Multi-cloud cost management with AAA Sentinel: AWS, Azure and Google Cloud in a single view

Few companies choose to have three clouds. It usually just happens: the application was born on AWS, the ERP arrived with a Microsoft contract and the data team fell in love with BigQuery. Each cloud has its own console, its own bill and its own names for the same thing, and the most basic question, how much did we spend on cloud this month, ends up being answered by adding up spreadsheets. This article shows you how to bring all three clouds into AAA Sentinel and make the most of them, step by step, with a full worked example.

The problem: three consoles, three truths

Managing each cloud separately is not just inconvenient. It has concrete consequences:

• Nobody sees the total. Each team knows its share, but overall spend only shows up at month end, when it is too late to fix.
• Waste hides in the secondary cloud. The one "nobody looks at" piles up orphaned disks and forgotten machines for months.
• Criteria are not comparable. What AWS calls an EC2 instance is a virtual machine in Azure and a Compute Engine instance in Google Cloud, and each console measures them its own way.
• Splitting cost by team becomes impossible, because tags are not written the same way across clouds.

What you gain with a unified view

With all three clouds in one place, the conversation changes:

• A single total spend, refreshed with every scan, instead of three figures to add up by hand.
• The same detection rules everywhere: an unattached disk is a finding whether it lives in AWS, Azure or Google Cloud.
• A comparison of spend by provider and by workload type.
• Cost split by governance tags, with the same criteria for every cloud.

How AAA Sentinel solves it

Multi-cloud support rests on five pieces, each with its plan:

• Account connection, from My cloud accounts → "Connect account", with a different wizard for each provider. Pro includes five accounts, also during the 30-day trial, and Business twenty: three clouds fit from day one.
• The "Dashboard", with the total spend across all clouds. Available on every plan.
• The "Analysis rules", which apply the same detection families to all three providers.
• The "Multi-cloud comparison", under Reports → Multi-cloud, with spend by provider, the workload comparison and informational migration recommendations. Pro plan.
• Cost split by tags: "By tags" (Pro), account by account, and "Chargeback" (Business), with all accounts together.

Worked example: ACME on three clouds

ACME, a fictional company, runs its online shop on AWS, its ERP and SQL database on Azure, and its analytics on Google Cloud. Until now, each team checked its own console once a month. This is its approximate monthly spend:

Step 1: connect the three clouds

In My cloud accounts → "Connect account", the wizard first asks "Choose your cloud provider" and then follows a different path for each one. In all three cases access is read-only:

• AWS: "Step 1 — Create the IAM role" opens CloudFormation with a ready-made stack that creates a read-only role protected by an ExternalId. In "Step 2 — Copy the role ARN" you copy the ARN the stack outputs, and in "Step 3 — Connect the account" you paste it and give it a name. Costs come from Cost Explorer.
• Azure: "Step 1 — Create Service Principal" gives you the Azure CLI (or Cloud Shell) commands to create a Service Principal with the Reader role, for inventory and posture, and Cost Management Reader, for costs. In "Step 2 — Service Principal credentials" you enter Tenant ID, Client ID (appId), Client Secret (password) and Subscription ID, and in "Step 3 — Name and connect" you name it.
• Google Cloud: "Step 1 — Create a Service Account" under IAM & Admin → Service Accounts, with roles/viewer and the Compute, SQL and Functions viewer roles, and with the matching APIs enabled on the project. In "Step 2 — Upload Service Account" you upload the JSON file. "Step 3 — Real costs (optional)" asks for your BigQuery Billing Export table.

Step 2: read the Dashboard

After the first scan of each account, the "Dashboard" shows "Total cost" for "all clouds · 30 days": in ACME's case, about $10,500. Below it you find "Cost evolution", with the current month's forecast on Pro, the "Needs your attention" block, the "Savings" summary and the "Your cloud accounts" list, with each account's spend, possible savings and last scan. For the first time, ACME's leadership sees a single figure for the whole cloud.

Step 3: the same rules across the three clouds

The "Analysis rules" apply equivalent families on each provider. On every plan: low CPU, unattached disks, unused public IPs and resources missing governance tags, plus stopped machines that keep generating cost on AWS and Azure. Pro adds, depending on the provider, load balancers with no traffic, databases with no connections, functions with no invocations, storage in an expensive class, rightsizing and orphaned NAT gateways. In "Active findings", with the "All accounts" filter, ACME sees findings from its three clouds together:

Step 4: the Multi-cloud comparison

Under Reports → Multi-cloud (/reports/multicloud) you will find the "Multi-cloud comparison". It is built from the latest completed scan of each account and has these parts:

• Indicators at the top: "Total spend", the provider with the highest spend and the total savings from migration recommendations.
• One card per provider with its monthly spend and number of resources.
• "Spend distribution by provider", split by category (compute, databases, storage, networking, serverless). At ACME: AWS 59%, Azure 28% and Google Cloud 13%.
• "Workload comparison by provider": the cost of the same workload type in each cloud, including estimates for providers where you have no resources, with the cheapest option marked "Lowest" and a confidence level.
• "Migration recommendations", with "Current cost", "Estimated cost", "Savings", "Complexity" and "Confidence".

Migration recommendations are informational only

A recommendation appears when another cloud would be at least 15% and $10 a month cheaper for a category. Complexity depends on the workload type: low for storage, medium for compute and high for databases or networking. At ACME one appears for Azure compute. The team dismisses it: the ERP has licences tied to Azure, and moving data between clouds carries an egress cost the estimate does not include.

Step 5: split cost with Chargeback and By tags

AAA Sentinel measures the coverage of five governance tags across the three clouds: Environment, Project, Owner, CostCenter and Team. It also accepts the lowercase key, which matters on Google Cloud, where labels only allow lowercase: environment, project, owner, costcenter and team. With that measurement there are two reports:

• "By tags" (Pro), account by account: "Tagging coverage" per key, "Breakdown by service", "Findings by region" and "Findings by resource type".
• "Chargeback" (Business), with all accounts together: you pick a key and see spend split into "Tagged" and "Unassigned", plus the "Breakdown by account", with its provider, and "Top services by cost".
• The split is proportional to coverage: each account's spend is divided according to the percentage of its resources that carry that tag.

Which currency the amounts are shown in

In these reports, all cost is stored in US dollars. If an account returns its real cost in another currency, the platform does not mix it with the rest and falls back to public-price estimates, which are in dollars. On Google Cloud, the export carries the exchange rate Google applied, and it is reversed row by row. If you would rather see euros or pounds, change it under Settings → Preferences → "Display currency": each amount is converted using the European Central Bank rate for its own date, so history never shifts.

When you need to split by specific team

Chargeback tells you how much spend is tagged and how much is not, but it does not split between the values of a tag: it does not separate the payments team from the catalogue team. For that there is cost-centre allocation on the detailed FOCUS bill, also on Business, which we cover in the article "From the cloud bill to cost per order: cost-centre allocation and unit cost across AWS, Azure and Google Cloud". There you will also see that, in that report, each currency gets its own card and is never converted.

What it does not do yet

To use the multi-cloud view with good judgement, it is worth knowing its limits:

• Chargeback and By tags split by tag coverage (tagged versus unassigned), not by the value of each tag.
• The workload comparison and migration recommendations are approximations: part of the inventory is rebuilt from findings and from the cost breakdown by service.
• Migration recommendations do not include egress, licences, discounts or commitments, and the platform does not run migrations.
• On Google Cloud, without BigQuery Billing Export the cost is a public-price estimate.
• The five governance keys are fixed: Chargeback does not accept custom keys.

Checklist to get started

With this in place, the next time someone asks how much the cloud costs you will have a single answer for all three:

• Pro plan or higher to connect more than one account (Business for Chargeback).
• AWS, Azure and Google Cloud connected with read-only access.
• BigQuery Billing Export set up on Google Cloud for real cost.
• "Dashboard" reviewed and "Active findings" filtered by "All accounts".
• Multi-cloud comparison read, with migrations taken as hints, not orders.
• The five governance tags agreed and written the same way on all three clouds, lowercase on Google Cloud.
• Display currency chosen under Settings → Preferences.