Connect AWS (CloudFormation)

Deploy the generated CloudFormation template, choose organization or single account and optional features, then verify.

Connect AWS (CloudFormation)

Give CostGlass read-only access to your AWS bill by deploying one CloudFormation template that CostGlass generates for you.

Where in CostGlassSettings → Cloud Accounts → Connect a New Cloud Account or Platform

PlanAll plans

Who can do thisOwner or Admin in CostGlass; someone who can create IAM roles and CloudFormation stacks in AWS

Time neededAbout 10 minutes, plus up to 24 hours for the first data

In short

You deploy one template in AWS region us-east-1. It creates a Cost and Usage export, an S3 bucket for it, and a role named CostGlassCURReader that only CostGlass can assume.
Choose AWS Organization (deploy once in the management account, member accounts follow) or Single account.
Instance Scheduler, Rightsizing and Uptime are optional. A feature you do not tick is left out of the template completely.
Only Instance Scheduler can change anything in your account (start and stop). Everything else is read-only.
AWS needs up to 24 hours to deliver the first export. CostGlass picks it up automatically.

Before you begin

A login to AWS. For an AWS Organization, the management (payer) account. For a single account, the account that pays the bill.
Permission in AWS to create CloudFormation stacks that contain IAM resources (named IAM resources).
For an Organization: CloudFormation StackSets trusted access enabled (a one-time step, explained below).
Spare capacity in your plan. See the connection limits in the overview.

How the connection works

CostGlass never asks for an AWS access key. Instead, the template creates an IAM role in your account. A role is a set of permissions that a trusted outsider can borrow for a short time. The role trusts only the CostGlass AWS account, and only when it presents your External ID.

External ID: A long random secret generated for this one connection. The role refuses anyone who does not present it. It stops another AWS customer from tricking CostGlass into reading your account.
Cost and Usage export (CUR): AWS Billing writes a detailed file of every charge, hourly, to an S3 bucket in your account. CostGlass reads those files. This is how your cost data arrives.
StackSet: A CloudFormation feature that rolls the same stack out to many accounts. The Organization template uses one to create the member-account role.

What the template creates:

Resource	Name	Purpose
S3 bucket	costglass-cur-exports-<your account ID>	Receives the export. Encrypted, all public access blocked. A bucket policy lets AWS Billing write to it.
Cost and Usage export	CostGlassCURExport	Hourly, with resource IDs, CSV compressed with gzip, into the folder cur.
IAM role	CostGlassCURReader	The role CostGlass assumes. Trusts the CostGlass account and your External ID.
Organization only: StackSet	CostGlass-Organization-Member-Roles	Creates a role named CostGlassReadOnly in every member account, including accounts that join later.

Connect AWS, step by step

Cloud Accounts → AWS. The same wizard also appears on the first-run screen.

Open the wizard

Go to Settings → Cloud Accounts. In the section Connect a New Cloud Account or Platform click the AWS card under Connect a cloud. (On the first-run screen the wizard is already on AWS.)

Choose the account type

Under Account type choose AWS Organization (deploy once in the management account; the role is rolled out to every member account) or Single account (an account that is not part of an Organization).

Choose the features

Under Features, Cost & Usage Report (CUR) is always on. Tick any of Instance Scheduler, Rightsizing recommendations and Resource uptime monitoring. Each shows a Read-only or Write access tag and lists its permissions. See the table in the next section.

Generate the template

Click Generate my template. CostGlass creates the connection and your External ID. If you leave and come back before finishing, the same pending connection and the same External ID are reused.

Download the template

On Deploy the CloudFormation template click Download or Copy template. The page also lists exactly which permissions the template grants. Your External ID is pre-filled inside the file.

Switch AWS to us-east-1

In the AWS console, set the region to us-east-1 (N. Virginia). This applies even if all your servers run elsewhere: the Cost and Usage export resource only exists there.

Organization only: enable trusted access

One time, from the management account: CloudFormation → StackSets → Enable trusted access with AWS Organizations.

Create the stack

In AWS open CloudFormation → Create stack → With new resources → Upload a template file, choose the file, leave the parameters as generated, tick the acknowledgement that IAM resources will be created (CAPABILITY_NAMED_IAM), and create the stack. Wait for CREATE_COMPLETE, usually three to five minutes.

Copy the outputs

Open the stack's Outputs tab and copy RoleArn and BucketName.

Verify and connect

Back in CostGlass click I have deployed it. Fill in the fields below and click Verify & connect.

The verify form

Field	What to enter	Default
Name for this integration (optional)	A label you will recognise, for example "Acme production organisation".	AWS CUR Export (<account ID>)
Role ARN (Outputs: RoleArn)	The RoleArn output. Looks like arn:aws:iam::123456789012:role/CostGlassCURReader.	None
S3 bucket (Outputs: BucketName)	The BucketName output.	None
Prefix	The folder inside the bucket.	cur/
Region	The region of the bucket.	us-east-1

CostGlass assumes the role with your External ID and lists the bucket before saving. A typo is rejected here, not a day later.

What you see afterwards

The wizard moves to AWS connected and shows one of these messages:

Message	Meaning
Synced N records from M file(s).	Data has already arrived.
The first import is running in the background. Your data will appear in a few minutes.	A large export is being read in stages. Nothing for you to do.
Connected. AWS has not delivered the first export yet...	Normal on a new setup. Up to 24 hours. CostGlass checks again every 6 hours.
The bucket could not be read yet: ...	Read the reason, then see the FAQ below.

Check delivery now runs the check immediately. Integrate another starts a fresh connection.

What each feature adds

Permissions are listed exactly as the template grants them.

Feature	Access	Permissions added
Cost & Usage Report (always)	Read-only	s3:GetObject and s3:ListBucket on the export bucket only; budgets:ViewBudget; organizations:ListAccounts; read-only Describe and List calls for EC2, Elastic IPs, snapshots, volumes, load balancers, RDS, ECS, ElastiCache, Redshift, DynamoDB and EMR; cloudwatch:GetMetricStatistics; iam:SimulatePrincipalPolicy.
Instance Scheduler	Write	ec2:StartInstances and ec2:StopInstances on instances; autoscaling:UpdateAutoScalingGroup on Auto Scaling groups.
Rightsizing recommendations	Read-only	cloudwatch:GetMetricData, cloudwatch:ListMetrics; compute-optimizer:GetEC2InstanceRecommendations, compute-optimizer:GetRDSDatabaseRecommendations.
Resource uptime monitoring	Read-only	ec2:DescribeInstanceStatus; cloudwatch:DescribeAlarms, cloudwatch:GetMetricData; elasticloadbalancing:DescribeLoadBalancers, DescribeTargetGroups, DescribeTargetHealth.

Important

Instance Scheduler is the only feature that can change your environment, and only by starting or stopping instances and Auto Scaling groups. Leave it unticked for a strictly read-only role.

Organization stacks also create the member-account role CostGlassReadOnly in each member account with the read-only inventory permissions and the features you ticked.

Organization or single account?

AWS OrganizationRecommended for many accounts

Deploy once in the management account. A StackSet adds the member-account role to every account, now and in the future (automatic deployment is on by default). Needs StackSets trusted access.

Single account

One stack in one account. Choose this if the account is not in an Organization, or you only want to connect that one account.

The Organization template has two extra parameters you can change at deploy time: AutoDeployNewAccounts (default true) and RetainOnAccountRemoval (default false).

Example

A company has a management account and 12 member accounts. They choose AWS Organization, tick Rightsizing recommendations, and deploy once from the management account. They connect one thing in CostGlass, and all 13 accounts show up under it. A thirteenth member account created next month is picked up automatically.

Cost and Usage export: the 24 hour wait

The export is created as soon as the stack finishes, but AWS writes the first file in its own time, up to 24 hours later. Until then CostGlass is connected but has no data. From the dashboard you can use Fetch data now for a one-off pull from Cost Explorer; AWS charges $0.01 per request and the button states the cost before you confirm.

After the first delivery CostGlass reads new files every 6 hours.

Removing access

Disconnect in CostGlass

In Cloud Accounts remove the AWS connection (trash icon). CostGlass stops reading. For AWS this also deletes its discovered resources, anomalies, savings suggestions and older cost metrics for that connection; cost history already stored in the main cost tables is kept.

Delete the stack in AWS

Empty the S3 bucket first, otherwise CloudFormation cannot delete it. Then delete the stack. This removes the role, so CostGlass can no longer assume it. For an Organization, CloudFormation also removes the StackSet it created; if it reports the StackSet still has instances, delete those from CloudFormation → StackSets first.

Tip

Doing the AWS step alone also cuts off access immediately, because the role no longer exists.

Updating the stack later

Switch a feature off: update the stack and set its parameter to false (EnableInstanceScheduler, EnableRightsizing or EnableUptimeMonitoring).
Add a feature you did not tick: an unticked feature is not in the template at all, so a parameter cannot turn it on. The wizard builds templates for new connections; it does not offer a way to change the features of one that is already active. Contact CostGlass support for that.
When CostGlass adds new read-only checks it may need new permissions. Then redeploy the stack (or update the Organization StackSet). For example, the unused Elastic IP and idle load balancer checks need ec2:DescribeAddresses and elasticloadbalancing:Describe*. Until you do, that check finds nothing and says so on the Savings page.

Note

Your original feature choices are recorded when you verify and shown as small tags (Scheduler, Rightsizing, Uptime) on the account card. They are not changed by later stack updates.

Troubleshooting and FAQ

The stack fails with "Unrecognized resource types: [AWS::BCMDataExports::Export]".

You deployed in the wrong region. Delete the failed stack, switch the console to us-east-1 (N. Virginia) and create it again.

CloudFormation says it needs capabilities (InsufficientCapabilities).

Tick the acknowledgement that the stack creates IAM resources, or pass CAPABILITY_NAMED_IAM on the command line.

Verify says "Could not verify access to ... AccessDenied".

Check that the stack reached CREATE_COMPLETE, that the role ARN and bucket name were copied exactly, and that you deployed the template from this connection. If you started a second connection, its External ID differs from the first template's. Use the template shown for the pending connection.

Verify says the Role ARN does not look valid.

Paste the RoleArn output, which starts arn:aws:iam:: and contains :role/. Do not paste the stack ARN.

The Organization stack fails when creating the StackSet.

Trusted access is probably not enabled. In the management account open CloudFormation → StackSets and choose Enable trusted access with AWS Organizations, then retry.

The stack says the bucket or role already exists.

The bucket (costglass-cur-exports-<account ID>) and the role (CostGlassCURReader) have fixed names, so one AWS account can hold only one CostGlass stack. Delete the old stack first.

It says connected but I see no data.

Wait for AWS to deliver the first export, up to 24 hours, then click Check delivery now. Dashboard → Fetch data now gives you a quick one-off look in the meantime.

I get "You have reached your plan's connection limit".

Remove a connection you no longer need, finish or remove a pending one, or upgrade at Settings → Billing.

Can I deploy this without CloudFormation?

Yes. See Connect AWS with Terraform.

All Documentation Guides

Welcome to CostGlass — What CostGlass does, who it is for, how your data gets in, the plans and regions, and a plain-English glossary.
Quickstart: your first hour — Sign up, connect a first cloud, invite your team, set a budget and turn on anomaly alerts, with a first-week checklist.
Finding your way around — A tour of the sidebar, top bar and page controls: what every page answers, plan gating, currency, language, links and caching.
Dashboards — The Overview dashboard widget by widget, plus building custom dashboards you can share with your organisation.
Cloud Resources — The multi-cloud inventory: filters, search, categories, estimated cost, terminated resources and CSV or Excel export.
Uptime, incidents & support requests — Monitor public endpoints, route alerts, see incidents and raise requests to CostGlass engineers.
How CostGlass accesses your data — Security and data ingestion architecture: how CostGlass reads multi-cloud billing and telemetry through read-only roles and least-privilege permissions.
Dashboard & Platform Screenshot Tour — Visual walkthrough of the CostGlass interface with screenshots covering multi-cloud spend, Cost Explorer, anomalies, Kubernetes allocation, and savings.
Connecting your clouds: overview — Every cloud and service you can connect, how each one connects, what access it needs, how long data takes and your plan limits.
Connect AWS (CloudFormation) — Deploy the generated CloudFormation template, choose organization or single account and optional features, then verify.
Connect AWS with Terraform instead of CloudFormation — A Terraform equivalent of the generated AWS template, with an Organization variant and a way to compare it to the wizard.
Connect Azure — Admin consent for the CostGlass application, Reader and Cost Management Reader roles, management group or subscription scope, and a Terraform version.
Connect Google Cloud — Enable the FOCUS BigQuery export, run the IAM grants CostGlass prints, verify, and a Terraform version.
Managing connected accounts — The Cloud Accounts page: statuses, syncing, errors, naming, disconnecting, and the FOCUS 1.0 and CUR Export pages.
Connect Oracle Cloud (OCI) — Give CostGlass read-only access to Oracle Cost and Usage Reports with a Resource Manager stack or your own Terraform.
Connect Alibaba Cloud — Connect Alibaba Cloud through Bill Subscription files in OSS and a read-only RAM role created by a ROS template.
Connect DigitalOcean — Connect DigitalOcean accounts with a read-only personal access token and see invoices by month.
Connect Akamai / Linode — Connect Linode (Akamai Connected Cloud) accounts with an account read-only token.
Connect Cloudflare — Connect Cloudflare usage-based charges with a Billing Read account token and see credits and unpaid debt.
Connect OpenAI, Anthropic, Datadog and Snowflake — Connect AI and software vendors with admin keys or a Snowflake key pair so their spend sits beside your cloud costs.
Cost Explorer — Slice, compare and drill into spend across every connected cloud: group by, filters, charts, overlays, details, AI, links and export.
Saved views, saved filters & scheduled emails — Keep, share and email the Cost Explorer views you use often, and reuse include/exclude filters across views and reports.
Reports — Build, compare, export, save and schedule spend reports, with presets, Excel, CSV and PDF exports.
SaaS & AI Spend — Spend and token analytics for OpenAI, Anthropic, DeepSeek, Datadog, Snowflake and cloud AI services.
Unit Economics — Cost per business unit: define metrics, send volumes, set targets and alerts.
Connect a Kubernetes cluster — Install OpenCost and the CostGlass exporter in your cluster so cost data is pushed to CostGlass every 15 minutes.
Kubernetes Costs page — Understand cluster, namespace, workload and pod costs, idle capacity, rightsizing, carbon and health.
Tagging strategy: getting the most from tags — How to tag cloud resources, enforce tagging, and when to use cloud tags or virtual tags in CostGlass.
Tag Explorer — Group billed spend by the value of a tag, see tag coverage per cloud and drill into resources.
Tag Compliance — Define required AWS tags, measure compliance, and fix missing tags with Quick Tag, batch apply or a CLI script.
Virtual tagging — Allocate spend by team, product or environment with rules, no cloud changes, with a rule builder and CostGlass AI.
Forecasting — Forecast month-end spend, the next months and a yearly run-rate, and simulate the cost of changes.
Budgets — Create spending limits for a cloud, account, service or team, and see how CostGlass budgets differ from native AWS, Azure and Google budgets.
Anomaly detection — How CostGlass finds unusual daily cost, how to tune it, explain it and be notified.
Cost alerts — Alert when spend rises versus the previous day, week, month or quarter.
All alert and notification types — A comparison of every alert and notification in CostGlass, with channel setup and testing.
Issues & annotations — Dated notes on spend, and a lightweight issue tracker for cost work with Jira push.
Savings playbook — A prioritised, step-by-step programme for reducing your cloud bill, with a 30/60/90-day plan.
Savings recommendations — How the Savings page finds, prices and tracks savings for every connected cloud and platform.
Rightsizing — Find servers and databases that are too big, or too small, using real CPU and memory measurements.
Commitments: Savings Plans & Reserved Instances — Track coverage, utilisation, expiry and purchase recommendations for Savings Plans, Reservations and committed use discounts.
Instance Scheduler — Start and stop non-production servers on a weekly schedule to stop paying for idle hours.
Giving your team access — Invite people, choose Owner, Admin or Member roles, remove users and limit what they see.
Setting up your organisation hierarchy — Build a tree of nodes, place cloud accounts by hand, rule or CSV, and scope people to a branch.
Designing your hierarchy (with enterprise examples) — Principles and worked patterns for AWS Organizations, single accounts, multi-cloud groups, MSPs and regulated regions.
Single sign-on (SAML & OIDC) — Connect Okta, Entra ID, Google Workspace or another provider, verify your domain, test and require SSO.
API keys & AI assistants (MCP) — Create API keys and connect Claude Desktop, Cursor or Claude Code to your cost data.
Audit log — See who changed what and when, with before and after values, kept for 24 months.
Data residency & retention — Your fixed region, how long cost history is kept, purge now and the data handling summary.
Notification settings, Jira & chat — Weekly spend summary, Slack and Teams webhooks, and connecting Jira Cloud.
Troubleshooting & Common Setup Fixes — Solutions for common cloud connection and ingestion issues across AWS, Azure, Google Cloud, OCI, Alibaba Cloud, Kubernetes, and SSO.

Connect AWS (CloudFormation)