Cost and security considerations

An overview of cost and security considerations for AWS account configuration

This page details AWS account configuration considerations for IAM roles, data protection, and cost to provide the highest level of security while minimizing overhead and costs.

IAM roles

  • Least privilege principles applied to all policies
  • Roles are only assumable by specified CloudBolt Platform accounts

Data protection

  • S3 server-side encryption (SSE-S3) with AES-256 is enabled by default on S3 buckets
  • S3 Block Public Access is enabled by default on S3 buckets
  • S3 Versioning is enabled on S3 buckets
  • The S3 bucket policy grants access to the bcm-data-exports.amazonaws.com service for the management account only

Cost

  • No additional AWS cost:
    • FOCUS Data Exports
    • Cost Optimization Recommendations Exports
    • CloudFormation StackSets
    • IAM Roles and Policies
  • Standard costs apply:
    • S3 Storage: For the cost report data stored in the S3 bucket
    • Data Transfer: If reports are generated in a different region than your resources