Skip to content

30-minute quickstart

Outcome 1 attributable record From 1 connected evidence source or accepted provider export.
Target time ≤30 minutes No Venturi-human response or emailed setup value.
Verify in Quality feed Inspect source, mapping, evidence, unknown state, and freshness.
Open guided setup

An authorized developer, Engineer, or Admin can move from tenant creation to at least 1 connected evidence source or provider export file, then make the 1st AttributionRecord visible in the quality feed within ≤30 minutes. The record appears on the /invocations surface and is verified through the quality feed. The path completes without a Venturi-human response or emailed setup value. Venturi tenant, connector, federation, and external-ID setup artifacts are generated in-product. Customer-provided provider-account credentials or provider exports are entered in-product. Credentials remain tenant-local and are validated for read-only access wherever the provider offers read-only credentials.

The ≤30-minute target counts your hands-on time from tenant creation to the 1st AttributionRecord. Expect approximately 15 to 30 minutes, including approximately 15 minutes for a cloud connector’s Terraform apply and verification. The path has no email round-trip and no wait for a Venturi-human response, so no setup step runs outside that clock.

For SaaS verification, open the quality feed. For self-hosted deployments, use the same /domains/quality/feed path on your own instance host.

What the 30-minute milestone means

Engineering active-use milestone The 1st attributable record on the /invocations surface, verified through the quality feed.
Persona-complete production onboarding Product, Security, Engineering, and Finance complete real in-product actions, and Finance accepts a chargeback-eligible export. There is no admin override and no support override.

Provision the organization

Role: Admin with tenant and identity settings access.

  1. Create the tenant in guided setup.
  2. Configure IdP federation and confirm a test assertion.
  3. Assign the Admin and Engineer entitlements needed for setup.

IdP federation authenticates people to Venturi. It is distinct from the identity-resolution connector that later maps usage to owners and cost centers.

Add evidence

Role: Engineer or Admin with connector settings access; cloud setup permissions are needed only for a cloud connector.

Choose 1 path:

  • Cloud connector (AWS, Google Cloud, or Azure): complete steps 1 to 3 of your cloud guide (AWS, Google Cloud, or Azure) now. In guided setup, generate the Venturi connector, federation, and external-ID artifacts, then download the pinned Terraform artifact for your cloud and extract it. The extracted infra/<cloud>/onboarding/ directory holds the module, terraform.tfvars.example, and scripts/verify.sh. Save the generated values as terraform.tfvars in that directory and apply the module:

    Bash
    cd "infra/<cloud>/onboarding"
terraform init
terraform plan
terraform apply

    Replace <cloud> with aws, gcp, or azure. Run the local boundary check for your cloud, register the Terraform outputs in guided setup, and run automated credential validation. This is the only terraform apply in the path: validation can pass only after the apply, and the connector shows Connected once it does.

  • Provider API: enter customer-provided provider-account credentials in-product, read-only wherever the provider offers read-only credentials. Automated credential validation must pass.

  • Provider export upload: upload a supported provider export file and confirm its schema, period, and source identity.

The local boundary check inspects what the module granted, from your side of the trust boundary; Verify & confirm gives the commands and pass rule for each cloud. For AWS, the role trusts only Venturi’s principal and cannot be assumed with your credentials, so you list the role’s policies, which is the complete check, and spot-check writes with the IAM policy simulator. For Google Cloud, run ./scripts/verify.sh with PROJECT_ID and SERVICE_ACCOUNT_EMAIL; its project-scope role lines must be exactly roles/monitoring.viewer, roles/logging.viewer, and roles/serviceusage.serviceUsageConsumer. For Azure, run ./scripts/verify.sh with SUBSCRIPTION_ID and CLIENT_ID from a session whose identity holds only Reader on the subscription, then list the service principal’s role assignments with --all; that listing, not the script’s role allowlist, proves the boundary. Automated credential validation then runs as Venturi’s identity and proves the positive reads and the denied writes.

Map identity and cost

Role: Engineer for source mapping; Admin for role or directory changes.

Connect identity evidence, map account and project dimensions to teams and cost centers, and inspect unmapped values. Preserve unknowns instead of assigning them speculatively.

Deploy

Role: Engineer with deployment access.

Activate the evidence source you added. For a cloud connector, the module is already applied, so do not apply it again: confirm that its local boundary check still meets its pass rule, activate the connector, and pass the 1st readiness probe. Deploy shows the check commands if the module or any role assignment changed since the apply. For a provider export file, confirm the accepted import and activate its period. The platform classifies evidence from the ready source and resolves canonical invocations through Stage A before inference. RAIL (Resource Attribution & Inference Layer) receives only eligible unresolved ownership relationships.

Verify active use

Role: Engineer or authorized viewer with quality-feed access.

Open the quality feed and inspect the 1st AttributionRecord. Confirm its source, identity and cost mapping, evidence, coverage, unknown state, and freshness.

Continue to production onboarding

Support can help recover a failed step, but no support action is required to reach either milestone. See Support.

Give feedback on this page

Sign in to send feedback. Opens in a new tab.

Copy page details 
Docs feedback: 30-minute quickstart
Page: https://docs.venturi.systems/quickstart/