AWS Setup Guide

Prerequisites

• An AWS account with billing access
• IAM permissions to create users and policies
• Cost Explorer enabled (free, but takes 24 hours to activate for new accounts)

Step 1: Enable Cost Explorer

If you haven't already enabled Cost Explorer, you'll need to do this first:

1. Go to the AWS Cost Explorer Console
2. Click "Enable Cost Explorer" if prompted
3. Wait 24 hours for data to become available (for new activations)

Step 2: Create an IAM Policy

Create a custom policy with the minimum permissions Cloudo needs:

1. Go to the IAM Policies Console
2. Click "Create policy"
3. Select the "JSON" tab
4. Paste the following policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CloudoCostExplorerRead",
      "Effect": "Allow",
      "Action": [
        "ce:GetCostAndUsage",
        "ce:GetCostForecast",
        "ce:GetDimensionValues",
        "ce:GetTags"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CloudoEC2Read",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CloudoS3Read",
      "Effect": "Allow",
      "Action": [
        "s3:ListAllMyBuckets",
        "s3:GetBucketLocation"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CloudoCloudWatchRead",
      "Effect": "Allow",
      "Action": [
        "cloudwatch:GetMetricStatistics"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CloudoSTSRead",
      "Effect": "Allow",
      "Action": [
        "sts:GetCallerIdentity"
      ],
      "Resource": "*"
    }
  ]
}

5. Click "Next"
6. Name the policy: CloudoReadOnly
7. Add a description: "Read-only access for Cloudo FinOps platform"
8. Click "Create policy"

Step 3: Create an IAM User

Create a dedicated user for Cloudo:

1. Go to the IAM Users Console
2. Click "Create user"
3. Enter username: cloudo-cost-reader
4. Click "Next"
5. Select "Attach policies directly"
6. Search for and select CloudoReadOnly
7. Click "Next", then "Create user"

Step 4: Create Access Keys

1. Click on the user you just created
2. Go to the "Security credentials" tab
3. Scroll to "Access keys" and click "Create access key"
4. Select "Third-party service" as the use case
5. Check the confirmation box and click "Next"
6. Click "Create access key"
7. Important: Copy both the Access Key ID and Secret Access Key. The secret will only be shown once!

Step 5: Add Credentials to Cloudo

1. Go to your Cloudo Settings
2. Find the "AWS Credentials" section
3. Enter your Access Key ID
4. Enter your Secret Access Key
5. Select your AWS region (e.g., us-east-1)
6. Click "Save" - we'll validate your credentials automatically

Permissions Explained

Here's what each permission does:

Troubleshooting

Error: "User is not authorized to perform ce:GetCostAndUsage"

This means the IAM policy isn't attached correctly. Double-check that:

• The policy was created successfully
• The policy is attached to the user
• You're using the correct access keys for that user

Error: "Data not available"

Cost Explorer data can take up to 24 hours to become available after:

• Enabling Cost Explorer for the first time
• Creating a new AWS account
• For the current day's costs (there's always a delay)

Which region should I use?

Cost Explorer is a global service, but the API endpoint is in us-east-1. You can select any region in Cloudo - it won't affect the cost data returned.