Setup guide

Lists the last N invoice IDs so the audit works from the authoritative bill rather than the console summary.

↳ No narrower form exists for the collection; pair it with GET /me/bill/* rather than granting GET /me/*.

Reads priceWithoutTax and the per-invoice detail for the last three months to build the spend breakdown.

↳ Use GET /me/bill/* only — GET /me/* would also expose contacts, payment means and identity documents.

Enumerates every Public Cloud project on the account, because bills aggregate across projects and auditing one project understates the total.

Covers usage/current, usage/forecast, usage/history, instance, flavor and instance monitoring reads in one rule.

↳ Replace with the four explicit rules GET /cloud/project/*/usage/*, GET /cloud/project/*/instance, GET /cloud/project/*/instance/*/monitoring and GET /cloud/project/*/flavor to keep the token read-only and narrow.

Switches an instance from hourly to monthly billing. Only grant this after a human has approved the commitment plan — the switch is irreversible for the current month.

↳ Omit entirely from the audit token; issue a second, short-validity token holding only this rule when the approved changes are executed.

Runs the Savings Plan simulation so a commitment can be modelled against real usage before being purchased.

↳ Grant the simulate path only; do not include the subscription/creation path in a read-only audit token.

Allows `openstack server list --long`, `openstack flavor list` and, once approved, `openstack server resize`.

↳ Infrastructure Supervisor gives read-only visibility and is sufficient for the discovery sweep; add Compute Operator only for the approved resize window.

Allows `openstack volume list --status available` and `openstack volume snapshot list` to find unattached volumes and orphaned snapshots, which OVHcloud bills in full.

↳ Read-only sweeps need only list rights; grant Volume Operator on a dedicated audit user rather than reusing an application user.

Allows `openstack image list --private` to find stale private images that accrue storage charges.

Allows `openstack floating ip list --status DOWN` to find unattached additional IPs.

Required for `openstack ec2 credentials create` and for the S3 user to list buckets and object metadata during the Cold Archive tiering analysis.

↳ Attach a read-only S3 policy to the generated S3 user so the tiering pass cannot delete or re-tier objects; grant write only for the approved lifecycle-rule step.

Cause: The consumer key's rules do not cover the method+path being called — typically GET /cloud/* was granted but GET /me/bill was not, or a rule was written as /cloud/project without the trailing /*.

Fix: Recreate the token at https://api.ovh.com/createToken/ with one explicit row per rule: GET /me/bill, GET /me/bill/*, GET /cloud/project, GET /cloud/project/*. Rules cannot be edited after creation.

Cause: The application key was created on a different regional endpoint than OVH_ENDPOINT points at (for example an ovh-eu key used against ovh-ca), or a stray whitespace/newline was captured when copying.

Fix: Match OVH_ENDPOINT to the createToken host that issued the key and re-copy the value without surrounding whitespace.

Cause: A consumer key obtained via POST /auth/credential was never validated by a human at the returned validationUrl, or the token's validity period has expired.

Fix: Open the validationUrl and log in to activate the consumer key, or issue a new token via the createToken page which returns an already-validated consumer key.

Cause: The X-Ovh-Signature is computed over a timestamp; a machine clock more than ~30 seconds off the OVHcloud server time invalidates every request. A wrong application secret produces the same message.

Fix: Sync the clock via NTP, then re-check OVH_APPLICATION_SECRET. python-ovh fetches server time from /auth/time automatically, so a proxy that blocks that call also triggers this.

Cause: openrc.sh was not sourced in the current shell (a new Bash tool call or subshell resets the environment), so OS_AUTH_URL is unset.

Fix: Run `source ~/openrc.sh` in the same shell as the openstack command, or pass --os-auth-url/--os-username/--os-project-id explicitly.

Cause: Wrong OS_PASSWORD, an OpenStack user deleted or regenerated in the Control Panel, or the password was typed into the wrong region's openrc.

Fix: Regenerate the password from Public Cloud > Project Management > Users & Roles and re-source openrc.sh.

Cause: The OpenStack user is missing the role for that resource family — e.g. listing volumes without Volume Operator, or floating IPs without Network Operator.

Fix: Add the missing role on the user in Public Cloud > Project Management > Users & Roles; role changes take effect on the next token issue, so re-source openrc.sh.

Cause: AWS_DEFAULT_REGION does not match the regional S3 endpoint host, so SigV4 signs for the wrong region scope.

Fix: Set AWS_DEFAULT_REGION to the lowercase region in the endpoint (gra for https://s3.gra.io.cloud.ovh.net) and always pass --endpoint-url.

Cause: The OVHcloud APIv6 application key was exported as AWS_ACCESS_KEY_ID. The two credential systems are unrelated.

Fix: Generate S3 credentials with `openstack ec2 credentials create` (or Generate S3 credentials in the Object Storage > Users tab) and use those values.

Cause: The S3 user holds a read-only policy, which is correct for the discovery pass but insufficient to write the AbortIncompleteMultipartUpload lifecycle rule.

Fix: Only after human approval, grant the S3 user write rights on the specific bucket, apply the rule, then revert the policy.