Configure AWS accounts

Preparing your AWS environment for CloudBolt Platform integration requires IAM roles and an S3 bucket. This page describes how to use a CloudBolt-provided AWS CloudFormation template to create them.

The template creates the following:

• Cross-account IAM roles: Least-privilege IAM roles enabling cost report access. The FOCUS role can also create cost report exports on CloudBolt’s behalf (but not delete them).
• Permissions for the cost report exports: The template grants CloudBolt the permissions needed to create the FinOps Open Cost and Usage Specification (FOCUS) 1.0, FOCUS 1.2 Hourly, FOCUS 1.2 Daily, and Cost Optimization Recommendations data exports. When a connection is established, CloudBolt creates any that do not exist.
• S3 bucket: Created when CreateS3Bucket=true (default), with policies for report storage. Set CreateS3Bucket=false to use an existing bucket.

Prerequisites

Before you begin, ensure the following:

AWS account requirements

• The management account has full access to AWS Organizations.
• CloudFormation StackSets are enabled in the management account.
• All target accounts are in the ACTIVE state.

Service requirements

• IAM permissions to create roles and policies.

• S3 permissions for bucket creation and management.

• Cost Explorer is enabled in the management account. Go to Billing and Cost Management > Cost Explorer and open it once to enable.

• AWS Compute Optimizer is opted in for the account and all member accounts. Cost Optimization Hub sources its rightsizing recommendations from Compute Optimizer, so enable it first. Go to Compute Optimizer > Get started, or run:

  aws compute-optimizer update-enrollment-status --status Active --include-member-accounts
  

  CloudBolt doesn’t verify this enrollment. A connection succeeds without it, but your rightsizing recommendations are incomplete.

• The Compute Optimizer rightsizing lookback period is set to 32 days (recommended). Compute Optimizer bases each rightsizing recommendation on the last N days of usage, and the default of 14 days can miss monthly patterns such as month-end jobs.

  • 14 days: Default. Free.
  • 32 days: Free. Covers a full month of usage.
  • 93 days: Paid. Requires enhanced infrastructure metrics (EC2 and RDS). Refer to Compute Optimizer pricing.

  Go to Compute Optimizer > Rightsizing > Edit preferences, choose All opted-in accounts and Any Region, and set the lookback period to 32 days. Repeat for each resource type (EC2, EBS, ECS, RDS, and Aurora).

  Alternatively, run the following command. Each call changes only the Region it is sent to, so the command loops over every Region enabled in the account:

  for r in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
    for t in Ec2Instance EbsVolume EcsService RdsDBInstance AuroraDBClusterStorage; do
      aws compute-optimizer put-recommendation-preferences \
        --region "$r" \
        --resource-type "$t" \
        --scope name=Organization,value=ALL_ACCOUNTS \
        --look-back-period DAYS_32
    done
  done
  

  To target specific Regions, replace the first line with your list, for example for r in us-east-1 eu-west-1; do. AWS applies the change within 24 hours.

• Cost Optimization Hub is opted in for the organization, including member accounts. Go to Billing and Cost Management > Cost Optimization Hub, choose Enable Cost Optimization Hub for this account and all member accounts, then select Enable. Alternatively, run:

  aws cost-optimization-hub update-enrollment-status --status Active --include-member-accounts --region us-east-1
  

• The AWSServiceRoleForBCMDataExports service-linked role exists in the management account. Navigate to Billing and Cost Management > Data Exports > Create to provision the role automatically, or run:

  aws iam create-service-linked-role --aws-service-name bcm-data-exports.amazonaws.com
  

Template deployment

• The template must be deployed in the us-east-1 region. AWS Data Exports (bcm-data-exports) operates only in us-east-1, so the bucket and roles the exports depend on must be created there.
• Download the CloudFormation template.

Deploy the template

There are two ways to deploy the template: from within CloudBolt (recommended), or directly in the AWS Console.

Deploy from CloudBolt

On the AWS connection form, select Deploy Stack to open CloudFormation in us-east-1 with the template already loaded. Refer to Connect AWS for the full connection workflow.

Deploy from the AWS Console

Use these steps if you prefer to deploy the template directly in the AWS Console.

1. Log in to your AWS management account.
2. Go to CloudFormation.
3. Select Create stack.
4. Select Upload a template file, then choose the downloaded template file, then select Next.
5. In the Stack name field, provide a name for the stack.
6. Under Parameters > S3 Bucket Configuration, provide a unique S3 Bucket Name for the template to create.
7. Under Parameters > Deployment Scope & Targeting, provide your organization’s Root OU ID.
8. Under Parameters > Tenant Configuration, select the CloudBolt Tenant Region matching where your CloudBolt tenant is hosted (US or EU), then select Next.
9. On the Configure stack options page, acknowledge the required capabilities, then select Next.
10. On the Review page, select Submit.

If your organization can’t use CloudFormation, you can create the same management-account resources with a CloudBolt-provided Terraform module instead. This is a beta option, enabled on request, and it covers the management account only. Refer to AWS onboarding with Terraform.

Created resources

A successful deployment creates the following resources:

• IAM roles enabling the CloudBolt Platform to retrieve cost reports and to create the cost report exports.
• The stack itself does not create the FOCUS 1.0, FOCUS 1.2 Hourly, FOCUS 1.2 Daily, and Cost Optimization Recommendations data exports. CloudBolt creates these once the AWS connection is established: immediately after deployment from CloudBolt, or when you complete the connection after deploying directly in the AWS Console.
  • If you require historical data, refer to AWS’s guidance on backfilling data exports up to 36 months.
• S3 bucket for report storage.
  • CloudBolt automatically reads the S3 bucket name, resource prefix, and stack name from the deployed stack. You do not need to copy them. Adding an AWS connection requires only your AWS account ID.

Troubleshooting

Contact CloudBolt Support if you require assistance with your deployment.

Next steps

• Manage organizations, users, and roles: Invite collaborators to the CloudBolt Platform and define the actions they can perform.
• Connect AWS: Connect AWS to the CloudBolt Platform to complete the integration. You only need your 12-digit AWS management account ID; CloudBolt reads everything else from the deployed stack.