Every cloud account in one workspace

Settings → Accounts lists every connected account. Admins add accounts through the onboarding wizard, rename them, and choose which one is primary. Adding another account doesn’t change which one is primary. Only the owner can remove an account, and removing one disconnects that account alone.

The primary account matters in two places. Findings that don’t point at a single resource are attributed to it, and the cost report shows it when no account is selected.

The free plan is limited to one account. Pro and the free trial include 10 cloud accounts; if you need more than 10, talk to us.

Each scan goes through every connected account and collects with that account’s own access:

• AWS accounts on the cross-account role: GetFinOps assumes that account’s role with an External ID.
• AWS accounts using the in-account collector: it reads the latest snapshots from that account’s bucket.
• GCP projects: it uses that project’s service account key and billing export dataset.

An AWS account without an assumable role is skipped and marked failed, rather than read with some other credentials. Each run then records a result for every account: its collection status, how many records it returned, the collectors that failed and the fetches that failed inside them.

The account cards on the home page show each account’s collection status and record count from the latest scan, so an account whose collection failed or was partial doesn’t show as complete.

The header selector appears once a workspace has two or more accounts. If a selected account has since been removed, pages return an error instead of an empty result, so a stale selection can’t pass for a clean account.

Picking an account scopes these pages to it:

• Findings and the remediation plan.
• The cost report and cost allocation.
• Budgets: that account’s budgets plus workspace-wide ones.
• Reports and daily briefs.
• Executions, tag governance, Kubernetes clusters and sustainability.

A scan merges every account into one run and always writes a workspace report. With two or more accounts it also writes a report for each account that has findings, built from that account’s findings and plan. Accounts with no findings get no report of their own.

Paid and trial workspaces also get a daily brief for each account with findings, next to the workspace brief. Free workspaces get the workspace brief only.

An approval carries the account of its finding. When it runs, GetFinOps assumes that account’s cross-account role. If the account can’t be found, the fix is refused rather than run against the primary account.

Automation Safety has a workspace default and a row per account. Each account row can block or allow fixes in production, turn on a notice when a fix is blocked, and choose the Slack channel that hears about it. The workspace default sets which environment names count as production. An account’s environment comes from its label, which you choose when you add the account and can change in Settings → Accounts or Automation Safety; an account with no label counts as production. Slack approval cards name the account and go to its channel when one is set.

• It doesn’t discover member accounts in AWS Organizations; you connect each account.
• A self-hosted Marketplace install reads AWS data with its own credentials, so it sees the account it runs in, not other AWS accounts you add.
• It doesn’t make changes in GCP projects.
• It doesn’t apply fixes in AWS accounts connected through the in-account collector.
• The tag compliance trend and the commitments view cover the whole workspace, not a single account.
• The cost report shows one account at a time; the by-account charts show the workspace total.