Skip to main content

Connect AWS

Summary​

Connect AWS accounts to Costimizer for billing analysis, resource discovery, and optimization recommendations.

Required role: Organization Manager or Manage Cloud Credentials
Estimated time: 15–30 minutes depending on CUR setup

Navigate to Accounts → Connect Cloud Account → AWS.

Why this method​

Assumed Role is the recommended way to connect to AWS. It uses temporary credentials; no long-lived access keys are stored anywhere. Costimizer assumes a role in your account using AWS Security Token Service (STS), which means access can be revoked instantly if needed. It also follows AWS best-practice guidance for cross-account access.

Prerequisites (AWS Billing Data Export)​

You must configure a Billing Data Export in AWS before connecting. Costimizer reads billing data from an S3 bucket — it does not use the AWS Cost Explorer API directly.

Step-by-step: Configure billing export​

  1. Log in to the AWS Console.
  2. Go to AWS Billing & Cost Management.
  3. Navigate to Data Exports.
  4. Click Create and select Standard Data Export (CUR 2.0). This is the recommended format. Legacy CUR is also supported but not advised.

AWS Billing Data Exports — Create Standard Data Export

  1. Configure the export settings:
    • Enable Include resource IDs
    • Set time granularity to Hourly or Daily (Hourly recommended)
    • Enable Overwrite existing export files

AWS export settings — Include resource IDs

AWS export settings — time granularity and overwrite

  1. Choose or create an S3 bucket and set an S3 path prefix.

AWS export — choose S3 bucket and path prefix

AWS export — S3 bucket configuration

  1. Review and confirm the export creation.

AWS export — review and confirm

Billing exports are usually ready within 24 hours of creation.

Create the IAM Role in AWS​

  1. In AWS Console, go to IAM → Roles → Create role.
  2. Select Trusted entity type: AWS account → Another AWS Account.
  3. Enter the Costimizer Access Account ID (provided by Costimizer).
  4. Give the role a recognisable name, for example: CostimizerCrossAccountRole.
  5. Attach a read-only policy covering:
    • AWS Billing & Cost Management
    • S3 (the billing export bucket)
    • EC2, ELB, CloudWatch (read-only)
    • Cost & Usage Reports / Data Exports
  6. Complete role creation.

AWS IAM — select trusted entity type Another AWS Account

Trust Policy JSON:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<COSTIMIZER_ACCOUNT_ID>:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Connect in Costimizer UI​

  1. Log in to Costimizer.
  2. Go to Accounts in the left menu.
  3. Click Connect Cloud Account.
  4. Select AWS, then choose Assumed Role as the connection type.
  5. Fill in the following fields:
    • Name — a label for this account (e.g., AWS Production)
    • AWS Account ID — your target AWS account ID
    • Assumed Role Name — the name of the IAM role created above
    • Export Type — select Standard Data Export (CUR 2.0) or Legacy CUR
    • Export Name — the name you gave your billing export
    • S3 Bucket Name — the bucket where billing data is stored
    • S3 Path Prefix — the folder path within the bucket
    • Export Region — the AWS region of the S3 bucket
    • AWS EDP (Enterprise Discount Program) — check this box if applicable
  6. Click Connect.

What happens next​

Billing data ingestion starts automatically after the connection is verified. The first data usually appears within a few hours. Full CUR data can take up to 24 hours, depending on when AWS last generated your billing export.

Troubleshooting​

SymptomFix
Connection validation failsVerify trust policy external ID and role ARN
No cost dataConfirm CUR files arrive in S3; check bucket policy
Missing resourcesEnable resource discovery permissions on the IAM role

See Connection failures for more detail.