> For the complete documentation index, see [llms.txt](https://docs.finops.softwareone.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.finops.softwareone.com/system/data-sources/amazon-web-services/configure-aws-access.md).

# Configure AWS Access

## AWS IAM Policies

FinOps for Cloud requires two policies, depending on the type of account being onboarded:

* **Billing import access policy** - This policy allows FinOps for Cloud to read cost and usage data from the configured S3 bucket. This policy is only required when you are onboarding an account that contains a cost and usage report.
* **Resource discovery access policy** - This policy allows FinOps for Cloud to discover new and changed resources in your AWS account more often than AWS updates the cost and usage reports. This allows FinOps for Cloud to show information about your spend that is more up-to-date than what is contained in the cost and usage report.

{% hint style="warning" %}
Note that any service control policies configured in your organization may prevent FinOps for Cloud from importing your data. For more information, read about [Service Control Policies](#service-control-policies) below.
{% endhint %}

### Create a policy for billing imports

The billing import access policy is only required for accounts with cost and usage reports configured for FinOps for Cloud.

A suggested name for the policy is `FinOpsForCloudBillingImport`.

{% hint style="warning" %}
In the following policy, be sure to replace `<bucket_name>` with a valid name of your S3 bucket.
{% endhint %}

{% code lineNumbers="true" %}

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "FinOpsForCloudGetBillingFiles",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::<bucket_name>/*"
        },
        {
            "Sid": "FinOpsForCloudManageBillingBucket",
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListBucket",
                "s3:PutBucketPolicy",
                "s3:PutObject"

            ],
            "Resource": "arn:aws:s3:::<bucket_name>"
        }
    ]
}
```

{% endcode %}

### Create a policy for resource discovery

The resource discovery access policy is required for all accounts.

A suggested name for the policy is `FinOpsForCloudResourceDiscovery`.

{% code lineNumbers="true" %}

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "FinOpsforCloudGetResources",
            "Effect": "Allow",
            "Action": [
                "bcm-data-exports:GetExport",
                "bcm-data-exports:ListExports",
                "cloudwatch:GetMetricStatistics",
                "cur:DescribeReportDefinitions",
                "ec2:Describe*",
                "elasticloadbalancing:Describe*",
                "iam:GetAccessKeyLastUsed",
                "iam:GetLoginProfile",
                "iam:ListAccessKeys",
                "iam:ListUsers",
                "s3:GetAnalyticsConfiguration",
                "s3:GetBucketAcl",
                "s3:GetBucketLocation",
                "s3:GetBucketPolicy",
                "s3:GetBucketPolicyStatus",
                "s3:GetBucketPublicAccessBlock",
                "s3:GetBucketTagging",
                "s3:GetIntelligentTieringConfiguration",
                "s3:GetLifecycleConfiguration",
                "s3:GetMetricsConfiguration",
                "s3:GetObject",
                "s3:ListAllMyBuckets",
                "s3:ListBucket"
            ],
            "Resource": "*"
        }
    ]
}
```

{% endcode %}

## AWS IAM assumed role

### Creating a new IAM role

To create a new IAM role for FinOps for Cloud, see [Create a role using custom trust policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-custom.html) in the AWS IAM user guide.

When creating the role, use the following settings:

1. For **Trusted entity type**, choose **Custom trust policy**.
2. Under **Custom trust policy**, copy and paste the following trust policy:

{% code lineNumbers="true" %}

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::654035049067:user/ffc-service-user"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
```

{% endcode %}

3. Select **Next**.
4. Under **Permissions policies**, select the following policies:
   1. `FinOpsForCloudResourceDiscovery` (always required)
   2. `FinOpsForCloudBillingImport` (required only for management or standalone accounts with cost and usage reports buckets)
5. Under **Set permissions boundary,** select **Create role without a permissions boundary**. Then, select **Next**.
6. Under **Role name**, enter `FinOpsForCloudAccessRole`. Then, enter your own optional description and add any tags you require.
7. Select **Create role**.

## AWS IAM user and access key

### Creating a new IAM user

To create a new IAM user for FinOps for Cloud, see [Create an IAM user in your AWS account](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html) in the AWS IAM User Guide.

When creating the user, use the following settings:

1. For **User name**, enter `FinOpsForCloudUser`.
2. In **Provide user access to the AWS Management Console**, select **No**.
3. Under **Set permissions**, select **Attach policies directly**.
   1. `FinOpsForCloudResourceDiscovery` (always required)
   2. `FinOpsForCloudBillingImport` (required only for accounts with cost and usage reports buckets)

### Creating an access key for FinOps for Cloud

To create an access key for FinOps for Cloud, see [Create an access key for an IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-keys-admin-managed.html#admin-create-access-key) in the AWS IAM User Guide.

When creating the access key, choose **Third-party service** as your use case.

{% hint style="warning" %}
Be sure to store your access key and secret access key securely. This is your only chance to view or download the newly created access key, as it cannot be recovered later.
{% endhint %}

## Service Control Policies

When onboarding an AWS datasource, **FinOps for Cloud** requires access to cost, usage, and resource data. This access is granted by attaching an IAM policy with the required permissions (Actions) to the IAM identity used by the assumed role.

In environments governed by AWS Service Control Policies (SCPs), it is important to understand how permission evaluation works:

* **SCPs apply at the organisation level** and define the maximum allowed permissions.
* **Explicit Deny statements in an SCP always override IAM permissions**, regardless of what is granted in the attached IAM policy.
* SCPs may restrict access based on conditions such as **AWS Region** or **calling identity**.

If an SCP denies any of the actions required for resource discovery, **FinOps for Cloud** will be unable to retrieve cost, usage, or resource information. This will result in incomplete or failed data ingestion.

### What you need to verify

To ensure successful onboarding and ongoing data collection:

* Confirm that the IAM identity used for the assumed role is **not restricted by SCP Deny rules** for any required actions.
* Review SCP conditions (e.g. region restrictions or principal constraints) that may unintentionally block access.
* Ensure that all required actions defined in the Resource Discovery IAM policy are **effectively allowed** after SCP evaluation.

If any required action is denied by an SCP, resource discovery will fail and **FinOps for Cloud** will not function as expected.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.finops.softwareone.com/system/data-sources/amazon-web-services/configure-aws-access.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.