CoverOps on Oracle Cloud
Read-only through a dedicated API user in a group whose policy has read verbs only.
The access you give
A dedicated user in a read-only group.
- A CoverOpsReaders group with a policy of read verbs only: instances, volumes, load balancers, metrics and usage reports. No use or manage verb is ever requested
- Created with an oci CLI script or Terraform from the console
The API signing key is encrypted at rest (AES-256-GCM) and used only by scans.
What it reads
- Compute instances, block volumes and backups, load balancers and networking
- Monitoring metrics and usage reports
Never read: your application data, database contents or the files in your storage.
Where the rupee figures come from
Public list prices, labelled as estimates; the usage report where it can be read.
What it finds
- Idle and oversized instances
- Unattached block volumes and old backups
What it changes
Advice only on Oracle Cloud: each finding comes with the oci command and its undo.
How to connect
- Sign up and open Cloud accounts → Connect Oracle Cloud
- Run the generated script: it creates the user, the CoverOpsReaders group, the read-only policy and an API key
- Paste the values the script prints, press Verify access, then Connect
How to end it
Delete the coverops-read-only policy or the user. Access ends at once. Your workloads keep running: none of them ever ran on CoverOps. More in revoking access and the security overview.
Other clouds: AWS · Azure · Google Cloud · DigitalOcean