AWS

中文 Docs

An AWS account reaches the ledger one of two ways. Cost Explorer is the quick one: an access key and a one-action policy, and the bill arrives as costs per service per day. A Data Export in S3 is the detailed one: resource IDs, tags and the linked account of every row — what Insights needs to price a resource.

Cost Explorer

1. Open the IAM console, go to Users and Create user. It needs no console access.
2. On the new user, choose Add permissions → Create inline policy, switch to the JSON editor and paste the policy below (also available as aws-cost-explorer-policy.json).
3. Open the user's Security credentials tab and click Create access key. Copy the Access Key ID and Secret Access Key; AWS shows the secret only once.
4. Add the account in CloudBridge with that key pair.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ce:GetCostAndUsage"
            ],
            "Resource": "*"
        }
    ]
}

It grants only ce:GetCostAndUsage, the one Cost Explorer action CloudBridge calls. Validating the key uses STS GetCallerIdentity, which needs no grant. Temporary credentials that need a session token are not supported. Provider permissions has the reasoning and how to scope it.

What it costs

Cost Explorer charges per request. A refresh asks for two months per account — last month and this one — one request each, and more for a month so large Cost Explorer returns it in pages (at most 20). The refresh interval keeps the background schedule to one refresh per interval, so with the default 24 hours an account costs about two requests a day. A fetch AWS answered but CloudBridge failed to store is not repeated within the interval. Force Refresh goes around all of this; it is the one way to spend more. Check AWS pricing for current rates.

Data Exports from S3

CloudBridge can read AWS Data Exports (CUR 2.0, in the FOCUS 1.2 with AWS columns shape) from the S3 bucket they are delivered to. Put the export's URI — s3://bucket/prefix — in the account form's Data export S3 URI field, and Refresh reads from there instead of Cost Explorer.

• Parquet or gzipped CSV, whichever the export was set to deliver.
• A month counts once. Only the files the period's manifest names are read, so an export that keeps every delivery still counts a month once.
• Not delivered is not zero. A period the export has not written yet is skipped, never stored as an empty month.
• Unchanged is not downloaded again. The files' keys, sizes and ETags are compared with the last fetch first; a month AWS finished delivering costs one listing and a manifest read per refresh.
• A payer's export splits by member account. Each row keeps the linked account it was billed under.

The Cost Explorer policy does not grant S3 access: see Provider permissions. S3 storage and request fees still apply.

Scanning resources

Insights scans an AWS account with the same access key, and only reads. For that the key needs read access to resources, such as the AWS ReadOnlyAccess managed policy.