Oracle Cloud¶

Connect an OCI tenancy on Account → Cloud accounts. Pick OCI, then Add account.

Koltto signs in as an IAM user in a dedicated group. Create that group and policy in OCI first, then add the account in Koltto.

Spend comes from Oracle’s cost reports (CSV files in an Oracle-owned Object Storage bucket) — the path Oracle’s billing docs describe. Koltto does not use Cost Analysis or the deprecated Usage reports API.

Create the KolttoReaders group¶

In the OCI Console, as a tenancy administrator:

Create an IAM group named KolttoReaders in the same identity domain as the Koltto user (Default or Oracle Identity Cloud Service).
Create an IAM user for Koltto (not your own console login). Add that user to KolttoReaders.
Create a policy in the tenancy (root), not in a child compartment. Paste one of these — the group prefix must match that user’s domain.

Default domain:

define tenancy usage-report as ocid1.tenancy.oc1..aaaaaaaaned4fkpkisbwjlr56u7cj63lf3wffbilvqknstgtvzub7vhqkggq
endorse group Default/KolttoReaders to read objects in tenancy usage-report
Allow group Default/KolttoReaders to inspect all-resources in tenancy
Allow group Default/KolttoReaders to read instances in tenancy
Allow group Default/KolttoReaders to read metrics in tenancy
Allow group Default/KolttoReaders to read optimizer-api-family in tenancy

OracleIdentityCloudService domain:

define tenancy usage-report as ocid1.tenancy.oc1..aaaaaaaaned4fkpkisbwjlr56u7cj63lf3wffbilvqknstgtvzub7vhqkggq
endorse group OracleIdentityCloudService/KolttoReaders to read objects in tenancy usage-report
Allow group OracleIdentityCloudService/KolttoReaders to inspect all-resources in tenancy
Allow group OracleIdentityCloudService/KolttoReaders to read instances in tenancy
Allow group OracleIdentityCloudService/KolttoReaders to read metrics in tenancy
Allow group OracleIdentityCloudService/KolttoReaders to read optimizer-api-family in tenancy

Unprefixed Allow group KolttoReaders only matches Default. The two domains are different groups even when the name is the same.

The define tenancy usage-report line names Oracle’s report tenancy (that OCID is Oracle’s, not yours). The endorse … to read objects line is required so Koltto can read cost report files. Inventory and metrics still use inspect all-resources, read instances, and read metrics. read optimizer-api-family is needed so Koltto can show Oracle Cloud Advisor expanders on Opportunities (for example burstable shapes and object lifecycle). Without it, Koltto’s own recommendations still work.

You do not need read usage-reports. That verb was for the old Usage API.

That is read-only. Koltto can list compartments, inventory, metrics, cost, and Cloud Advisor. It cannot create, start, stop, or delete resources.

Copy the tenancy OCID and the user OCID. You will paste those in Koltto.

Cost reports are generated through the day and can lag up to 24 hours. In the OCI Console, Billing → Cost and Usage Reports is where those files appear. After you connect, run Refresh data → Cost; if spend is still empty, wait for the next files and refresh again.

Fields in the form¶

Field	What to enter
Name	A label in Koltto (`acme-prod`).
Description	Optional.
Region	Home region, for example `us-ashburn-1`.
Tenancy OCID	`ocid1.tenancy.oc1..…`
User OCID	The `KolttoReaders` user OCID.
Sync regions	Optional comma-separated list (`us-ashburn-1, eu-frankfurt-1`). Inventory and metrics sync only those regions. One region means only that region. Leave blank to sync the home region only — not every subscribed region. Cost is tenancy-wide from the home region and is not limited by this field.

Koltto generates the API signing key pair. The private key never leaves Koltto (encrypted at rest). You do not paste a PEM or a passphrase.

Add the public key in OCI¶

Inventory does not start when you save the account. Next:

Download the public key from Koltto.
In the OCI Console, go to Identity → Users, open the KolttoReaders user, then API Keys, and add the public key.
Check that the fingerprint in OCI matches the one Koltto computed.
In Koltto, choose I've added the key and policy. Inventory refresh starts after that verify succeeds.

What Koltto inventories¶

Compute, block and boot volumes, object storage, file storage, load balancers (including network load balancers), databases (Autonomous DB, Base DB, MySQL HeatWave, PostgreSQL), WAF, WAA, and Logging.

OKE and VCN collectors are not in the product yet.

Compute CPU and memory in Inventory need the Compute Instance Monitoring plugin on the instance. Other metrics (storage, load balancer, database) do not.

After the key is verified¶

Inventory starts after verify succeeds. Run Refresh data → Cost and Metrics so Overview, Spend Analytics, and Opportunities have numbers.

Scope in the rest of the app is the compartment tree, with the tenancy at the root.