AWS account configuration on CloudBolt Documentation

Advanced AWS account configuration

Mon, 01 Jan 0001 00:00:00 +0000

This is an advanced configuration guide

Refer to the configure AWS accounts guide for simplified configuration using our recommended defaults.

Preparing your AWS environment for CloudBolt Platform integration requires IAM roles and an S3 bucket. This page describes how to use a CloudBolt-provided AWS CloudFormation template to create them.

The template creates the following:

Cross-account IAM roles: Least-privilege IAM roles enabling cost report access. The FOCUS role can also create cost report exports on CloudBolt’s behalf (but not delete them).
Permissions for the cost report exports: The template grants CloudBolt the permissions needed to create the FinOps Open Cost and Usage Specification (FOCUS) 1.0, FOCUS 1.2 Hourly, FOCUS 1.2 Daily, and Cost Optimization Recommendations data exports. When a connection is established, CloudBolt creates any that do not exist.
S3 bucket: Created when CreateS3Bucket=true (default), with policies for report storage. Set CreateS3Bucket=false to use an existing bucket.

Prerequisites

Before you begin, ensure the following:

CloudFormation template parameters

Mon, 01 Jan 0001 00:00:00 +0000

This page details the AWS CloudFormation template parameters you can configure when deploying the template in your AWS environment.

Use this guide when configuring AWS accounts for CloudBolt Platform integration to determine the appropriate parameter settings for your environment.

S3 bucket configuration

Parameter	Description	Allowed values	Default value	Required
CreateS3Bucket	Create a new S3 bucket. To use an existing bucket, set to `false` and specify the bucket name in `S3BucketName`.	true, false	true	Yes
CreateS3BucketPolicy	Create an S3 bucket policy to control access to billing data. Set to `false` if a bucket with the correct policy exists.	true, false	true	Yes
S3BucketName	Name for new S3 bucket, or existing S3 bucket name.	Valid S3 bucket name	N/A	Conditional, not required when `TargetDeploymentType=MemberAccountOnly`

If you set CreateS3BucketPolicy=false, the existing bucket’s policy must grant bcm-data-exports.amazonaws.com the actions shown in S3 bucket policy. If it does not, the exports are created, but every run fails with “Data Exports no longer has permission to run this export.”

CloudFormation template outputs

Mon, 01 Jan 0001 00:00:00 +0000

A successful deployment produces the following outputs. The CloudBolt Platform reads these values automatically to complete the integration.

Each FOCUS and Cost Optimization export is named ${ResourceNamePrefix}-<ExportType>-${AWS::StackName}, so the CBPInputResourcePrefix and CBPInputStackName outputs together reconstruct every export prefix path the CloudBolt Platform needs.

Template outputs

Name	Description	Condition
CBPInputAccountId	Management account ID	All modes except `MemberAccountOnly`
CBPInputFocusBucket	S3 bucket name for FOCUS exports	All modes except `MemberAccountOnly`
CBPInputResourcePrefix	Resource name prefix value (`ResourceNamePrefix` parameter)	All modes except `MemberAccountOnly`
CBPInputStackName	Stack name (suffix on FOCUS and Cost Optimization export resource names)	All modes except `MemberAccountOnly`
MemberAccountActionsRoleArn	Actions role ARN in the member account (for confirming the deploy succeeded)	`MemberAccountOnly` (first deploy only)
ServiceManagedStackSetId	ID of the created StackSet	`OrganizationWide` or `SpecificOU`

IAM roles

Mon, 01 Jan 0001 00:00:00 +0000

If you choose to deploy the AWS CloudFormation template to configure AWS accounts for CloudBolt Platform integration, two least-privilege IAM roles are created in your environment:

CloudBoltFocusCrossAccountRole: A management account role that allows CloudBolt to access your billing data.
CloudBoltActionsCrossAccountRole: Target account roles used to discover resources.

The Terraform module creates the same two roles, with the same names and permissions, in the management account.

CloudBoltFocusCrossAccountRole

Purpose: Used by CloudBolt for cost visibility and analysis, and to create the cost report exports on your behalf.
Permissions: AWS ReadOnlyAccess, plus Cost Explorer, Budgets, and S3 billing-data access. To create and read the cost report exports, it also has bcm-data-exports:GetExport, ListExports, and CreateExport; cur:PutReportDefinition (required by AWS for export creation); and cost-optimization-hub:GetRecommendation / ListRecommendations.

The role has no permission to delete exports and cannot change your account’s Cost Optimization Hub or Compute Optimizer enrollment. CloudBolt reports missing prerequisites rather than remediating them.

Cost and security considerations

Mon, 01 Jan 0001 00:00:00 +0000

This page details AWS account configuration considerations for IAM roles, data protection, and cost to provide the highest level of security while minimizing overhead and costs.

IAM roles

Least privilege principles applied to all policies
Roles are only assumable by specified CloudBolt Platform accounts

Data protection

S3 server-side encryption (SSE-S3) with AES-256 is enabled by default on S3 buckets
S3 Block Public Access is enabled by default on S3 buckets
S3 Versioning is enabled on S3 buckets
The S3 bucket policy grants access to the bcm-data-exports.amazonaws.com service for the management account only

Cost

No additional AWS cost:
- FOCUS Data Exports
- Cost Optimization Recommendations Exports
- CloudFormation StackSets
- IAM Roles and Policies
Standard costs apply:
- S3 Storage: For the cost report data stored in the S3 bucket
- Data Transfer: If reports are generated in a different region than your resources

AWS onboarding with Terraform

Mon, 01 Jan 0001 00:00:00 +0000

Beta, enabled on request

Terraform onboarding is off by default. CloudBolt recommends the CloudFormation StackSet deployment described in Configure AWS accounts, because it also covers member accounts. To use Terraform, contact CloudBolt Support to enable it for your organization; the Connect Terraform Deployment option then appears on the AWS connection form.

The CloudBolt Terraform module creates, in the management (payer) account, what the ManagementAccountOnly deployment of the CloudFormation template creates: an S3 bucket for the cost report exports, the CloudBolt OIDC identity provider, and the CloudBoltFocusCrossAccountRole and CloudBoltActionsCrossAccountRole IAM roles. CloudBolt then creates the FOCUS 1.0, FOCUS 1.2 Hourly, FOCUS 1.2 Daily, and Cost Optimization Recommendations data exports itself once the connection is established.