Connect AWS

Read permissions and their purpose

This is the permission policy used by Costframe's current setup generator. Billing reads query Cost Explorer; inventory reads describe resources; CloudWatch reads supply utilization evidence. Other groups support tagging, governance and WorkSpaces checks. A listed permission does not promise that every detector is available for your pilot account. Review the groups with your administrator and the workspace's capability checks.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CostframeAwsBillingRead",
      "Effect": "Allow",
      "Action": [
        "ce:GetCostAndUsage",
        "ce:GetCostAndUsageWithResources"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CostframeAwsInventoryRead",
      "Effect": "Allow",
      "Action": [
        "autoscaling:DescribeAutoScalingGroups",
        "ec2:DescribeAddresses",
        "ec2:DescribeInstances",
        "ec2:DescribeNatGateways",
        "ec2:DescribeRegions",
        "ec2:DescribeVolumes",
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeTags",
        "rds:DescribeDBInstances",
        "sts:GetCallerIdentity"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CostframeAwsMetricsRead",
      "Effect": "Allow",
      "Action": [
        "cloudwatch:GetMetricData"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CostframeAwsTagReadiness",
      "Effect": "Allow",
      "Action": [
        "tag:GetResources"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CostframeAwsGovernanceRead",
      "Effect": "Allow",
      "Action": [
        "iam:GetAccessKeyLastUsed",
        "iam:GetAccountSummary",
        "iam:GetPolicyVersion",
        "iam:GetRole",
        "iam:ListAccessKeys",
        "iam:ListPolicies",
        "iam:ListUsers"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CostframeAwsWorkspacesRead",
      "Effect": "Allow",
      "Action": [
        "workspaces:DescribeWorkspaceDirectories",
        "workspaces:DescribeWorkspaces",
        "workspaces:DescribeWorkspacesConnectionStatus"
      ],
      "Resource": "*"
    }
  ]
}

Setup steps

1. 1

   Create the role in your AWS account

   In the AWS Console under IAM, choose Create role. Select Another AWS account as the trusted entity type. Use the Costframe account ID shown in the workspace setup as the trusted account, not your own account ID. Review the generated trust policy before saving it; the permission policy above does not establish who can assume the role.

2. 2

   Require the workspace external ID

   Check Require external ID, and supply the randomized string displayed inside your Costframe workspace connection setup. Keep the exact value in the trust policy's sts:ExternalId condition. It helps bind the role assumption to your workspace and addresses the confused-deputy problem. AWS does not treat an external ID as a secret; it does not replace the trusted-principal restriction or permission policy.

3. 3

   Attach the read policy

   Create an IAM policy with the JSON document structure detailed above, and attach it to your trust role. Save the role with a clear identifier such as Costframe-ReadOnly.

4. 4

   Enter your account ID and role ARN

   Enter your 12-digit AWS Account ID and the generated Role ARN in Cloud Connections. The account number inside the role ARN must match the account you enter. Costframe attempts role assumption with the workspace external ID, checks the returned account identity and tests supported data reads.