> ## Documentation Index > Fetch the complete documentation index at: https://help.nops.io/llms.txt > Use this file to discover all available pages before exploring further. # Oracle Cloud Infrastructure - Integration Setup > Connect your Oracle Cloud tenancy to nOps so nOps can read your FOCUS cost reports. You run one Oracle Resource Manager stack and paste a connection code back into nOps. ## FAQs > [accordion] Who needs to run the setup? > > A **tenancy administrator**: a member of the **Administrators** group in your Oracle Cloud tenancy. The stack creates a user, a group, and a policy in the root compartment, and only a tenancy administrator can do that. > > The nOps steps need an nOps **admin**. One person can do both parts, or two people can work through the same wizard. > [accordion] What does nOps get access to? > > Only your Oracle **cost and usage reports**. Oracle stores these reports in a bucket that Oracle owns, not in your tenancy. The policy the stack creates lets one nOps user read objects in that bucket, and nothing else. > > nOps can't see, create, change, or delete any resource in your tenancy. See [Permissions & Resources](https://help.nops.io/oci/permissions-and-resources.md) for the full list. > [accordion] Does nOps ever see a password or private key from my tenancy? > > No. nOps creates the key pair. It keeps the private key in an encrypted secret store and only gives you the **public** key. The user the stack creates has no console password, so it can only use that API key. > > The connection code you paste back holds no secret. It only holds your tenancy OCID, the user OCID, the key fingerprint, and your home region. > [accordion] Which region do I deploy the stack in? > > Any region works. The stack always creates the user, group, and policy in your **home region**, because Oracle keeps identity resources and cost reports there. The stack record itself stays in the region and compartment you pick. > [accordion] How long until I see my Oracle costs in nOps? > > Oracle writes a new FOCUS report about **every 6 hours**. A report can be **up to 24 hours** late. After verification, nOps loads the reports Oracle has kept, which is up to the **last 12 months**, and then checks for new reports every day. > > If your tenancy is new, the first report can take up to a day to appear. > [accordion] My tenancy is non-metered. Can I connect it? > > Oracle does not produce cost reports for non-metered tenancies, so nOps has no cost data to read. Setup still passes, but nOps will keep reporting that no reports were found. Contact your Oracle account team or [nOps support](mailto:support@nops.io) if you're not sure which type you have. > [accordion] Do you support government or other Oracle realms? > > Not yet. nOps supports the commercial realm only: tenancy OCIDs that start with `ocid1.tenancy.oc1..`. The stack refuses any other tenancy. > [accordion] Can I connect more than one tenancy? > > Yes. Add one integration per tenancy, and run the stack once in each tenancy with that integration's public key. Each integration has its own key. nOps won't let you connect the same tenancy twice. > [accordion] We use Oracle Organizations. Which tenancy do I connect? > > Connect the **parent tenancy** only. Oracle writes the cost reports for the whole organization in the parent tenancy, and they include every child tenancy. A child tenancy shows little or none of its own spend, and connecting both counts the child's spend twice. > > If you connect a child tenancy, verification still passes, but nOps warns you and names the parent. *** ## Overview nOps reads the **FOCUS cost reports** that Oracle Cloud generates for your tenancy. FOCUS is an open standard format for cost data, so your Oracle costs line up with your other clouds in nOps. Setup has two steps in the nOps wizard: 1. **Deploy** -- Name your integration, generate and copy your nOps public key, and run the nOps stack in Oracle Cloud 2. **Connect** -- Paste the connection code from the stack, and nOps verifies access > [!NOTE] > > Setup takes about **10 minutes**. You need: > > * An nOps admin account > * A tenancy administrator in Oracle Cloud (a member of the **Administrators** group) > > If you use Oracle Organizations, run the setup in the **parent tenancy**. Its cost reports cover every child tenancy. *** ## 1. Name Your Integration **1. Open Cloud Provider Integrations** Log in to **nOps** and go to [**Settings > Cloud Provider Integrations**](https://clara.nops.io/settings). Scroll down to the **Add a provider** section and click the **Oracle Cloud** card. **2. Enter an Integration Name** Enter a name that helps you find this integration later (for example, "Production OCI tenancy"), then click **Generate key**. nOps creates the integration and a key pair for it. You can leave the wizard and come back later: the integration shows **Action Required** until verification passes. *** ## 2. Deploy the nOps Stack The nOps stack is an Oracle **Resource Manager** stack. Its source is public: [nops-io/terraform-oci-nops-integration](https://github.com/nops-io/terraform-oci-nops-integration). It has two fields: your nOps public key, and an optional email for the nOps user. **1. Copy Your nOps Public Key** On the **Deploy** step, click the copy button next to the public key. You paste it into Oracle Cloud in a moment. The key belongs to this integration only. If you start a second integration, it gets a different key. **2. Click Deploy to Oracle Cloud** Click **Deploy to Oracle Cloud**. Oracle Cloud opens in a new tab, on the **Create stack** page, with the nOps stack already loaded. Keep the nOps tab open. Sign in as a **tenancy administrator** if Oracle asks you to. **3. Review the Stack Information** Oracle shows the stack's name and the compartment it will be saved in. You can keep the defaults. Click **Next**. **4. Paste the Public Key** In the **nOps public key** field, paste the key you copied. Leave everything else as it is. Click **Next**. Oracle requires an email on every user. Leave **Email for the nOps user** blank to use yours, or enter a team mailbox. Oracle may send it a welcome message; the nOps user still can't sign in to the Console. **5. Create and Apply** On the **Review** page, select **Run apply**, then click **Create**. Resource Manager starts an apply job. It usually takes a minute or two. **6. Copy the Connection Code** When the job succeeds, open the job's **Outputs** and copy the value of **`nops_connection_code`**. It's one long line of letters and numbers. > [!TIP] > > **Prefer to read the code first?** The stack is plain Terraform. Open [nops-io/terraform-oci-nops-integration](https://github.com/nops-io/terraform-oci-nops-integration) to see every resource it creates before you click **Deploy to Oracle Cloud**. The Deploy button always uses a pinned, tagged release, so the code you read is the code that runs. For what the stack creates and why, see [Permissions & Resources](https://help.nops.io/oci/permissions-and-resources.md). *** ## 3. Connect and Verify **1. Paste the Connection Code** Go back to the nOps tab. On the **Connect** step, paste the connection code. **2. Click Verify** Click **Verify**. nOps saves the code and then checks, from its own servers, that it can reach your reports: * **API key signs in** -- Oracle accepts the key the stack added (`GetNamespace`) * **Can list cost reports** -- nOps can list your FOCUS cost reports (`ListObjects`) * **Can read a cost report** -- nOps can open a report file (`HeadObject`) * **Cost reports found** -- how many reports Oracle has written so far. This one is for information only: zero reports still passes nOps also checks whether your tenancy is a child tenancy in an Oracle organization (`ListOrganizations`). That check never fails verification; it only adds a warning. **3. Click Done** When the checks pass, nOps shows **Oracle Cloud Verified** and the button changes to **Done**. Read any note on the screen (for example, that Oracle hasn't written reports yet), then click **Done**. Your integration is now **Active**. If a check fails, nOps shows **Required Access Not Detected** with the fix for each failed check. See [Troubleshooting](#troubleshooting). > [!NOTE] > > New API keys and policies can take a few minutes to take effect in Oracle Cloud. nOps retries a few times on its own before it reports a failed check. If a check still fails, wait a few minutes and click **Verify** again. ### Finishing Later If you need to stop partway, click **Finish later**. The integration shows **Action Required**, and nOps doesn't read any data from it. nOps saves the connection code when you click **Verify**, even if a check fails. To pick up where you left off, open the integration from **Settings > Cloud Provider Integrations**. The wizard reopens at **Connect** if you already saved a code, and shows it as dots, so you only need to click **Verify** again. It opens at **Deploy** if you didn't save one. Your public key stays the same, so you don't need to run the stack again. You can also go back to the **Deploy** step from **Connect** at any time to copy the key again. *** ## Troubleshooting > [accordion] nOps says the connection code isn't valid > > The code must be copied whole, from the `nops_connection_code` output of a successful apply job. Check that: > > * You copied the full value, with no spaces or line breaks added > * You copied the output of the **latest** successful apply job for this stack > [accordion] nOps says the code was made with a different key > > The stack was run with a public key from a **different** nOps integration, or from an earlier attempt that you deleted. Each integration has its own key. > > In Oracle Cloud, go to **Developer Services > Resource Manager > Stacks** and open the nOps stack. Click **Edit**, paste the public key shown in **this** integration's **Deploy** step, save, and run **Apply** again. Then copy the new connection code. > [accordion] nOps says this tenancy is already connected > > Another nOps integration in your organization already uses this tenancy. Use that integration, or delete it first if you want to start over. > [accordion] The "API key signs in" check fails > > Oracle didn't accept the key. Most often the key is still new: wait a few minutes and click **Verify** again. > > If it keeps failing, check the user the stack created: > > 1. In Oracle Cloud, go to **Identity & Security > Domains**, open the **Default** domain, and select **Users**. (Older tenancies without identity domains: **Identity & Security > Users**.) > 2. Open the nOps user and select **API keys**. > 3. Confirm there is a key whose **fingerprint** matches the one shown in nOps. > > If the key is missing, run **Apply** on the nOps stack again with the public key from this integration's **Deploy** step. > [accordion] The "Can list cost reports" check fails > > nOps signed in but Oracle refused to list your reports. This means the policy is missing or hasn't taken effect yet. Oracle can take a few minutes to apply a new policy, so wait and click **Verify** again. > > A new API key can also cause this: Oracle accepts it for sign-in a few minutes before it accepts it for cost reports. nOps then says the key isn't activated for cost reports yet. > > **New tenancy?** Until Oracle writes a tenancy's first cost report, the report bucket doesn't exist, and Oracle answers exactly as it does when the policy is missing. If your tenancy was created in the last day, click **Verify** again tomorrow. > > If it keeps failing, open **Identity & Security > Policies**, select the **root** compartment, and open the nOps policy (`nops-cost-reports-policy-`). It must contain both of these statements, with your nOps group's name (`nops-cost-reports-reader-`, shown in the stack's `nops_group_name` output) in the second one: > > ``` > define tenancy usage-report as ocid1.tenancy.oc1..aaaaaaaaned4fkpkisbwjlr56u7cj63lf3wffbilvqknstgtvzub7vhqkggq > endorse group to read objects in tenancy usage-report > ``` > > The policy must be in the **root** compartment. Oracle only accepts these statements there. If the policy was changed or removed, run **Apply** on the nOps stack again to restore it. > [accordion] The "Can read a cost report" check fails > > nOps can list your reports but Oracle refused to open one. This happens when the policy's `endorse` statement was changed from `read objects` to `inspect objects`, which allows listing only. Run **Apply** on the nOps stack again to restore the policy, then click **Verify** again. > [accordion] Verification passes, but no reports were found > > This is normal for a new tenancy. Oracle writes a FOCUS report about every 6 hours, and the first one can take up to a day. nOps keeps checking every day, so you don't need to do anything. > > To check on Oracle's side, go to **Billing & Cost Management > Cost and Usage Reports** and look for a **FOCUS Reports** folder. > > If your tenancy is **non-metered**, Oracle doesn't produce cost reports, and none will appear. > [accordion] nOps warns that this is a child tenancy > > Your tenancy belongs to an Oracle organization, and Oracle writes the organization's cost reports in the parent tenancy the warning names. Add a new integration, run the stack in that **parent tenancy**, then remove this one. > [accordion] nOps says Oracle Cloud didn't respond > > Oracle Cloud returned an error or timed out, so nOps couldn't run the checks. Nothing about your integration changed: an active integration stays active. Try **Verify** again in a few minutes. > [accordion] The stack's apply job fails > > Open the failed job and read its log. Common causes: > > * **You are not a tenancy administrator.** Ask a member of the **Administrators** group to run the stack. > * **The public key was pasted incorrectly.** Edit the stack, paste the key again from the nOps **Deploy** step, save, and run **Apply** again. > * **The primary email must be specified.** Oracle couldn't find an email for you. Edit the stack, enter **Email for the nOps user**, save, and run **Apply** again. *** ## Disconnecting Oracle Cloud Do both steps to remove nOps's access completely: **1. Delete the Integration in nOps** In [**Settings > Cloud Provider Integrations**](https://clara.nops.io/settings), delete the Oracle Cloud integration. nOps stops reading your reports and deletes its private key. **2. Destroy the Stack in Oracle Cloud** In Oracle Cloud, go to **Developer Services > Resource Manager > Stacks** and open the nOps stack. Click **Destroy** and confirm. This removes the policy, the user, its API key, and the group. When the destroy job finishes, you can delete the stack itself. > [!TIP] > > To cut off access right away, before you destroy the stack, delete the API key on the nOps user in Oracle Cloud. nOps can no longer sign in once the key is gone. *** ## Related Guides > [card] [Permissions & Resources](https://help.nops.io/oci/permissions-and-resources.md) > > What the nOps stack creates in your tenancy, and why each part is needed. > [card] [Cloud Provider Integrations](https://help.nops.io/platform/integrations.md) > > All the cloud providers and tools you can connect to nOps. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.