Cloud8 is a platform that centralizes and enriches data from multiple accounts and multiple cloud providers, making it easier to analyze and visualize data both separately and in a unified way. To help our customers integrate this data into their own BI systems, custom reports, or dashboards, we offer the ability to export data to storage accounts of the main cloud providers.
Below you will find the necessary steps to create this integration with Amazon AWS, Google GCP, and Microsoft Azure. Jump directly to:
 Cloud8 Integration with AWS S3 Bucket |  Cloud8 Integration with Azure Storage Account |  Cloud8 Integration with GCP Cloud Storage |
Exporting data from Cloud8 to a Cloud Storage Account (all supported providers)
How to integrate with an AWS S3 Bucket? #
Below is the step-by-step guide to integrating an S3 Bucket with your Cloud8 account.
- Find the “Integrations” option in the side menu;
- Create a new integration of Type “S3 Bucket“;
- Enter the name of the S3 Bucket defined in AWS in the “Bucket” field;
- Configure the access pair, IAM Role ARN, and External ID provided by AWS. This credential must have permissions to write, read, list, and remove files in the Bucket, according to the policy described in Required permissions in the S3 Bucket below;
- Fill in the remaining information and click Save to finish
- This integration also works in Best Practices and in “Reports” – you can create the report to be exported
Required permissions in the S3 Bucket #
The IAM Role specified in the integration needs permission to write, read, list, and remove files in the destination Bucket. The permission is granted on the IAM Role, not in the Bucket: it is the same role used in the connection between the AWS provider and Cloud8.
To attach the policy to the role in the AWS Console:
- Go to IAM → Roles and locate the role used by Cloud8;
- On the Permissions tab, click Add permissions → Create inline policy;
- Select the JSON editor, delete the existing content, and paste the policy below, replacing
NOME-DO-BUCKETwith the name of your S3 Bucket; - Click Next, give the policy a name (e.g.,
cloud8-export-s3), and finish by clicking Create policy.
If you prefer to reuse the same policy across other roles, create it under IAM → Policies → Create policy and then attach it to the role.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:DeleteObjectVersion",
"s3:PutObject",
"s3:DeleteObject",
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::NOME-DO-BUCKET/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::NOME-DO-BUCKET"
]
}
]
}
Attention: the two blocks have different Resources on purpose. File-level actions (PutObject, GetObject, DeleteObject, DeleteObjectVersion) apply to the objects inside the Bucket, which is why there is /* at the end. Meanwhile, ListBucket applies to the Bucket itself, without /*.
When you click Save, Cloud8 writes a test file to the Bucket to validate access. If the policy is not attached to the role, the integration is not saved and the error “is not authorized to perform: s3:PutObject […] because no identity-based policy allows the s3:PutObject action” appears.
Optional template: read-only access to all Buckets #
If you already want to grant Cloud8 read access to all Buckets in the account—reusing the same role for other platform features and settings—use the template below instead of the previous policy. It keeps file writing and removal restricted to the export Bucket and grants read-only access to all others. Replace NOME-DO-BUCKET with the name of your export Bucket:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ListarBuckets",
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets"
],
"Resource": "*"
},
{
"Sid": "LerTodosOsBuckets",
"Effect": "Allow",
"Action": [
"s3:ListBucket",
"s3:GetBucketLocation"
],
"Resource": "arn:aws:s3:::*"
},
{
"Sid": "LerArquivosDeTodosOsBuckets",
"Effect": "Allow",
"Action": [
"s3:GetObject"
],
"Resource": "arn:aws:s3:::*/*"
},
{
"Sid": "GravarNoBucketDeExportacao",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:DeleteObject",
"s3:DeleteObjectVersion"
],
"Resource": "arn:aws:s3:::NOME-DO-BUCKET/*"
}
]
}
Attention: with this template, the role will read the contents of all Buckets in the account, including those unrelated to Cloud8. Evaluate whether this complies with your company’s security policy before applying it. If your goal is strictly data export, the previous policy is sufficient.
IAM Role #
An IAM Role is an entity in AWS IAM that defines a set of permissions to make requests to AWS services. Unlike an IAM user, which is associated with a specific person, an IAM role is intended to be assumed by any trusted entity, such as an AWS service, an application, or an IAM user. Roles are useful for granting temporary permissions and can be assumed by different entities as needed.
ARN (Amazon Resource Name) #
The ARN is an identifier that follows a standard, unique format to identify resources within AWS. It is used to specify the role uniquely in policies and permissions.
Example Role ARN #
arn:aws:iam::ID-NUMERICO-AWS:role/NOME-DO-ROLEUsing an IAM Role ARN in S3 #
When you use an IAM Role with S3, you can grant specific permissions to access S3 buckets and objects. For example, you can create an IAM role with permissions to access a specific S3 bucket and then configure an AWS service (such as EC2) or an IAM user to assume that role. This is useful for managing and controlling access to S3 resources securely and scalably.
Why use an IAM Role ARN? #
- Security: Allows granting temporary permissions, minimizing risks.
- Flexibility: Can be assumed by multiple entities, making permission management easier.
- Scalability: Ideal for large environments where different services and users require controlled access.
How to integrate with an Azure Storage Account? #
If you haven’t already done so, the first step is to create a Storage Account in Azure. To do this, search for “Storage accounts” in the Azure portal search bar. Click “Create”. On the Basics tab, fill in the information, and define the Subscription and Resource Group where the storage account will be created.
Define a name and region for the resource creation, and under “Preferred storage type”, choose “Azure Blob Storage or Azure Data Lake Storage”.
Under Performance, select “Standard”, and under Redundancy, select “Locally-redundant storage (LRS)”. However, this is just a suggestion, and the redundancy setting should always comply with the user’s business rules.
Finish by clicking “Review + create”. Validate the data and click “Create”.
Search for the created storage account. In the left-hand side menu, look for “Containers”. Click “Add container”, enter a name, and click “Create”. Note down the name of the created container.
In the left-hand side menu, locate “Access keys”. Copy the following information into a notepad:
- Storage account name
- Key
Integrating the Storage Account with the Cloud8 Platform #
Follow the steps below to create an integration with the Azure Storage Account inside our MultiCloud Dashboard.
- Find the “Integrations” option in the side menu
- Select “New Integration” from the first option
- Click “Type” and select the “Azure Storage Account” option
- Give this integration a name
- Fill in the required data: Storage Account Name, Storage Account Key, and Container
How to integrate with GCP Cloud Storage? #
If you haven’t already done so, you first need to create the GCP JSON on the Service Account. To do this, go to the GCP Console and search for IAM & Admin. Select Service Accounts in the left-hand side menu.
On the Permissions tab, select Manage access | Add another role and choose Storage Object Admin.
Return to Service Accounts, and click the three-dot icon to select the Manage Keys option. Click Add key | Create new key to create a new access key if you haven’t created one yet. Otherwise, granting the necessary accesses in the previous step is sufficient.
See below how to integrate GCP Cloud Storage with your Cloud8 account.
- Find the “Integrations” option in the side menu;
- Create a new integration of Type “GCP Cloud Storage“
- Add a credential (JSON file from a Service Account) generated under Access Key;
- Click “Save” and you’re all set.
How to export data from Cloud8 to Cloud Storage #
Cloud8 customers often have reports in different formats that need to be populated with the data available in our reports. The simplest way to do this is through an integration with Cloud Storage. See below how to perform this extraction in a few quick steps.
NOTE: An AWS S3 bucket was used in the example, but the process is the same for all supported providers.
- Click “FinOps – Reports“, then “Pivot Table”
- Select the “Provider“, “Tags“, currency, and markup
- Click “Refresh” to load the report with the selected filters
- Use the “My Dashboards” button and select “Save New”
- From the displayed options, select the integration created in the previous step for your chosen provider
- Don’t forget to save
After these two simple steps, the customer will receive a complete and consistent CSV format file with their defined markup, 2 to 3 times a day containing all data.
This eliminates the need for any API integration, credential generation, scripts, error handling, etc.
Best Practices #
Under “Reports“, you can export all data in JSON format. If you choose “Immediately“, we will export whenever a new item enters or leaves the rule. Inside the JSON, you will find an “identifier” that can be used to reconcile an item that opened and was later closed (whether because the rule changed or the customer / partner fixed it, allowing it to be closed automatically).
Inventory #
For Inventory data exports, contact Support so we can configure it internally.
