# Configure AWS accounts

> Prepare your AWS environment for CloudBolt Platform integration using a CloudFormation template

---

Site [llms.txt](/llms.txt)

---

Preparing your AWS environment for CloudBolt Platform integration requires IAM roles and an S3 bucket. This page describes how to use a CloudBolt-provided AWS CloudFormation template to create them.

**The template creates the following:**

- **Cross-account IAM roles:** Least-privilege IAM roles enabling cost report access. The FOCUS role can also create cost report exports on CloudBolt's behalf (but not delete them).
- **Permissions for the cost report exports:** The template grants CloudBolt the permissions needed to create the [FinOps Open Cost and Usage Specification](https://focus.finops.org/what-is-focus/) (FOCUS) 1.0, FOCUS 1.2 Hourly, FOCUS 1.2 Daily, and Cost Optimization Recommendations data exports. When a connection is established, CloudBolt creates any that do not exist.
- **S3 bucket:** Created when `CreateS3Bucket=true` (default), with policies for report storage. Set `CreateS3Bucket=false` to use an existing bucket.

## Prerequisites

Before you begin, ensure the following:

### AWS account requirements

- The management account has full access to AWS Organizations.
- CloudFormation StackSets are enabled in the management account.
- All target accounts are in the ACTIVE state.

### Service requirements

- IAM permissions to create roles and policies.
- S3 permissions for bucket creation and management.
- **Cost Explorer** is enabled in the management account. Go to **Billing and Cost Management** > **Cost Explorer** and open it once to enable.
- **AWS Compute Optimizer** is opted in for the account and all member accounts. Cost Optimization Hub sources its rightsizing recommendations from Compute Optimizer, so enable it first. Go to **Compute Optimizer** > **Get started**, or run:

  ```bash
  aws compute-optimizer update-enrollment-status --status Active --include-member-accounts
  ```

  CloudBolt doesn't verify this enrollment. A connection succeeds without it, but your rightsizing recommendations are incomplete.
- **The Compute Optimizer rightsizing lookback period** is set to 32 days (recommended). Compute Optimizer bases each rightsizing recommendation on the last *N* days of usage, and the default of 14 days can miss monthly patterns such as month-end jobs.

  - **14 days**: Default. Free.
  - **32 days**: Free. Covers a full month of usage.
  - **93 days**: Paid. Requires enhanced infrastructure metrics (EC2 and RDS). Refer to [Compute Optimizer pricing](https://aws.amazon.com/compute-optimizer/pricing/).

  Go to **Compute Optimizer** > **Rightsizing** > **Edit preferences**, choose **All opted-in accounts** and **Any Region**, and set the lookback period to **32 days**. Repeat for each resource type (EC2, EBS, ECS, RDS, and Aurora).

  Alternatively, run the following command. Each call changes only the Region it is sent to, so the command loops over every Region enabled in the account:

  ```bash
  for r in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
    for t in Ec2Instance EbsVolume EcsService RdsDBInstance AuroraDBClusterStorage; do
      aws compute-optimizer put-recommendation-preferences \
        --region "$r" \
        --resource-type "$t" \
        --scope name=Organization,value=ALL_ACCOUNTS \
        --look-back-period DAYS_32
    done
  done
  ```

  To target specific Regions, replace the first line with your list, for example `for r in us-east-1 eu-west-1; do`. AWS applies the change within 24 hours.
- **Cost Optimization Hub** is opted in for the organization, including member accounts. Go to **Billing and Cost Management** > **Cost Optimization Hub**, choose **Enable Cost Optimization Hub for this account and all member accounts**, then select **Enable**. Alternatively, run:

  ```bash
  aws cost-optimization-hub update-enrollment-status --status Active --include-member-accounts --region us-east-1
  ```

- The **`AWSServiceRoleForBCMDataExports`** service-linked role exists in the management account. Navigate to **Billing and Cost Management** > **Data Exports** > **Create** to provision the role automatically, or run:

  ```bash
  aws iam create-service-linked-role --aws-service-name bcm-data-exports.amazonaws.com
  ```

### Template deployment

- The template **must** be deployed in the **us-east-1** region. AWS Data Exports (`bcm-data-exports`) operates only in us-east-1, so the bucket and roles the exports depend on must be created there.
- Download the [CloudFormation template](https://downloads.cloudbolt.io/platform/onboarding/cb-onboarding-stackset.yaml).

## Deploy the template

<div class="alert alert-warning" role="alert"><div class="h4 alert-heading" role="heading">Region requirement</div>


The CloudFormation template must be deployed in the **us-east-1** region.
</div>


There are two ways to deploy the template: from within CloudBolt (recommended), or directly in the AWS Console.

### Deploy from CloudBolt

On the AWS connection form, select **Deploy Stack** to open CloudFormation in **us-east-1** with the template already loaded. Refer to [Connect AWS](/docs/cbp/getting-started/connect-cloud-accounts/aws/) for the full connection workflow.

### Deploy from the AWS Console

Use these steps if you prefer to deploy the template directly in the AWS Console.

1. Log in to your **AWS management account**.
1. Go to **CloudFormation**.
1. Select **Create stack**.
1. Select **Upload a template file**, then choose the downloaded template file, then select **Next**.
1. In the **Stack name** field, provide a name for the stack.
1. Under **Parameters** > **S3 Bucket Configuration**, provide a unique **S3 Bucket Name** for the template to create.
1. Under **Parameters** > **Deployment Scope & Targeting**, provide your organization's **Root OU ID**.
1. Under **Parameters** > **Tenant Configuration**, select the **CloudBolt Tenant Region** matching where your CloudBolt tenant is hosted (**US** or **EU**), then select **Next**.
1. On the **Configure stack options** page, acknowledge the required capabilities, then select **Next**.
1. On the **Review** page, select **Submit**.

If your organization can't use CloudFormation, you can create the same management-account resources with a CloudBolt-provided Terraform module instead. This is a beta option, enabled on request, and it covers the management account only. Refer to [AWS onboarding with Terraform](/docs/cbp/reference/aws-account-config/terraform-onboarding/).

## Created resources

A successful deployment creates the following resources:

- IAM roles enabling the CloudBolt Platform to retrieve cost reports and to create the cost report exports.
- The stack itself does not create the FOCUS 1.0, FOCUS 1.2 Hourly, FOCUS 1.2 Daily, and Cost Optimization Recommendations data exports. CloudBolt creates these once the AWS connection is established: immediately after deployment from CloudBolt, or when you complete the connection after deploying directly in the AWS Console.
  - If you require historical data, refer to [AWS's guidance on backfilling data exports](https://docs.aws.amazon.com/guidance/latest/cloud-intelligence-dashboards/data-exports.html#backfill-data-export) up to 36 months.
- S3 bucket for report storage.
  - CloudBolt automatically reads the S3 bucket name, resource prefix, and stack name from the deployed stack. You do not need to copy them. Adding an AWS connection requires only your AWS account ID.

## Troubleshooting

[Contact CloudBolt Support](https://support.cloudbolt.io/cloudbolt/s/) if you require assistance with your deployment.

## Next steps

- [Manage organizations, users, and roles](/docs/cbp/getting-started/manage-organizations-users-roles/): Invite collaborators to the CloudBolt Platform and define the actions they can perform.
- [Connect AWS](/docs/cbp/getting-started/connect-cloud-accounts/aws/): Connect AWS to the CloudBolt Platform to complete the integration. You only need your 12-digit AWS management account ID; CloudBolt reads everything else from the deployed stack.

## Related topics

- [IAM roles](/docs/cbp/reference/aws-account-config/iam-roles/): Details on the roles created by the template.
- [Advanced AWS account configuration](/docs/cbp/reference/aws-account-config/advanced-aws-config/): Advanced configuration guide.
- [CloudFormation template parameters](/docs/cbp/reference/aws-account-config/cloudformation-template-parameters/): Full parameter reference guide.
- [AWS onboarding with Terraform](/docs/cbp/reference/aws-account-config/terraform-onboarding/): Alternative to CloudFormation for the management account. Beta, enabled on request.