CosmosCost LogoCosmosCost

AWS Integration

Connect your AWS accounts using secure OIDC authentication.

Overview

CosmosCost integrates with AWS Cost Explorer using OIDC (OpenID Connect) Web Identity Federation. This approach eliminates the need to store AWS credentials, providing enhanced security and simplified management.

Key Features

No Credentials Stored

Uses temporary security tokens

Read-Only Access

Cannot modify AWS resources

Automated Sync

Hourly, daily, or weekly updates

Historical Data

Import up to 24 months of cost data

Prerequisites

  • Active AWS account with billing enabled
  • IAM permissions to create roles and policies
  • AWS Cost Explorer enabled
  • CosmosCost Business or Business+ plan (Free plan supports 1 AWS account)

Quick Setup

Step 1: Start in CosmosCost

  1. Log in to your CosmosCost dashboard
  2. Navigate to Settings → Cloud Accounts
  3. Click Add Cloud Account
  4. Select AWS
  5. Note the OIDC Provider URL and Subject provided

Step 2: Configure AWS IAM

Create IAM Role

  1. Open AWS Console and go to IAM
  2. Click Roles → Create Role
  3. Select Web Identity
  4. Choose Identity Provider: OpenID Connect
  5. Enter Provider URL from CosmosCost
  6. Set Audience to sts.amazonaws.com
  7. Click Next

Attach Policies

Attach these AWS managed policies:

  • ViewOnlyAccess
  • CostExplorerReadOnlyAccess

Or create a custom policy with minimum permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ce:GetCostAndUsage",
        "ce:GetCostForecast",
        "ce:GetDimensionValues",
        "ce:GetTags"
      ],
      "Resource": "*"
    }
  ]
}

Configure Trust Relationship

Edit the trust relationship with:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::YOUR_ACCOUNT:oidc-provider/YOUR_OIDC_PROVIDER"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "YOUR_OIDC_PROVIDER:sub": "YOUR_SUBJECT_FROM_COSMOSCOST"
        }
      }
    }
  ]
}

Name and Create

  1. Name the role (e.g., "CosmosCostIntegration")
  2. Add description
  3. Create role
  4. Copy the Role ARN

Step 3: Complete in CosmosCost

  1. Return to CosmosCost setup wizard
  2. Paste the Role ARN
  3. Enter account name/alias
  4. Click Connect Account
  5. CosmosCost validates the connection
  6. Initial sync begins automatically

Success!

Your AWS account is connected. Initial sync takes 24-48 hours.

Cost Explorer Configuration

Enabling Cost Explorer

  1. Open AWS Billing Console
  2. Navigate to Cost Explorer
  3. Click Enable Cost Explorer
  4. Wait 24 hours for initial data population

Cost and Usage Reports

(Optional)

For more detailed cost analysis, enable Cost and Usage Reports:

  1. Go to Billing → Cost & Usage Reports
  2. Click Create Report
  3. Configure S3 bucket for report storage
  4. Enable hourly granularity
  5. Include resource IDs
  6. Create report

Multi-Account Setup

AWS Organizations

For organizations with multiple AWS accounts:

  • Set up role in management (payer) account
  • Enable consolidated billing
  • All member account costs aggregated automatically
  • Or create separate connections for each account

Troubleshooting

Connection Failed

Check these common issues:

  • OIDC provider URL entered correctly
  • Trust relationship configured properly
  • Role ARN copied correctly
  • Required policies attached
  • Cost Explorer enabled

No Data Appearing

  • Wait 24-48 hours for initial sync
  • Verify Cost Explorer has data
  • Check account has billable usage
  • Review CloudTrail for API access logs

Permission Errors

  • Verify all required policies attached
  • Check trust relationship condition matches
  • Ensure role is assumable
  • Review AWS CloudTrail logs for denied requests

Need Detailed Instructions?

Check docs/COMPLETE_OIDC_SETUP_GUIDE.md in the repository for comprehensive step-by-step instructions with screenshots.

Still having issues? Check troubleshooting guide or contact support.