Frequently Asked Questions#

General#

What is Reply CMP?

Reply CMP is a multi-cloud management platform. It gives you a single view of resources, costs, policies, and operations across Azure, AWS, and GCP. See What is Reply CMP?.

Which cloud providers are supported?

Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).

How is data refreshed?

Discovery syncs run on a configurable schedule (default: daily). Cost data is ingested daily from each provider’s billing API at T-1 (previous day). You can trigger an on-demand Discovery sync from the Connections tab in Administration.

Where can I find Reply CMP online?

Reply CMP is listed on the Microsoft Azure Marketplace — get in touch with the Cluster Reply team to request access or a demo: marketplace.microsoft.com → Reply CMP

For a full product overview, case studies, and contact information, visit the Cluster Reply official product page: reply.com → Cloud Management Platform

Is there a mobile app?

No. However, a PWA is available and can be installed from the Install button in the sidebar, to use Reply CMP on your tablet or mobile.

Discovery#

Why are some of my resources not appearing in Discovery?

This is usually one of three causes:

  1. The connection for that account has not completed a full sync yet — wait for the next scheduled sync or trigger one manually.

  2. The resource type is not in the Discovery coverage list — see Supported Services.

  3. The cloud credentials are expired or lack read permissions for that resource type.

Why does a resource show “Not provisioned via CMP”?

This means the resource exists in your cloud account but was not created through the Reply CMP provisioning wizard. Most resources will show this. The label helps you distinguish managed (CMP-provisioned) from unmanaged resources.

How often does Discovery run?

The default schedule is daily. Your administrator can configure a more frequent schedule per connection. You can also trigger an on-demand sync from Administration → Connections → Launch Discovery.

What does the “View in Provisioning” link on a resource mean?

It appears on resources that were created through the Reply CMP provisioning wizard. Clicking it navigates to the deployment record in the Provisioning section.

FinOps#

Why are some of my resources showing €0 cost?

Several causes:

  • The resource may be covered under a spend commitment (Reserved Instance, Savings Plan, or CUD) that results in zero marginal cost — the cost appears on the commitment line instead.

  • The resource may have been inactive for the billing period.

  • Cost data for that resource type may not be available for your provider plan or tier.

What is the difference between Actual and Amortised cost?

Actual cost shows what is billed on each day (including full upfront reservation charges on the day they are billed). Amortised cost spreads reservation and savings plan charges evenly over the commitment term. Use Amortised for day-to-day operational views; use Actual for reconciling with your cloud invoice. See The FinOps Lifecycle.

My allocation shows a large “Other” group — what does this mean?

“Other” contains costs not attributed to any Group, Environment, or Project in your hierarchy. This happens when resources don’t match any allocation rules. Create allocation rules in FinOps → Allocate to reduce the Other bucket. See Allocate — Assign Cost Ownership.

Why can’t I add a budget to a Group node?

A Group node can have one budget. If a budget already exists on that node, delete it before creating a new one. Budget creation also requires FinOps.Budget / Write permission.

Optimize & AI Savings Estimation#

How are the “AI savings estimates” calculated?

The platform runs a ReAct-pattern AI agent that queries your actual billing history for the affected resources, applies the recommendation’s expected saving, and caps the result to the actual resource cost. See AI Savings Estimation for the complete methodology.

Can I trust Low confidence savings estimates?

Low confidence means no cost history was found for the affected resources — the estimate is heuristic. It indicates an opportunity exists but the size is uncertain. Use High confidence estimates for business cases; treat Low confidence as a flag to investigate further.

Why didn’t the AI savings estimates update after I added a new connection?

Estimates are computed at recommendation refresh time. After adding a new connection, wait for the first cost data ingestion (T-1) and then click Refresh on the Optimize tab. The AI will re-run with the new data.

Provisioning#

What is the difference between a Deployment and a Resource?

A Deployment groups Resources, cloud Connections and aliases, a tenant runner and one protected state location. A Resource is one configured instance of an approved module inside that Deployment. One Plan or Apply covers all pending Resource changes. See Manage Deployments and operations.

What is the difference between a module and a module version?

A module is a stable record for one Terraform repository path. A module version is an immutable exact commit with a semantic version, input schema, provider locks and content digests. Only approved versions can be selected for new Resources. See Module registry.

Does Register module import every module in my repository?

No. One registration represents one module path. Register separate records for other paths in a monorepo; they can all use the same repository and credential.

Where do I enter the schema and provider checksums when creating a version?

You do not enter them in the UI. Commit schema.json and the file generated by terraform providers lock (.terraform.lock.hcl) in the selected module path. Reply CMP reads and validates both from the server-resolved commit.

Why is the Dispatch credential list empty?

Add an active credential of the matching provider under Provisioning → Module registry → Credentials. A revoked, incompatible or unused-metadata-only record is not selectable.

Where is Terraform state stored? Can I bring my own backend?

New Deployments use your Azure Blob account. Reply CMP requires Entra ID-only access, disabled anonymous access, a private container, secure HTTPS traffic, versioning, at least 14 days of blob and container soft delete, TLS 1.2 and a generated per-Deployment state key. The account endpoint may be public or private as long as the selected runner can reach it. Raw state is never proxied or downloaded by Reply CMP. See Configure runners and Terraform state.

How do I move an existing Deployment to customer-owned state?

Freeze the old runner, back up the complete existing state and copy it to the exact deterministic key shown in Runner & state. Then run Plan and require no creates, deletes or replacements before Apply. If an individual live object is not present in the old state, import it at the exact address returned by state-adoption-required. See Adopt an existing Deployment.

What is REPLY_CMP_EXPECTED_API_BASE_URL?

It is a non-secret endpoint trust pin committed in the protected runner file. It prevents a dispatched operation from redirecting the runner to another control plane. The current downloadable starters already pin the production endpoint; change it only when Reply CMP support provides another environment URL.

Can I use Azure DevOps or GitHub to run Terraform?

Yes. Configure either a protected Azure DevOps pipeline or GitHub Actions workflow per Deployment. A vault credential dispatches it; runtime callbacks and Azure access use workload identity federation. Starter repositories are available in the Provisioning quickstart.

Can I attach multiple cloud providers to the same Deployment?

Yes. Attach Connections for Azure, AWS and GCP and select the intended provider alias on each Resource. You can also use multiple accounts of the same provider with unique aliases. All Resources still share the Deployment operation and state lifecycle.

Why is a Resource still Draft?

Saving input does not change the cloud. Create a Plan, review policy and Apply the exact saved plan. A successful Apply changes the Resource to Latest.

What happens if a plan shows unexpected changes?

Do not Apply it. Check the Resource input, pinned module version, aliases and out-of-band provider changes, then create a fresh Plan. Apply never replaces the displayed saved plan with a hidden re-plan.

Can I delete a Deployment directly?

Only when it is Tainted. Schedule every Resource for deletion, Plan and Apply the destruction, then delete the empty Deployment record.

How do I configure a Deployment for Terraform execution?

Open Runner & state, choose the tenant-owned Azure DevOps or GitHub runner and its dispatch credential, then select the protected state backend. Reply CMP validates the configuration and locks the backend identity before the first Apply. See Configure runners and Terraform state.

Automation#

Does Reply CMP support auto-scaling, not just start/stop?

Currently, Start/Stop and Tag Enforcement policies are supported. Auto-scaling configuration is on the roadmap but not yet available.

My Stop policy ran but some VMs were not stopped. Why?

Check the policy execution results (Automation → Policies → Execution History). Resources showing “Failed” may have had insufficient permissions on the cloud connection, or were in a state that prevented the action. Resources showing “Skipped” may have been excluded by a rule or were already in the target state.

Are policies applied to future resources added to a Group?

Yes. Policies are scoped to a Group node — any resource allocated to that Group in the future will automatically be covered by the policy at the next scheduled run.

Monitoring#

Why does a dashboard widget show “Query error”?

The cloud connection used by the widget may have expired credentials or insufficient permissions. Go to Administration → Connections and check the connection status. Use the “Test query” button in the widget editor to surface the exact API error. See Connect a Provider for per-provider permission requirements, and Troubleshooting for the full troubleshooting guide.

How often are monitoring charts refreshed?

Widget data is fetched live on page load. There is no automatic background polling — refresh the page to see the latest data. Alert Rules are evaluated on their configured schedule, independently of the dashboard view.

I created an alert rule but it fired immediately. Is this a bug?

No. If the threshold condition is already met when the rule first evaluates, it fires on first run by design. This confirms the rule is working correctly.

Can I attach the same webhook to multiple alert rules?

Yes. A single webhook endpoint can be attached to any number of alert rules. Each rule that fires or resolves will trigger a separate delivery to the endpoint.

Does Reply CMP retry a failed webhook delivery?

No. Each delivery is a single attempt. If delivery fails, the failure is recorded in the webhook’s delivery history. Use the Test button after fixing the target endpoint to confirm connectivity, and use the Evaluate now button on the rule to trigger a fresh notification if needed.

What payload format does a Webhook deliver?

The Webhook type sends an HTTP POST with a JSON body containing the event type, alert rule details, evaluated value, and timestamp. If a signing secret is configured, a X-Reply-CMP-Signature header is included with an HMAC-SHA256 of the raw body. The Microsoft Teams type sends a MessageCard formatted for Teams connectors.

Administration#

Can I have more than one Owner?

Yes. Multiple users can hold the Owner role. It is recommended to have at least 2 Owners for resilience.

I can’t assign a role to a user. Why?

You can only assign roles whose permissions are a subset of your own (the superset rule). If the role you want to assign requires permissions you don’t hold, ask an Owner to make the assignment. See Roles & Permissions Reference.

A user left the company — what do I do?

  1. Go to Administration → Users → find the user.

  2. Open their User Role Drawer → click “Remove user”.

  3. Separately, remove their Azure AD guest account from Microsoft Entra ID.

  4. Optionally, review Audit Logs to see their recent activity.

Forecasting#

Why does my forecast look flat?

There is not yet enough variation in the data to identify a trend or seasonal pattern. As more billing data arrives the forecast will become more expressive.

The forecast dropped to zero for a resource — why?

If a resource had days with no cost (e.g. it was turned off, or billing data arrived late), those gaps are filled with near-zero values. If a resource was decommissioned, the forecast will naturally decay toward zero.

Can I see a forecast beyond 30 days?

The platform supports longer forecast horizons. The default view currently shows 30 days.

CMP Agent#

What language can I use with the CMP Agent?

The Agent understands queries in any language and always responds in the language you write in — including generated reports.

Is the CMP Agent accessing my data right now even when I’m not chatting?

No. The Agent only queries data when you send a message. It does not run background queries or maintain an active data connection when the chat panel is closed.

The CMP Agent gave me an incorrect answer. What should I do?

AI responses may sometimes be inaccurate. Cross-check important figures in the FinOps module directly. For cost figures, use FinOps → Analyze with the same filters the Agent described. Report inaccuracies to your platform administrator.

Can the CMP Agent deploy resources or make changes?

No. The only write action the CMP Agent can perform is triggering a Discovery sync (which requires your explicit confirmation in chat). It cannot create, edit, or delete cloud resources.

Support#

How do I get additional support?

For questions not covered here, reach out to the Reply CMP team directly at cmp@reply.it.