Cloud Accounts

Cloud accounts are connections between Upmetr and your cloud providers. Once connected, Upmetr discovers resources, tracks costs, and collects cloud-native metrics automatically.

Supported Providers

AWS

EC2, RDS, Route53, CloudFront, ALB, ACM, CloudWatch metrics, Cost Explorer

Google Cloud

Compute Engine, Cloud SQL, Cloud Monitoring metrics, billing

Azure

Virtual Machines, SQL Database, Azure Monitor metrics, cost management

DigitalOcean

Droplets, managed databases, monitoring, billing

Adding an Account

Navigate to Settings > Cloud Accounts
Click Add Account
Select your cloud provider
Enter credentials (see provider-specific sections below)
Click Test Connection to verify
Click Save

After adding, click Discover to scan for resources. Resources are re-discovered every 15 minutes.

AWS Setup

AWS supports two authentication methods:

IAM Role (Recommended)
Access Keys

The most secure method — Upmetr assumes a role in your AWS account.

Step 1: Create an IAM Policy

In your AWS account, create a policy named Upmetr-Monitoring-ReadOnly:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "UpmetrMonitoringReadOnly",
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",
        "rds:Describe*",
        "rds:ListTagsForResource",
        "cloudwatch:GetMetricData",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:ListMetrics",
        "route53:List*",
        "route53:Get*",
        "cloudfront:List*",
        "cloudfront:Get*",
        "elasticloadbalancing:Describe*",
        "acm:List*",
        "acm:Describe*",
        "ce:GetCostAndUsage",
        "ce:GetCostForecast",
        "budgets:ViewBudget",
        "sts:GetCallerIdentity"
      ],
      "Resource": "*"
    }
  ]
}

To also allow instance management (start/stop/reboot) from Upmetr, add ec2:StartInstances, ec2:StopInstances, and ec2:RebootInstances to the policy.

Step 2: Create an IAM Role

Go to IAM > Roles > Create Role
Select Another AWS account
Enter the Upmetr AWS Account ID (provided in the app)
Check Require external ID and enter a unique value (e.g., upmetr-YOURORG-2026)
Name the role Upmetr-Monitoring-Role
Attach the Upmetr-Monitoring-ReadOnly policy

Step 3: Add to Upmetr

In the Upmetr UI:

AWS Account ID — Your 12-digit account ID
Role ARN — e.g., arn:aws:iam::123456789012:role/Upmetr-Monitoring-Role
External ID — The value from step 2
Default Region — Your primary AWS region

Simpler setup, suitable for quick testing.

Step 1: Create an IAM User

Go to IAM > Users > Create User
Name: upmetr-monitoring-reader
Attach the Upmetr-Monitoring-ReadOnly policy (same as above)
Create an Access Key for programmatic access

Step 2: Add to Upmetr

Access Key ID — Your access key
Secret Access Key — Your secret key
Default Region — Your primary region

GCP Setup

Create a Service Account in your GCP project with the following roles:
- roles/compute.viewer — Compute Engine resources
- roles/cloudsql.viewer — Cloud SQL instances
- roles/monitoring.viewer — Cloud Monitoring metrics
- roles/billing.viewer — Billing data (optional, for cost tracking)
Generate a JSON key file for the service account
In Upmetr, paste the contents of the JSON key file in the Service Account JSON field

Azure Setup

Register an App Registration in Azure Active Directory
Grant it the Reader role on your subscription
In Upmetr, enter:
- Tenant ID — Your Azure AD tenant
- Application (Client) ID — From the app registration
- Client Secret — Generated in app registration > Certificates & secrets
- Subscription ID — The subscription to monitor

DigitalOcean Setup

Generate a Personal Access Token at cloud.digitalocean.com/account/api/tokens
Grant Read scope
In Upmetr, paste the token

Resource Discovery

After connecting an account, Upmetr discovers:

Provider	Resource Types
AWS	EC2, RDS, Route53, CloudFront, ALB, ACM certificates
GCP	Compute Engine VMs, Cloud SQL instances
Azure	Virtual Machines, SQL Databases
DigitalOcean	Droplets, Managed Databases

Resources are refreshed every 15 minutes. You can trigger a manual discovery from the account detail page.

Security Best Practices

Always use the least privilege principle. Only grant the permissions Upmetr needs.

Prefer IAM Roles over Access Keys when possible (AWS)
Use unique External IDs per account for AssumeRole
Rotate credentials periodically for Access Key or token-based auth
Enable CloudTrail (AWS) to audit API calls from Upmetr

Troubleshooting

Issue	Solution
”Access Denied”	Verify the policy is attached and permissions are correct
”Invalid Role ARN”	Check format: `arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME`
”Connection Test Failed”	Verify credentials and network connectivity
”Expired Token”	Regenerate the token or access key

Guides

​Cloud Accounts

​Supported Providers

AWS

Google Cloud

Azure

DigitalOcean

​Adding an Account

​AWS Setup

​Step 1: Create an IAM Policy

​Step 2: Create an IAM Role

​Step 3: Add to Upmetr

​Step 1: Create an IAM User

​Step 2: Add to Upmetr

​GCP Setup

​Azure Setup

​DigitalOcean Setup

​Resource Discovery

​Security Best Practices

​Troubleshooting

Cloud Accounts

Supported Providers

Adding an Account

AWS Setup

Step 1: Create an IAM Policy

Step 2: Create an IAM Role

Step 3: Add to Upmetr

Step 1: Create an IAM User

Step 2: Add to Upmetr

GCP Setup

Azure Setup

DigitalOcean Setup

Resource Discovery

Security Best Practices

Troubleshooting