Integrate Amazon Web Services Account with CloudSpend

You can provide CloudSpend programmatic access to your AWS resources using two ways. You can create a cross-account IAM Role and establish a trust relationship between your AWS account and CloudSpend's AWS account.

Between the two, IAM Role is recommended as there is no sharing of security credentials. Also when you delegate permissions using Roles, you can designate the AWS accounts that are allowed to assume the role, thereby safeguarding your account from unauthorized access.

IAM role based access

The following section will walk you through the IAM Role creation process:

Get your External ID

1. Open the CloudSpend web console and sign in.

2. When you open the CloudSpend console for the first time, you'll land on an on-boarding carousel highlighting the features of the app. You can read and understand how the app can help you, or you can choose to skip.

   

3. Click Integrate AWS Account. In the Integrate AWS Account page, provide a Display Name, and choose IAM role as the Access Type. Copy the Account ID and External ID and save the value in a notepad for the AWS IAM Role creation step. Also, keep this browser tab open.

   

Copy Role ARN

1. Go to IAM > Roles page.
2. Click the refresh button.
3. Search the role name that you created and click the role name hyperlink.

4. Copy the ARN details from the Summary section and paste it in the CloudSpend>Integrate Account> Role ARN field.

   

IAM User based access (deprecated)

The following section will walk you through the AWS IAM user creation process:

Select Access Type

1. Sign in to the AWS Management Console and open the IAM console.

   If you're using the consolidated billing feature in AWS Organizations to bring multiple member accounts under a master account then sign in to the AWS management console of the master account. If you're running multiple standalone accounts (choose to have each account receive a bill) then login to the AWS account you want to integrate with CloudSpend.

2. In the navigation pane, click Users and then click Add user.

   
3. For user name, type a meaningful name.

4. Select Programmatic access as the type of access.

   
5. Click Next: Permissions.

Assign permissions

1. In the Set permissions window, choose the option Attach existing policies to user directly and click Create policy to open a new browser tab.

   
2. Choose the JSON tab. Copy the custom policy shown below and paste it in the editor.
    

     
   {
      "Version":"2012-10-17",
      "Statement":[
   
            {
               "Sid":"VisualEditor0",
               "Effect":"Allow",
               "Action":[
                  "organizations:ListRoots",
                  "s3:GetObjectVersionTagging",
                  "organizations:DescribeAccount",
                  "organizations:ListChildren",
                  "s3:GetObjectAcl",
                  "organizations:DescribeOrganization",
                  "s3:GetObjectVersionAcl",
                  "organizations:DescribeHandshake",
                  "s3:GetBucketWebsite",
                  "s3:GetBucketNotification",
                  "s3:GetReplicationConfiguration",
                  "s3:ListMultipartUploadParts",
                  "organizations:ListAccountsForParent",
                  "organizations:ListHandshakesForAccount",
                  "s3:GetObject",
                  "iam:GetUserPolicy",
                  "s3:GetAnalyticsConfiguration",
                  "organizations:ListOrganizationalUnitsForParent",
                  "s3:GetObjectVersionForReplication",
                  "cur:DescribeReportDefinitions",
                  "s3:GetLifecycleConfiguration",
                  "s3:GetBucketTagging",
                  "s3:GetInventoryConfiguration",
                  "s3:ListBucketVersions",
                  "s3:GetBucketLogging",
                  "s3:ListBucket",
                  "s3:GetAccelerateConfiguration",
                  "s3:GetBucketPolicy",
                  "organizations:DescribePolicy",
                  "s3:GetObjectVersionTorrent",
                  "s3:GetEncryptionConfiguration",
                  "organizations:ListCreateAccountStatus",
                  "s3:GetBucketRequestPayment",
                  "organizations:DescribeOrganizationalUnit",
                  "s3:GetObjectTagging",
                  "s3:GetMetricsConfiguration",
                  "organizations:DescribeCreateAccountStatus",
                  "organizations:ListPoliciesForTarget",
                  "s3:ListBucketMultipartUploads",
                  "organizations:ListTargetsForPolicy",
                  "s3:GetBucketVersioning",
                  "organizations:ListAWSServiceAccessForOrganization",
                  "s3:GetBucketAcl",
                  "organizations:ListPolicies",
                  "organizations:ListHandshakesForOrganization",
                  "organizations:ListAccounts",
                  "s3:GetObjectTorrent",
                  "s3:ListAllMyBuckets",
                  "s3:GetBucketCORS",
                  "organizations:ListParents",
                  "iam:GetUser",
                  "s3:GetBucketLocation",
                  "s3:GetObjectVersion",
                  "bcm-data-exports:ListExports",
                  "bcm-data-exports:GetExport"
               ],
               "Resource":"*"
            }
         ]
      }

3. Click Review policy.

   

4. On the review page, type a name and a description for the policy you're creating. Evaluate the permissions granted, if everything looks satisfying click Create policy.

   
5. Back in the Set permissions page, select Refresh, type the name of the policy you just created in the search box to filter the list.

6. Select the check box next to the name of the policy. Click Next: Review.

   

Download credentials

1. Review user details and permissions. If everything is in order click Create user.

   

2. Choose Download.csv and save the file in a secure location. (This is the only opportunity you will get to view or save the security credentials.)

   
3. Open the file, copy the secret access key and access key ID and save it to a notepad for Stage 3.

AWS CloudFormation stack based access

CloudSpend uses an AWS CloudFormation template to generate an IAM role, so that you can seamlessly integrate your AWS account with CloudSpend. Enabling access to your AWS environment automatically creates an IAM role using the CloudFormation template.

The following section will walk you through the IAM Role creation process using CloudFormation stack:

1. Open the CloudSpend web console and sign in.
2. When you open the CloudSpend console for the first time, you'll land on an on-boarding carousel highlighting the features of the app. You can read and understand how the app can help you, or you can choose to skip.
3. Click Integrate Account.
4. In the Integrate Account page, provide a Display Name, and select AWS as the Public Cloud Provider.
5. Select CloudFormation as the Access Type. 
6. Select the AWS region in which CloudFormation stack needs to be created. 
7. The Cost and Usage Report creation needed option is set to Yes by default. Toggle this option to No, if the Cost and Usage Report (CUR) is already created in your AWS account to avoid duplicate report creation.
8. Click Create CloudFormation Template. You will be redirected to the AWS console.
9. In the AWS console, you can edit the IAMRoleName, CURReportName, and S3BucketName if required. 
10. Select the acknowledgement check boxes at the bottom of the Capabilities section and click Create stack. The IAM role template will be created via the stack after CloudSpend receives the Lambda API call. 
11. After creating the IAM role, the CloudFormation stack sends the role ARN to CloudSpend via the Lambda function. If the Cost and Usage Report creation needed option is set to Yes then CloudSpend creates S3 Bucket and CUR Report in AWS via Lambda function. As a result, the report and S3 Bucket details are also fetched along with the role ARN details and the Role ARN, Report, and S3 Bucket fields will be displayed and auto-filled in the CloudSpend Integrate Account page. 

If the Cost and Usage Report creation needed option is set to No then, CloudSpend creates only the role ARN via Lambda function. Once the role ARN details are fetched, the Role ARN field is auto-filled. You will have to enter the report name in the Report field manually.

AWS Data Exports enables you to create exports of the Cost and Usage Report (CUR) 2.0 or Legacy Cost and Usage Reports.

CloudSpend supports master and linked accounts. If you're using the consolidated billing feature in AWS Organizations, then create the data export at master account level. However, if you wish to view the cost and usage details at the linked account level, you have to create the data export for the respective linked account.

Exports are delivered on a recurring basis to an Amazon S3 bucket. To deliver the exports to an existing or new S3 bucket, follow the steps mentioned below. If you're already publishing the export to a S3 bucket, skip to Stage 3.

Creating a Data export

To create an AWS data export in an S3 bucket, follow the steps below to get started.

1. Sign in to the AWS console.
2. Select Billing and Cost Management.
   
3. Select Data Exports in the left navigation pane and click Create.
   
4. On the Create page, under Export type, choose Standard data export or Legacy CUR export.
   
5. Enter a name for your export name in the Export name field and save this name for later use.
6. Select the Include resource IDs checkbox under Additional exportcontent.
   1. For Standard data export, set the Time granularity as Hourly and keep the Column selection list at default. Under Data export delivery options, select Compression type and file format as gzip - text/csv. Choose the File versioning as Overwrite existing data export file.
      
   2. For Legacy CUR export, set the Report data time granularity as Hourly and select the Overwrite existing report option for Report versioning. Select gzip as Compression type.
      
7. To configure the S3 bucket, click Configure under Data export storage settings. You can either create a S3 bucket or configure an existing S3 bucket.
   1. Choose Create a bucket to create a new S3 bucket. Provide a S3 bucket name, choose the Region, and click Create bucket.
      
   2. Choose Select existing bucket to configure an existing S3 bucket, and select the required S3 bucket from the S3 bucket name list. Select the I agree to overwrite my S3 bucket policy checkbox and click Select bucket.
      
8. Enter the S3 path prefix. Save the S3 bucket name and S3 path prefix for later use.
   
9. Click Create.

Configure the Integrate AWS account page

1. If you've created an IAM Role, navigate back to the open CloudSpend console browser tab (the same tab where you copied the External ID and Account ID) and paste the Role ARN in the appropriate field. 
2. If you've automatically created an IAM role with CloudFormation template, then the Role ARN, Report, and S3 Bucket fields will be auto-filled. You will have to enter the export name in the Export Name field manually when the Cost and Usage Report creation needed option is set to No.
3. If you've created an IAM user, sign in to the CloudSpend web console and click Integrate Account. Enter a Display Name, and choose IAM user as the Access Type. Copy and paste the Access key ID and Secret Access Key in the appropriate field. (This method is deprecated.)
4. If you've chosen Organization as Account Type, then copy and paste the name of the export you already created in the Export name field. In case of Linked Accounts,copy and paste the Export name, S3 bucket name and path prefix which you created in the Creating a data export section above.
5. The Start Date for Bill Processing determines the start date from which bills will be processed. Choose an appropriate starting date as per your requirement.
6. Click Save.