A configuration is displayed. Click on the copy button below the text box and paste it into a local file editor (save for step 5).

   Note: The Oracle documentation offers alternative methods for generating the key. Ensure that you have the complete configuration details as outlined in the following step.

5. Generate a Public Key from Finout

1. In Finout, navigate to Settings > Cost Centers and click Add cost center. The Connect Accounts window appears.

   
2. In Oracle Cloud, click Connect Now. The Select connection method appears.

   
3. Select Console. You are brought to the Connect to OCI step.

   

4. Copy the Public key and return to Oracle.

6. Obtain the Configuration File Information

1. Click Add API Key.

   
2. Paste the Public key obtained from Finout in the previous step.

3. A configuration is displayed. Click on the copy button below the text box and paste it into a local file editor (save for the next step).

   

Note: The Oracle documentation offers alternative methods for generating the key. Ensure that you have the complete configuration details as outlined in the following step.

7. Integrate Oracle with Finout

1. Back in Finout, fill in the relevant fields from the "Configuration file preview" text box that you copied in the previous step.

   Note: Finout generates the key pair for you. Finout securely stores the private key, and you receive the public key, which you can copy and paste into the OCI Console.

2. Click Complete Integration. The cost center is created.

CLI-Based Integration

Note: The CLI script is currently supported on macOS and Linux only. If you are using Windows, please follow the Oracle Console setup instead.

1. Select Connection Method

1. In Finout, navigate to Settings > Cost Centers and click Add cost center. The Connect Accounts window appears.

   
2. In Oracle Cloud, click Connect Now. The Select connection method appears.

   

3. Click CLI. You are brought to the Set Up CLI Parameters.

2. Install and Authenticate the CLI

1. Install OCI command line as instructed in the Oracle official docs. Skip this step if you already have the OCI command line installed.

2. Authenticate. You have two options:

   • Follow the authentication guide in the Oracle official docs.

   • Authenticate using the browser by running oci session authenticate

     Note: Before running the authentication command, ensure that any existing OCI configuration files are removed, as they may have been left over from a prior integration run.

     1. This will open a browser window in which you will need to authenticate.

     2. Once authentication is complete, you will have a file named rm -rf ~/.oci/config containing all the necessary configuration, including a temporary authentication token.

3. Run a small test to see if you are authenticated:

   • oci --auth security_token iam availability-domain list

4. Choose the domain

   1. Print domains

      OCI_TENANCY=$(awk -F'=' '/^tenancy/ { gsub(/ /, "", $2); print $2; exit }' ~/.oci/config) && \
        oci iam domain list \
        --compartment-id "$OCI_TENANCY" \
        --all \
        --auth security_token \
        --query 'data[].{name:"display-name", id:id, url:url}' \
        --output table

   2. Ensure that it looks like:

      +--------------------------------------------------------------------------------+-------------+----------------------------------------------------------------------------+
      | id                                                                             | name        | url                                                                        |
      +--------------------------------------------------------------------------------+-------------+----------------------------------------------------------------------------+
      | ocid1.domain.oc1..aaaaaaaaxnavpemxob22rbpw73f77kplggcozle5pppj6prsdznykjp2urbq | Default     | https://idcs-d24ab4d562c6425398a8ddf963660fbf.identity.oraclecloud.com:443 |
      | ocid1.domain.oc1..aaaaaaaa46euetfik5sqk4zvnia7v6l2kpb3cgypzd4bmhpmwi2rvhqnztha | finout-cost | https://idcs-6bd3f87141924f1995523f8ec5662c67.identity.oraclecloud.com:443 |
      +--------------------------------------------------------------------------------+-------------+----------------------------------------------------------------------------+

   3. Pick one and use it below as OCI_DOMAIN_NAME.

5. A key is generated:

   • The public key will be used as the value in FINOUT_PUB_KEY.

   • The private key will be saved when saving the credentials to the cost center to authenticate in the data pipelines.

6. Provide the input details as instructed previously, then run the script provided below.

   Once the execution is complete, please review the results and extract the necessary details from the output, as shown in the example format:

   -----------------------
   User ID: ocid1.user.oc1..aaaaaaaaj7xn352us5bj74ew4pfkkebfbtrsfkgnhbmbikofdprpdavzca4q
   API Key fingerprint: 6e:b5:43:46:aa:6e:6f:0d:50:68:f6:f2:a6:f0:4e:bb
   Tenancy: ocid1.tenancy.oc1..aaaaaaaalzf62oj3gqksyjc6jiee7na3m7ne7ebvecslrbk6xfhqgrlqbrka
   Region: us-ashburn-1
   -----------------------

7. Fill the form.

3. Set Up CLI Parameters

1. In Finout, review and adjust the CLI parameters below, then run the generated script.

2. Update the editable fields at the top of the script:

   • FINOUT_USERNAME - ask the user for the name of the user we will create for him.

     • Can only contain: A-Z, a-z, 0-9, hypen(`-`), period(`.`), underscore(`_`), plus sign (+) and at sign (@)

   • FINOUT_EMAIL - ask the user for the email for the user we will create for him

     • Make sure it’s a valid email

   • FINOUT_FIRST_NAME and FINOUT_LAST_NAME - same

   • GROUP - IAM group name they wish to create the use at:

     • Choose a group name, but it must consist of letters, numbers, dots, dashes, and underscores.

   • OCI_POLICY_NAME - Policy name they wish to create (this is the one that allows the group to read the OCI usage reports)

   • FINOUT_PUB_KEY-

     • Generate a pair of public/private keys, similar to those commands:

       • z - this creates a private key file

       • openssl rsa -pubout -in finout_user_private.pem -out finout_user_public.pem - this extracts the public key from the private key file.

   Note: Group names may contain only letters, numbers, dots (.), dashes (-), and underscores (_).

3. Copy the generated script. Run this script in your terminal to set up the OCI integration.

4. Click Next.

4. Run the Script in the CLI

1. Copy and run the script below into a file called oci-setup.sh (this contains your own specific one-time public key in the script): chmod +x oci-setup.sh ./oci-setup.sh

This option uses a single CLI script to automatically create all required OCI resources, reducing setup time and minimizing configuration errors.

What the script does:

• Creates or reuses an IAM group

• Creates or reuses a read-only IAM policy for cost and usage reports

• Creates or reuses an IAM user in the selected identity domain

• Adds the user to the group

• Uploads the public API key provided by Finout

• Outputs all required identifiers for Finout

Note: If resources already exist, they will be reused. If not, they will be created.

1. Copy the following values from the CLI script:

• User ID

• API Key Fingerprint

• Tenancy

• Region

5. Connect to OCI

1. Back in Finout, fill in the values from the CLI.

2. Click Complete Integration. The integration is completed.