Skip to content

Amazon Web Services (AWS)

Connect one or more AWS accounts or an AWS Organization to bring billing, resource inventory, and commitment data into CloudVerse AI.

What you get

  • Billing data from AWS Cost and Usage Report (CUR)
  • Full resource inventory across regions and services
  • Reserved Instance and Savings Plan coverage and recommendations
  • Anomaly detection and budget tracking per account or organization

Prerequisites

  • AWS account with administrator access (or delegated billing access)
  • An S3 bucket for CUR export, or permission to create one
  • Permission to create an IAM role (or a CloudFormation stack) in the account

Connect AWS

  1. Go to Settings > Integrations.
  2. Select Amazon Web Services.
  3. Enter a connection name, for example aws-production.
  4. Choose the Account type:
    • Organizations management account (payer): the account that receives the consolidated bill.
    • Member account: an account inside an AWS Organization.
    • Standalone account: an account that is not part of an Organization.
  5. Choose a setup mode (see below) and enter the credential.
  6. Complete the Permissions, Discovery, and Billing Setup steps. For billing, configure or confirm your CUR export to S3.
  7. Finish the flow and wait for initial data ingestion.

Setup modes

Nothing long-lived is stored. CloudVerse receives a role ARN and mints a short-lived credential (15 minutes) when it needs one. You can revoke access by deleting the stack.

  1. Select Deploy our CloudFormation stack.
  2. Select Launch stack in AWS to open the quick-create page, or select Download the template and create the stack yourself. Quick-create is offered for management accounts when your deployment has it enabled; downloading always works.
  3. The External ID is shown in CloudVerse and already filled in by the launch link. Do not change it.
  4. Create the stack and wait for it to finish.
  5. Open the stack's Outputs tab, copy the RoleArn value, and paste it into the Role ARN field.

Manual IAM role

Same security properties as the stack. Choose this when your change management will not run the template.

  1. Select Create the IAM role yourself.
  2. CloudVerse shows its CloudVerse account ID and an External ID.
  3. In the AWS console, create a read-only IAM role that trusts arn:aws:iam::<CloudVerse account ID>:root and has a condition on sts:ExternalId equal to the External ID shown. Attach read-only and billing permissions.
  4. Copy the role ARN (see below) and paste it into the Role ARN field.

Access keys

  1. Select Use AWS access keys.
  2. Enter the AWS Access Key ID (starts with AKIA), the AWS Secret Access Key, and, only for temporary STS credentials, a Session Token.

Access keys are a long-lived secret that CloudVerse has to store. Prefer CloudFormation unless an IAM role is not an option for you.

Where do I find the role ARN?

  • CloudFormation: open CloudFormation > Stacks, select your stack, open the Outputs tab, and copy the RoleArn value.
  • Manual role: open IAM > Roles, select the role you created, and copy the ARN shown at the top of the summary.

The ARN has this format, where the account ID is 12 digits:

arn:aws:iam::123456789012:role/RoleName

CloudVerse rejects values that do not match this format ("That does not look like an IAM role ARN"). Paste the role ARN, not the account ID or the stack ARN.

Verify the connection

  1. Go to Settings > Integrations and open the AWS connection detail page.
  2. Confirm that billing and discovery status indicators are green.
  3. Open Cost Management > Cost Explorer, filter by Provider: AWS, and check that data appears.
  4. Open Cloud Infrastructure > Resources and filter by your AWS account to verify inventory.

Permissions required

CloudVerse requires an IAM role with the following minimum permissions:

  • ce:GetCostAndUsage and related Cost Explorer read permissions
  • s3:GetObject and s3:ListBucket on the CUR export bucket
  • ec2:Describe*, rds:Describe*, and service-specific read permissions for inventory discovery

For the full recommended policy, refer to the in-app IAM policy template provided during setup.

Connect multiple AWS accounts

To connect additional accounts:

  • Repeat the setup flow for each account, or
  • Connect at the AWS Organization level during initial setup to pull all member accounts automatically.

Best practices

  • Use the CloudFormation or manual role mode rather than long-lived access keys.
  • Enable CUR at the management account level if using AWS Organizations.
  • Include resource IDs and tags in your CUR export for accurate inventory mapping.
  • If you use access keys, rotate them on schedule and update credentials in CloudVerse immediately after.

Troubleshooting

  • No billing data after 24 hours — Check that the CUR export is configured in AWS and that the S3 bucket has the correct permissions.
  • Missing resources — Verify that the IAM role has the required Describe* permissions for the services you expect to see.
  • Status shows error — Open the integration detail page; the error message identifies the failing step.

See Integration setup issues for more help.