Cloud Hierarchy
Roll up and drill into cost and savings along your real cloud structure — AWS Organization OUs, Azure management groups, and GCP folders.
CostLens mirrors your cloud providers' own organizational structure so you can roll up and drill into cost and savings along the same tree you manage in the console — instead of a flat list of accounts.
| Provider | Structure imported |
|---|---|
| AWS | Organization root → Organizational Units (OUs) → member accounts |
| Azure | Management group tree → subscriptions |
| GCP | Organization → folders → projects |
Read-only
The hierarchy is a mirror. CostLens never creates, moves, or deletes anything in your cloud organization.
How it works
Import the hierarchy
An admin clicks Sync hierarchy on the Cloud Hierarchy page. CostLens reads the structure from each connected cloud and stores it as a provider-neutral tree.
Accounts are linked
Each connected account is matched to its leaf node by its native id — AWS account id, Azure subscription id, or GCP project id.
Metrics roll up
Spend (trailing 30 days), open savings, realized savings, and recommendation counts are summed from every account in a subtree up to each parent node.
Reading the tree
Every node shows its rolled-up totals — the node's own accounts plus everything beneath it. Click a node to see its full breakdown; expand a node to drill into child OUs/folders and individual accounts.
Accounts that aren't part of a hierarchy appear under "Not in a hierarchy" so nothing is ever hidden.
Scoping the rest of CostLens
Once a hierarchy is imported, a scope picker appears next to the account and cloud filters on the Billing and Recommendations pages. Pick any node — an OU, management group, or folder — and those views narrow to just that subtree.
The selection is sticky: it persists as you move between pages until you set it back to All scopes. If the hierarchy is re-imported and your selected node no longer exists, the scope resets to org-wide automatically rather than showing you an empty page.
Resolved server-side
Scoping is applied by resolving the node to its accounts on the server, so a scope can only ever narrow results within your own organization.
Required permissions
The hierarchy APIs need read access beyond the default CostLens roles. If a provider isn't permitted, that cloud is simply skipped — the rest of CostLens is unaffected.
- AWS:
organizations:ListRoots,organizations:ListOrganizationalUnitsForParent,organizations:ListAccountsForParent— only works from the organization's management account. - Azure: Management Group Reader at the tenant root.
- GCP:
resourcemanager.projects.getandresourcemanager.folders.geton the project's ancestors.
Limitations
- If the hierarchy API isn't permitted, no tree is imported and your accounts stay in the flat list — nothing breaks.
- AWS OU nesting is walked to the provider's maximum depth of 5.
- For GCP, CostLens walks upward from each connected project (project → folders → organization) rather than enumerating an entire organization, so it only needs access to resources you've already shared.
- The hierarchy refreshes when you run a sync — it isn't continuously watched.