# Cost and security considerations

> An overview of cost and security considerations for AWS account configuration

---

Site [llms.txt](/llms.txt)

---

This page details [AWS account configuration](/docs/cbp/getting-started/configure-cloud-accounts/aws/) considerations for **IAM roles**, **data protection**, and **cost** to provide the highest level of security while minimizing overhead and costs.

## IAM roles

- Least privilege principles applied to all policies
- Roles are **only** assumable by specified CloudBolt Platform accounts

## Data protection

- S3 server-side encryption (SSE-S3) with AES-256 is enabled by default on S3 buckets
- S3 Block Public Access is enabled by default on S3 buckets
- S3 Versioning is enabled on S3 buckets
- The S3 bucket policy grants access to the `bcm-data-exports.amazonaws.com` service for the management account only

## Cost

- No additional AWS cost:
  - FOCUS Data Exports
  - Cost Optimization Recommendations Exports
  - CloudFormation StackSets
  - IAM Roles and Policies
- Standard costs apply:
  - S3 Storage: For the cost report data stored in the S3 bucket
  - Data Transfer: If reports are generated in a different region than your resources