Integrate Amazon Web Services Account with CloudSpend

Integrating your AWS account with CloudSpend provides a comprehensive view of your cloud spending.

CloudSpend reads your AWS billing data and turns it into cost reports, budgets, anomaly alerts, and optimization recommendations. To do that, it needs two things from your AWS account:

Read-only access - an IAM role that CloudSpend can assume to read your billing objects.
A billing data export - a Cost and Usage Report delivered on a schedule to an Amazon S3 bucket.

The Integrate Account page is a step-by-step wizard with a toggle at the top offering two ways to set this up:

Automated integration: A CloudFormation stack creates the IAM role and, optionally, the data export for you.
Manual integration: You create the IAM role and the data export yourself in the AWS console.

This page documents each one end-to-end, so you only need to read the section for the path you choose.

New to CloudSpend? Start at Get started with CloudSpend for a product overview, then come back here.

Before you begin

Have these ready before you open the wizard.

What you need	Why	Where to get it
A CloudSpend account with permission to add integrations	The Integrate Account wizard is admin-only.	User Management - Access Control
Sign-in to the correct AWS account	For an AWS Organization, sign in to the management (payer) account. For a standalone account, sign in to that account.	AWS Management Console
Permission to create IAM roles and policies in AWS	Both paths create a cross-account IAM role.	Your AWS administrator
Permission to create CloudFormation stacks	Required for Automated integration, and for the CloudFormation access type under Manual integration method.	Your AWS administrator
Permission to create Data Exports and S3 buckets	Required for Manual integration method.	AWS Billing and Cost Management
The month you want billing to start from	Sets how far back CloudSpend loads your past bills.	Your own reporting requirement.

How the integration works

AWS writes your billing data to an S3 bucket in your account, on a recurring schedule, as a Cost and Usage Report (CUR 2.0 or Legacy CUR).
CloudSpend assumes the cross-account IAM role you created. The role’s trust policy names CloudSpend’s AWS account and requires a unique External ID, so no one else can assume it.
CloudSpend reads the report from S3, it never touches your workloads, and parses it into cost, usage, and tag data.
CloudSpend builds your reports and evaluates your budgets, anomaly checks, and governance checks against the parsed data.

The Choose Policy Options section on the Access & Credentials page has three preselected options: Default Permissions, IT Automations, and Recommendations. These options grant permissions for executable actions, such as starting, stopping, and rebooting resources.

Which integration should you choose?

At the top of the Integrate Account page there is a toggle with two options: Automated and Manual. Choose the method based on how you want to configure access and the AWS resources required for the integration.

Integration aspect	Automated integration	Manual integration
How access is created	A CloudFormation stack creates the IAM role for you	You create the IAM role by hand in the IAM console, or run the CloudFormation stack yourself
How the export is created	The same stack can create the S3 bucket and the Cost and Usage Report.	You create the Data Export yourself in AWS Billing and Cost Management
Access types offered	Management Account, Delegated Admin	CloudFormation, IAM Role, IAM User (deprecated), Site24x7 Account
Choose this when	You can run CloudFormation in the account, and you want the fastest setup	Your organization restricts CloudFormation, you already publish a CUR to S3, or your security team requires the role to be reviewed before creation
Go to	Automated integration	Manual integration

Automated integration

The automated integration setup takes four steps:

Step 1: Account basics
Step 2: Access & credentials
Step 3: Processing date
Step 4: Review & activate

With this integration method, CloudSpend generates an AWS CloudFormation template based on your account details. Run the template in the AWS console to create the required read only IAM role. You can also choose to let the CloudFormation stack create the S3 bucket and Cost and Usage Report for you.

After the stack is successfully created, it sends the IAM role ARN back to CloudSpend. The wizard then automatically populates the relevant fields, so you can continue with the remaining configuration.

Ensure that:

You have permission to create CloudFormation stacks and IAM resources in the AWS account.
You are signed in to either the management (payer) account or a delegated administrator account for AWS Billing and Cost Management.

Step 1: Account basics

Sign in to the CloudSpend web console. If this is your first time in CloudSpend, you land on an onboarding carousel that introduces the product. Read it or skip it. Either way you end up on the same page.
Click + Integrate Account in the top right corner.
At the top of the page, make sure the toggle is set to Automated.
Under Identify this account, enter a Display Name.
Under Where does the spend live?, select AWS as the Provider.

Provider	Access method	View
AWS	CloudFormation or IAM role access	This page
Azure	App registration + exports	Connect Azure Account
GCP	BigQuery billing export	Connect GCP Account

Select the Environment:
1. Global: Standard AWS commercial regions. Choose this unless you are certain otherwise.
2. Gov Cloud (US): See the AWS GovCloud (US) accounts before you continue, because the account you sign in to is not the GovCloud account.
Click Next.

Step 2: Access & credentials

Choose your access type

Access type	Choose this when
Management Account: Automated, from the management account	You are signed in to the management (payer) account of your AWS Organization, or to a standalone AWS account. Most common choice.
Delegated Admin: Automated, from a delegated admin Delegated Admin prerequisite: The account must already be registered as a delegated administrator for AWS Billing and Cost Management in your Organization. If it is not, the stack will fail with a permissions error. Register it from the management account, or use Management Account instead.	Billing administration has been delegated to a member account and you are signed in to that account.

Run the automated setup

The panel shows a three stage progress bar. Stage 2 is where CloudSpend waits for the CloudFormation stack to complete.

Stage	What is happening	Where it happens
Step 1: CloudFormation Stack Creation	CloudSpend generates a CloudFormation template for your account and hands you a link to it	CloudSpend
Step 2: Waiting for RoleARN	You create the stack in AWS; the stack creates the IAM role and calls back to CloudSpend with the role’s ARN	AWS, then back to CloudSpend
Step 3: Integrate Role ARN	CloudSpend stores the ARN and fills in the remaining fields for you	CloudSpend

Configure the template

AWS region in which CloudFormation stack needs to be created: Select a region. This is only where the stack runs. It does not limit which regions CloudSpend reports on. Cost data for every region in the account is included regardless. Use the recommended region unless a policy in your organization requires otherwise.
Set the Cost And Usage Report Creation option needed option to Yes or No as required.
1. Yes: The stack also creates an S3 bucket and a Cost and Usage Report for you. After the stack finishes, the Report and S3 Bucket fields are filled in automatically.
2. No: The stack creates only the IAM role. Choose this if you already publish a CUR to S3 and do not want a duplicate report. You will need to enter the export name yourself; see If you chose No section for report creation.
Choose Policy Options: Select which permission sets to include in the generated policy. The default selection covers standard cost and usage reporting.
Click Create CloudFormation Template. CloudSpend opens the AWS CloudFormation console in a new tab with the template URL and parameters prefilled. Keep the CloudSpend tab open and do not refresh it, as this can restart the process.
In the AWS console, review the pre filled parameters. You can edit IAMRoleName, CURReportName, and S3BucketName if required.
Select the acknowledgement check boxes at the bottom of the Capabilities section and click Create stack. The IAM role template will be created via the stack after CloudSpend receives the Lambda API call.
After creating the IAM role, the CloudFormation stack sends the role ARN to CloudSpend via the Lambda function. If the Cost and Usage Report creation needed option is set to Yes then CloudSpend creates S3 Bucket and CUR Report in AWS via Lambda function. As a result, the report and S3 Bucket details are also fetched along with the role ARN details and the Role ARN, Report, and S3 Bucket fields will be displayed and auto-filled.
Click Next.

If you chose No for report creation

If the Cost and Usage Report creation needed option is set to No then, CloudSpend creates only the role ARN via Lambda function. Once the role ARN details are fetched, the Role ARN field is auto-filled. You will have to enter the report name in the Report field manually.

Step 3: Processing date

Processing window
- Start Date for Bill Processing: Choose the month from which CloudSpend begins processing your bills. It controls how far back CloudSpend loads your past bills, which affects both what you can compare against and what you are charged. The wizard notes that all historical bills from this date forward will be processed and charged. See Pricing Details before choosing a distant start date.
Notify Alerts Via: Choose how CloudSpend should send notifications. Select Users to notify one or more individual CloudSpend users, or User Group to notify all members of a selected user group. Using user groups simplifies notification management because any changes to the group membership are automatically reflected in the notification profile.
Contacts: Select the users or user groups that should receive notifications when an associated check is breached.
Add Label: Optionally attach key value Labels to this integration. Enter a Label Key and Label Value, then click the + icon to add another pair, or the delete icon to remove one. Labels are CloudSpend side metadata, useful for filtering and grouping accounts in reports, independent of AWS tags. See Labels.
Click Next.

Step 4: Review & activate

The final step summarizes everything you have configured. Each card has an Edit link that takes you back to that step with your values intact.

Card	Fields shown
Account basics	Display Name, Provider, Environment
Access & credentials	Choose Onboarding Type (Automated), Access type, Status, Account scope, Existing export, Report
Processing date	Bill processing month, Notify Alerts Via, Contacts, Add Label

Click Submit once you have verified all the details.

If you encounter any issues, see Troubleshooting for possible causes and solutions.

Manual integration

The manual integration method has five steps:

Step 1: Account basics
Step 2: Access & credentials
Step 3: Billing data
Step 4: Processing date
Step 5: Review & activate

In this method you do the AWS side work yourself. The extra Billing data step is where you create the Cost and Usage Report export, optionally enable AWS Cost Optimization Recommendations, and tell CloudSpend whether you are reporting on a whole organization or a single linked account.

Step 1: Account basics

Sign in to the CloudSpend web console. If this is your first time in CloudSpend, you land on an onboarding carousel that introduces the product. Read it or skip it. Either way you end up on the same page.
Click + Integrate Account in the top right corner.
At the top of the page, make sure the toggle is set to Manual.
Under Identify this account, enter a Display Name.
Under Where does the spend live?, select AWS as the Provider.

Provider	Access method	View
AWS	CloudFormation or IAM role access	This page
Azure	App registration + exports	Connect Azure Account
GCP	BigQuery billing export	Connect GCP Account

Select the Environment:
1. Global: Standard AWS commercial regions. Choose this unless you are certain otherwise.
2. Gov Cloud (US): See the AWS GovCloud (US) accounts before you continue, because the account you sign in to is not the GovCloud account.
Click Next.

Step 2: Access & credentials

Choose your access type. The manual method offers four ways to give CloudSpend access.

Access type	Description	Choose this when
CloudFormation	Recommended, approximately 3 minutes	You can run CloudFormation and want the role created for you
IAM Role	Create the role manually	You want to create the role by hand, or CloudFormation is restricted in your organization.
IAM User	Use an IAM user’s access keys	Deprecated. Only for existing setups that already rely on access keys.
Site24x7 Account	Reuse an existing connection	You already monitor this AWS account on Site24x7 and want to reuse that connection instead of creating new credentials.

The steps you need to complete depend on the access type you select. Complete the required setup for your selected option, then click Next to continue to Step 3: Billing data.

CloudFormation access type

The Create the CloudFormation stack panel is the same as on the Automated path. It has the same three stage progress bar, region and report creation controls, and Create CloudFormation Template button.

Follow Run the automated setup mentioned in the Automated integration method, then return here and click Next to continue to Step 3: Billing data.

IAM Role access type

Selecting IAM Role opens the Create the IAM role panel, which displays the full procedure inline with a screenshot carousel beside each stage. Delegate access to your AWS resources through the IAM role by following the steps and screenshots in the panel. Make sure you have the required policies for CloudSpend. If not, create your own policy before creating the IAM role.

The IAM Role access type is recommended as there is no sharing of security credentials. Also when you delegate permissions using Roles, you can designate the AWS accounts that are allowed to assume the role, thereby safeguarding your account from unauthorized access.

Note:

We've deprecated the IAM user-based access to new users. So if you're existing users, you can switch to IAM role based access.
Why an IAM role rather than access keys?

A role is assumed temporarily and there are no long lived credentials to store, rotate, or leak. The trust policy names exactly one AWS account, CloudSpend’s, and requires a matching External ID, so the role cannot be assumed by anyone else.

The following section will walk you through the IAM Role creation process.

Create a custom policy

Sign in to the organization’s master AWS account. For an AWS Organization using consolidated billing, sign in to the management (payer) account. That is where the consolidated bill lives. For standalone accounts, sign in to the account you want to integrate.
Select Access Management > Policies from the left navigation pane.
Click Create policy.
Choose the JSON tab and delete the existing JSON policy snippet.

Click Copy Policy in the CloudSpend wizard, then paste the custom cost policy into the JSON tab. Alternatively, you can copy the JSON policy given below.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "organizations:ListRoots",
                "s3:GetObjectVersionTagging",
                "organizations:DescribeAccount",
                "organizations:ListChildren",
                "s3:GetObjectAcl",
                "organizations:DescribeOrganization",
                "s3:GetObjectVersionAcl",
                "organizations:DescribeHandshake",
                "s3:GetBucketWebsite",
                "s3:GetBucketNotification",
                "s3:GetReplicationConfiguration",
                "s3:ListMultipartUploadParts",
                "organizations:ListAccountsForParent",
                "organizations:ListHandshakesForAccount",
                "s3:GetObject",
                "iam:GetUserPolicy",
                "s3:GetAnalyticsConfiguration",
                "organizations:ListOrganizationalUnitsForParent",
                "s3:GetObjectVersionForReplication",
                "cur:DescribeReportDefinitions",
                "s3:GetLifecycleConfiguration",
                "s3:GetBucketTagging",
                "s3:GetInventoryConfiguration",
                "s3:ListBucketVersions",
                "s3:GetBucketLogging",
                "s3:ListBucket",
                "s3:GetAccelerateConfiguration",
                "s3:GetBucketPolicy",
                "organizations:DescribePolicy",
                "s3:GetObjectVersionTorrent",
                "s3:GetEncryptionConfiguration",
                "organizations:ListCreateAccountStatus",
                "s3:GetBucketRequestPayment",
                "organizations:DescribeOrganizationalUnit",
                "s3:GetObjectTagging",
                "s3:GetMetricsConfiguration",
                "organizations:DescribeCreateAccountStatus",
                "organizations:ListPoliciesForTarget",
                "s3:ListBucketMultipartUploads",
                "organizations:ListTargetsForPolicy",
                "s3:GetBucketVersioning",
                "organizations:ListAWSServiceAccessForOrganization",
                "s3:GetBucketAcl",
                "organizations:ListPolicies",
                "organizations:ListHandshakesForOrganization",
                "organizations:ListAccounts",
                "s3:GetObjectTorrent",
                "s3:ListAllMyBuckets",
                "s3:GetBucketCORS",
                "organizations:ListParents",
                "iam:GetUser",
                "s3:GetBucketLocation",
                "s3:GetObjectVersion",
                "bcm-data-exports:ListExports",
                "bcm-data-exports:GetExport"
            ],
            "Resource": "*"
        }
    ]
}

Click Next.
On the Review and create page, enter the Policy name and Description.
Click Create policy.

Follow the steps mentioned in the Select trusted entity, Add permissions, and Name, review, and create sections below for creating a cross-account IAM role.

Select trusted entity

Sign in to the organization’s master AWS account.
Search for IAM in the search bar and select IAM from the search results.
Select Access Management > Roles from the left navigation pane and click Create Role.
Select AWS Account from the Trusted entity type options.
Select Another AWS Account to register CloudSpend with your AWS account.
Enter Site24x7's AWS account ID in the Account ID field displayed in the Integrate AWS Account page.
Check the Require external ID box. Ensure that the box next to Require MFA is unchecked.
Enter the unique External ID displayed in the Integrate AWS Account page.
Click Next.

The External ID is regenerated every time the page reloads. It is an alphanumeric key unique to your integration. If you refresh the Integrate Account page, navigate away and back, or leave the tab idle long enough to re-render, you will get a new External ID and the one you already pasted into AWS becomes invalid.

Always copy it immediately before you create the role, and do not refresh the CloudSpend tab until the role exists.

Add permissions

Site24x7 requires ReadOnly access to your AWS services and resources.

In the Add permissions page, search and select the policy you created above. You can also search for and select ReadOnlyAccess which is the AWS managed - job function policy as required.
Note: If you wish to monitor the usage metrics of your Kinesis Video Streams, ensure that you also select AmazonKinesisVideoStreamsReadOnlyAccess.
Click Next.

Name, review, and create

Enter the Role name and Description.
Review the details configured in Select trusted entity and Add permissions sections.
Click Create Role. Once done, an ARN role will be created for the IAM role you created.

Copy Role ARN

Go to IAM > Roles page.
Click the refresh button.
Search the role name that you created and click the role name hyperlink.
Copy the ARN details from the Summary section and paste it in the CloudSpend > Integrate Account > Role ARN field.

Copy Role ARN

IAM User based access type (deprecated)

The following section will walk you through the AWS IAM user creation process.

Select Access Type

Sign in to the AWS Management Console and open the IAM console.
Note: If you're using the consolidated billing feature in AWS Organizations to bring multiple member accounts under a master account then sign in to the AWS management console of the master account. If you're running multiple standalone accounts (choose to have each account receive a bill) then login to the AWS account you want to integrate with CloudSpend.
In the navigation pane, click Users and then click Add user.
For user name, type a meaningful name.
Select Programmatic access as the type of access.
Click Next: Permissions.

Assign permissions

In the Set permissions window, choose the option Attach existing policies to user directly and click Create policy to open a new browser tab.

Choose the JSON tab. Click Copy Policy in the wizard, then paste the custom cost policy into the JSON tab. Alternatively, copy the custom policy shown below and paste it in the editor.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "organizations:ListRoots",
                "s3:GetObjectVersionTagging",
                "organizations:DescribeAccount",
                "organizations:ListChildren",
                "s3:GetObjectAcl",
                "organizations:DescribeOrganization",
                "s3:GetObjectVersionAcl",
                "organizations:DescribeHandshake",
                "s3:GetBucketWebsite",
                "s3:GetBucketNotification",
                "s3:GetReplicationConfiguration",
                "s3:ListMultipartUploadParts",
                "organizations:ListAccountsForParent",
                "organizations:ListHandshakesForAccount",
                "s3:GetObject",
                "iam:GetUserPolicy",
                "s3:GetAnalyticsConfiguration",
                "organizations:ListOrganizationalUnitsForParent",
                "s3:GetObjectVersionForReplication",
                "cur:DescribeReportDefinitions",
                "s3:GetLifecycleConfiguration",
                "s3:GetBucketTagging",
                "s3:GetInventoryConfiguration",
                "s3:ListBucketVersions",
                "s3:GetBucketLogging",
                "s3:ListBucket",
                "s3:GetAccelerateConfiguration",
                "s3:GetBucketPolicy",
                "organizations:DescribePolicy",
                "s3:GetObjectVersionTorrent",
                "s3:GetEncryptionConfiguration",
                "organizations:ListCreateAccountStatus",
                "s3:GetBucketRequestPayment",
                "organizations:DescribeOrganizationalUnit",
                "s3:GetObjectTagging",
                "s3:GetMetricsConfiguration",
                "organizations:DescribeCreateAccountStatus",
                "organizations:ListPoliciesForTarget",
                "s3:ListBucketMultipartUploads",
                "organizations:ListTargetsForPolicy",
                "s3:GetBucketVersioning",
                "organizations:ListAWSServiceAccessForOrganization",
                "s3:GetBucketAcl",
                "organizations:ListPolicies",
                "organizations:ListHandshakesForOrganization",
                "organizations:ListAccounts",
                "s3:GetObjectTorrent",
                "s3:ListAllMyBuckets",
                "s3:GetBucketCORS",
                "organizations:ListParents",
                "iam:GetUser",
                "s3:GetBucketLocation",
                "s3:GetObjectVersion",
                "bcm-data-exports:ListExports",
                "bcm-data-exports:GetExport"
            ],
            "Resource": "*"
        }
    ]
}

Click Review policy.
On the review page, type a name and a description for the policy you're creating. Evaluate the permissions granted, if everything looks satisfying click Create policy.
Back in the Set permissions page, select Refresh, type the name of the policy you just created in the search box to filter the list.
Select the check box next to the name of the policy. Click Next: Review.

cloud cost management user policy assignment

Download credentials

Review user details and permissions. If everything is in order click Create user.
Choose Download.csv and save the file in a secure location. (This is the only opportunity you will get to view or save the security credentials.)
Open the file, copy the secret access key and access key ID, and paste them into the Access Key ID and Secret Access Key fields in the CloudSpend Integrate AWS Account page.
Click Next.

After you enter the Access Key ID and Secret Access Key and click Next, proceed to Step 3: Billing data.

Site24x7 Account access type

Choose this if you already monitor this AWS account in Site24x7. CloudSpend reuses the IAM role or user that connection already has. You only need to attach a cost policy to it.

Link your Site24x7 account

Under Link your Site24x7 account, select the account to integrate from the Choose Site24x7 Account drop-down menu. The drop-down lists the AWS accounts already connected to your Site24x7 account.

Attach new cost policy

The Attach new cost policy panel explains how to delegate access to your AWS resources through a Site24x7 account.

Create policy

Create a new cost policy.
Select the JSON tab. Click Copy Policy in the wizard, then paste the custom cost policy.
Provide a name for your cost policy, and click Create policy.

Attach cost policy

Whether your Site24x7 account has an IAM role or an IAM user associated with it, follow the respective set of instructions to delegate access.

If your Site24x7 account uses an IAM Role:

Select the IAM role associated with your Site24x7 account.
Select Attach policies to attach your cost policy with the IAM role.
Select the cost policy to attach, and click Attach policy.

If your Site24x7 account uses an IAM User:

Select the user name associated with your Site24x7 account.
Select Add permissions.
Select the Attach existing policies directly tab to grant permission, select the cost policies, and click Next: Review.
Select Add permissions to attach the policy to the user.

After you select the Site24x7 account and attach the required cost policy, click Next to proceed to Step 3: Billing data.

MSP accounts: If you are working in a Site24x7 MSP account, choose the MSP customer first, then pick the AWS account associated with that customer. See Connecting an MSP account.

Step 3: Billing data

This step has three parts: the billing data export, the cost optimization recommendations export, and the account scope.

The Billing data panel asks whether you already deliver AWS cost data to an S3 bucket. Select Yes or No.

Yes: Enter the name of your existing export in the Export Name field.
No: Follow the steps below to create a new export.

AWS Data Exports enables you to create exports of the Cost and Usage Report (CUR) 2.0 or Legacy Cost and Usage Reports.

CloudSpend supports master and linked accounts. If you're using the consolidated billing feature in AWS Organizations, then create the data export at master account level. However, if you wish to view the cost and usage details at the linked account level, you have to create the data export for the respective linked account.

Exports are delivered on a recurring basis to an Amazon S3 bucket. To deliver the exports to an existing or new S3 bucket, follow the steps mentioned below.

Creating a Data export

To create an AWS data export in an S3 bucket, follow the steps below to get started.

Sign in to the AWS console.
Select Billing and Cost Management.
Select Data Exports in the left navigation pane and click Create.
On the Create page, under Export type, choose Standard data export or Legacy CUR export.
Enter a name for your export name in the Export name field and save this name for later use.
Select the Include resource IDs checkbox under Additional export content.
1. For Standard data export, set the Time granularity as Hourly and keep the Column selection list at default. Under Data export delivery options, select Compression type and file format as gzip - text/csv. Choose the File versioning as Overwrite existing data export file.
2. For Legacy CUR export, set the Report data time granularity as Hourly and select the Overwrite existing report option for Report versioning. Select gzip as Compression type.
To configure the S3 bucket, click Configure under Data export storage settings. You can either create a S3 bucket or configure an existing S3 bucket.
1. Choose Create a bucket to create a new S3 bucket. Provide a S3 bucket name, choose the Region, and click Create bucket.
2. Choose Select existing bucket to configure an existing S3 bucket, and select the required S3 bucket from the S3 bucket name list. Select the I agree to overwrite my S3 bucket policy checkbox and click Select bucket.
Enter the S3 path prefix. Save the S3 bucket name and S3 path prefix for later use.
Click Create.

Enable AWS Cost Optimization Recommendations

This optional export powers AWS native rightsizing and savings guidance inside CloudSpend, including the AWS Recommendations report and the AWS entries in Native Recommendations. Your cost reporting works without it.

The panel asks whether you already have the required export. Select Yes or No.

Yes: Select this if you already have the Cost Optimization Recommendations export.
No: Select this if you do not have the required export and follow the steps below to create one.

Create the recommendations export in AWS

To create the recommendation export in AWS:

Sign in to the AWS Management Console and select Billing and Cost Management.
In the left navigation pane, select Data Exports, then select Create.
On the Create export page, under Export type, select Standard data export.
Enter CostRecommendationsReports as the Export name. CloudSpend looks for this exact string. Any other name, including a different capitalization, will prevent the recommendations from being picked up.
Under Data table/export settings, select the Cost optimization recommendations table, and configure the export to retain the applicable recommendation based on the configured export behavior.
Under Data export delivery options, set the following:
1. Compression type: gzip
2. File format: text/csv
3. File versioning: Overwrite existing data export file
Under Data export storage settings, select the same Amazon S3 bucket used for your billing data export.
Enter recommendations as the S3 path prefix. This value must match exactly.
Click Create.

Note: The IAM role CloudSpend uses for this account also needs:

cost-optimization-hub:ListRecommendations
cost-optimization-hub:GetRecommendation

Set the account scope

Under Account scope, choose the Account Type.

Account type	What it means	What you must provide
Organization	The export covers an AWS Organization’s consolidated bill. The default.	Export Name
Linked Account	The export covers a single member account within an Organization	Export Name, S3 bucket name and S3 path prefix you saved earlier

Export Name: Copy and paste the export name you created in the Creating a Data export section above.
Click Next.

Step 4: Processing date

This step has four sections: Observability, Processing window, Notifications, and Labels. Only the processing window is required.

Observability: Integrate with Site24x7

In the Observability section, select the Site24x7 account you wish to link to this CloudSpend account, from the Choose Site24x7 Account drop-down menu. You can select multiple Site24x7 accounts.

Linking the accounts allows you to view CloudSpend account details in the Cloud tab, view budget related alarms raised by CloudSpend in the Alarms tab, and let Site24x7 users acknowledge alarms and assign technicians.

This Site24x7 link is separate from the Site24x7 Account access type in Step 2. The access type is used to provide CloudSpend with AWS access, while this setting determines where CloudSpend alerts are shown.

Leave this field empty if you do not use Site24x7 or do not want to link the CloudSpend account to Site24x7.

Processing window

Under Start Date for Bill Processing, select the month from which CloudSpend should begin processing your bills.

All historical bills from the selected date will be processed and charged. See Pricing Details before selecting an earlier date.

On an evaluation account, you can view two months of data regardless of the start date selected.

Notifications

Choose how CloudSpend should send notifications.

From the Notify via option, select Users to notify one or more individual CloudSpend users, or User Group to notify all members of a selected user group. Using user groups simplifies notification management because any changes to the group membership are automatically reflected in the notification profile.
Contacts: Select the users or user groups that should receive notifications when an associated check is breached.

Labels

Add Label: Optionally attach key value Labels to this integration. Enter a Label Key and Label Value, then click the + icon to add another pair, or the delete icon to remove one. Labels are CloudSpend side metadata, useful for filtering and grouping accounts in reports, independent of AWS tags. See Labels.
Click Next.

Step 5: Review & activate

The final step displays the details you entered in the previous steps. Review the details you entered in the previous steps before submitting the integration. Use Edit to return to any step and make changes.

Check that all required fields are completed, especially the Role ARN, Export Name, and, for Linked Account integrations, the S3 Bucket and Path Prefix.
If you linked a Site24x7 account in Step 4, verify that the correct account is selected.
Once you have reviewed the details, click Submit.

After you activate

What happens next:

CloudSpend validates the role and confirms that it can read the export from S3.
CloudSpend begins processing bills from the start date you selected. The first run takes the longest. For a large organization with several months of history, processing can take a few hours.
As data becomes available, your reports are populated and any configured budgets or anomaly checks begin evaluating.

Connecting a Site24x7 account

If you already monitor the AWS account in Site24x7, you can reuse that connection instead of creating new credentials. CloudSpend uses the IAM role or user associated with the Site24x7 connection. You only need to attach the required cost policy.

This is an access type within the Manual path:

In Step 1: Account basics, enter a Display Name and select AWS as the Provider.
In Step 2: Access & credentials, select Site24x7 Account: Reuse an existing connection.
Follow the steps in Site24x7 Account access type section to select the account and attach the cost policy.
Complete Step 3: Billing data, Step 4: Processing date, and Step 5: Review & activate as usual.

If your account does not appear in the dropdown, it is not connected to your Site24x7 account yet. Connect it in Site24x7 first, or use IAM Role access type instead.

Connecting an MSP account

For Site24x7 MSP accounts, the flow is the same, with one additional selection:

In Step 1: Account basics, enter a Display Name and select AWS as the Provider.
In Step 2: Access & credentials, select Site24x7 Account.
Select the MSP customer first, then select the Site24x7 AWS account associated with that customer.
Attach the cost policy as described in Site24x7Account access type section.
Complete the remaining steps as usual.

See Customer Portal Overview and Managing Customer Portals for information about how MSP integrated accounts map to portals.

Support for Parquet format

The CloudSpend AWS cost supports Parquet and GZIP file formats. For cost accounts parsed from the Parquet format report, the user-defined tags with camel case, colon, and hyphen will be replaced with an underscore and follow lower casing.

Tag name in GZIP	Tag name in Parquet
autoscaling:groupName	autoscaling_group_name
cloudformation:id	cloudformation_id
CreatedBy	created_by
Environment type	environment_type

The system-generated tags will not have any changes.

Recommended next steps

Set up cost centers: Split shared spend by team, project, or customer. See Cost Centers Overview.
Create a budget with alerts: Get notified before you overspend. See Single-step Budget and Multi-step Budget.
Turn on anomaly detection: Detect cost spikes within a day. See Anomaly.
Configure tag profiles: Make your AWS tags usable for cost allocation. See Tag Profiles.
Set up governance checks: Monitor your cloud environment for compliance issues and track resources that do not meet your defined governance requirements. See Governance.
Review recommendations: Act on the optimization recommendations from the export you enabled. See AWS Recommendations.
Review cost reports: Analyze your cloud spending through detailed cost reports and identify spending patterns, trends, and allocation opportunities. See Reports.
Schedule a monthly report: Automatically share spend information with stakeholders. See Schedule Reports.
Explore AI-powered features: Use CloudSpend's AI capabilities to analyze spending, identify anomalies, and gain insights from your cloud cost data. See Zia Agent Studio.
Connect MCP: Integrate CloudSpend with MCP to access and work with your cloud cost data through supported AI tools and workflows. See MCP Integration.

Troubleshooting

Configuration Error Accounts

You can now easily view the errors in configuring your CloudSpend account, like Invalid report name or Expired roles in the Configuration Error Account(s) section. Choose to either edit or delete the configuration error and rectify the errors for all accounts from a single view.

Common issues

Issue	Likely cause	Fix
Report Name is required on activation	The Export Name field is empty, usually because Cost And Usage Report Creation needed was set to No and the field was not filled in.	Click Edit on the relevant card and enter the export name exactly as it appears in AWS.
Invalid report name after activation	The export name does not match, usually because of a typo or capitalization difference.	Compare it with Billing andCost Management > Data Exports in AWS and correct it under Accounts.
Role assumption fails / Expired role	The External ID changed after the role was created, the trust policy names the wrong account, Require MFA is enabled, or the role was deleted.	Reopen the wizard, copy the current External ID, and update the role's trust policy. Verify the trusted account ID and MFA is not required.
CloudFormation stack never calls back / stuck on Waiting for RoleARN	The CloudSpend tab was closed or refreshed, or the stack failed.	Check the stack's Events tab in AWS for the failure. If the tab was lost, delete the stack and restart the Access & credentials step.
Stack fails with a permissions error	The signed in AWS identity cannot create IAM resources, or the account is not a registered delegated administrator.	Use an identity with IAM permissions, or switch to the Management Account access type.
Integration activates but reports are empty	AWS has not written the first export yet.	Wait up to 24 hours after creating the export. Confirm that objects exist under the S3 path prefix.
Costs appear but no resource level detail	Include resource IDs was not selected on the export.	Edit the export in AWS to include resource IDs. New data will carry them; historical data will not.
Anomaly detection or hourly trends unavailable	Export granularity is Daily rather than Hourly.	Change the granularity in AWS. Data written before the change stays daily.
Recommendations reports are empty	The recommendations export is missing, misnamed, or the cost optimization hub permissions were not added.	Verify that the export is named CostRecommendationsReports with the recommendations prefix, and add the required permissions.
Tag based cost centers match nothing	Parquet tag name normalization.	Use the normalized name described in Parquet and GZIP tag naming.
Only two months of data visible	The account is on an evaluation plan.	Two months is the evaluation limit regardless of the start date. See Pricing Details.

If you are still stuck, email cloudspend-support@site24x7.com or ask in the community forum.