Cloud integration
Amazon Web Services
Connect AWS with a cross-account IAM role and External ID via CloudFormation (Console or CLI). OptCloud never needs your root credentials, access keys, or write access.
Cross-account IAM role + External ID (Console or CLI)
Read-only
Connection verified in under a minute after you paste the Role ARN; cost sync (Cost Explorer / CUR) follows as the next connector step
How OptCloud connects with AWS
OptCloud uses the AWS-recommended Cross-Account IAM Role pattern with a unique External ID. In Cloud Accounts choose Connect via AWS Console or Connect via CLI: we generate an External ID for this connection, you deploy our CloudFormation stack (OptCloudReadOnly) in your AWS account (Download + Upload template in the Console, or aws cloudformation deploy), then paste the Role ARN back into OptCloud. Before saving, OptCloud calls AWS STS AssumeRole from our hub account using that External ID, if the Account ID, Role ARN, or External ID is wrong, the account is not connected and nothing is stored. We never ask for or store long-lived AWS access keys. The role grants read-only Cost Explorer, CUR, and inventory APIs; we only collect billing and inventory metadata, never application data from EC2, S3 objects, or databases. After a successful verification the account shows Connected and Awaiting first sync until cost ingestion is enabled.
Required permissions (read-only)
- ce:Get* / ce:Describe* / ce:List* (Cost Explorer), high-level historical spend
- cur:Describe* and related report APIs / S3 read on CUR buckets, detailed line items
- ec2:Describe*, rds:Describe*, s3:List*, eks:Describe*/List*, lambda:List*/GetFunctionConfiguration, inventory metadata for recommendations (includes Elastic IPs and EBS snapshots)
- cloudwatch:GetMetricData / GetMetricStatistics / ListMetrics, utilization metrics (CPU, network, disk IOPS, database connections, freeable memory) that power idle and rightsizing recommendations
- organizations:ListAccounts (optional), multi-account rollups under AWS Organizations
- compute-optimizer:Get* / Describe* (optional), additional rightsizing signals when Compute Optimizer is enabled
The CloudFormation template creates role OptCloudReadOnly (name must start with OptCloud). Trust is limited to OptCloud's hub account and requires your unique External ID on every sts:AssumeRole. No long-lived access keys are stored; OptCloud never requests mutation APIs such as iam:Create* or ec2:TerminateInstances.
Connected vs. cost data — what you see, and when
Saving a connection only means STS AssumeRole succeeded, the account is registered and ready for sync. Dashboard KPIs and Cost Explorer stay empty until OptCloud's cost sync (Cost Explorer API and/or CUR) runs. When CUR is enabled, AWS can take up to 24 hours to deliver the first report; the first CUR typically covers the current month only. Until the first sync lands, Overview, Rightsizing, and Idle Resources show honest empty states rather than invented numbers. Once connected, OptCloud syncs automatically on a fixed schedule — no action needed from you or your team. Resource inventory (EC2, RDS, EBS, etc.) refreshes every 4 hours so new or terminated instances appear quickly. Cost data syncs once per day (around 06:00 UTC), but because AWS Cost Explorer itself has approximately 24 hours of lag, the latest day's charges always appear the following day — this is an AWS limitation and applies equally to all FinOps tools in the market. The Sync now button is available in Cloud Accounts if you need to pull the latest data immediately after connecting or making infrastructure changes.
Connecting AWS Organizations (multiple accounts)
Repeat Connect via AWS Console or CLI for each account you want OptCloud to see (each gets its own External ID and CloudFormation stack). If you use AWS Organizations, connect the management (payer) account first when you want consolidated costs. Connecting only a member account limits visibility to that account's spend. Organization-wide discovery of linked accounts will expand as cost sync matures.
Create a connection via Console
- 1
Open Connect AWS in OptCloud
Sign in → Cloud Accounts → Connect account → Amazon Web Services. Click Connect via AWS Console. Enter an account name, the 12-digit AWS Account ID, and a team (defaults to Platform). OptCloud generates a unique External ID for this connection, copy it; you will paste it into the CloudFormation ExternalId parameter.
- 2
Deploy the OptCloudReadOnly CloudFormation stack
Click Download template first, then Open CloudFormation (opens Create stack → Template in us-east-1). Choose Upload a template file, select the downloaded YAML, set stack name OptCloudReadOnly, paste the dialog External ID into ExternalId, keep RoleName OptCloudReadOnly. Acknowledge that CloudFormation may create IAM resources, then create the stack. (AWS rejects non-S3 TemplateURLs such as optcloud.tech, upload is required unless an S3 template URL is configured.)
- 3
Copy the Role ARN from stack Outputs
Wait until the stack status is CREATE_COMPLETE. Open the Outputs tab and copy RoleArn (it looks like arn:aws:iam::YOUR_ACCOUNT_ID:role/OptCloudReadOnly). Do not invent or edit this value.
- 4
Paste the Role ARN and save in OptCloud
Back in the OptCloud dialog, choose I created the stack, continue, paste the Role ARN, then Save connection. The button shows Verifying with AWS… while OptCloud calls STS AssumeRole with your External ID.
- 5
Confirm Connected, only after verification succeeds
If Account ID, Role ARN, or External ID do not match what AWS expects, the connection is rejected and nothing is saved. On success you land on Cloud Accounts with status Connected and Awaiting first sync. Cost Explorer numbers appear after the cost sync step, not at connect time.
Create a connection via AWS CLI
Same IAM role and STS verification as Console, deploy with aws cloudformation deploy instead of the browser quick-create wizard.
- 1
Open Connect via CLI in OptCloud
Sign in → Cloud Accounts → Connect account → Amazon Web Services → Via CLI tab → Connect via CLI. Enter an account name, the 12-digit AWS Account ID, and a team (defaults to Platform). OptCloud shows a unique External ID and a ready-to-run script, do not change the External ID in the commands.
- 2
Run the AWS CLI script in the target account
In a terminal where the AWS CLI is authenticated to that Account ID: download optcloud-readonly-role.yaml (Copy includes curl when the app URL is public; on localhost use Download template and save the file next to your shell). Then run aws cloudformation deploy with stack name OptCloudReadOnly, ExternalId and RoleName from the dialog, --capabilities CAPABILITY_NAMED_IAM, region us-east-1. The copied script uses bash line continuation (a trailing backslash). On Windows PowerShell, run it in Git Bash or WSL, or paste each aws command as a single line.
- 3
Print and copy the Role ARN
Run the describe-stacks command from the dialog (or copy it from the script). It prints RoleArn only, paste that exact value. Do not invent an ARN.
- 4
Paste Role ARN and save, STS verification required
In OptCloud choose I deployed the stack, continue, paste RoleArn, then Save connection. OptCloud calls the same STS AssumeRole verifier as Console. Wrong Account ID, Role ARN, or External ID will not connect and nothing is stored.
- 5
Confirm Connected
On success the account appears under Cloud Accounts as Connected / Awaiting first sync. Cost data arrives after the cost sync step, not at connect time.
Historical cost data (after sync is enabled)
Once Cost Explorer / CUR ingestion is live, high-level totals can come from Cost Explorer quickly; full resource- and tag-level filtering typically needs CUR delivery (often up to 24 hours for the first report). The first CUR usually covers the current month, for older months, request a CUR backfill from AWS for the export OptCloud uses, then ask us to re-ingest. Until then, dashboards stay empty rather than showing placeholder spend.
Data collected
- Cost and usage line items (service, account, region, usage type, tags), after cost sync
- Resource inventory metadata (instance type, state, attached volumes, Elastic IPs, EBS snapshots, not disk contents)
- CloudWatch utilization metrics (averages over the last 7–14 days) for EC2, EBS, and RDS, never application logs or payloads
- Commitment inventory (Savings Plans, Reserved Instances) for coverage analysis
- Optional Compute Optimizer recommendations when enabled in AWS
What you get in OptCloud
- Verified cross-account connection (STS AssumeRole) with no customer access keys
- Unified Cost Explorer across every connected AWS account (after sync)
- Rightsizing and idle resource recommendations ranked by ROI
- Savings Plans / RI coverage and break-even modeling
- Tag compliance and unallocated spend views
- FinOps Agent answers grounded in your live AWS cost data
Filterable dimensions
Once connected, you can filter and group cost data in Cost Explorer and Reports by:
- Account, AWS account name and ID
- Category, compute, storage, network, database, other (OptCloud's normalized category)
- Service, e.g. EC2, RDS, S3, EKS
- Region, e.g. us-east-1, eu-west-1
- Resource, specific resource ID (instance, volume, load balancer, etc.)
- Tag / Not tagged, any AWS cost allocation tag key and value
- Usage type and operation, the underlying CUR usage type driving the charge
- Charge type, usage, tax, credit, refund, Savings Plan/RI amortization
Updating or rotating your connection
When OptCloud adds a new read-only permission (for example CloudWatch metrics for recommendations), you do not need to reconnect. Update the existing OptCloudReadOnly stack with the latest template and keep the same External ID: in the Console, open CloudFormation → OptCloudReadOnly → Update → Replace existing template → upload the new optcloud-readonly-role.yaml (Download template in OptCloud) → keep the ExternalId and RoleName parameters unchanged → acknowledge IAM capabilities → Submit. With the CLI, run the same aws cloudformation deploy command you used to connect, with the same ExternalId, against the new template file. The Role ARN stays the same, so nothing changes in OptCloud. To rotate the External ID instead, remove the account in Cloud Accounts, delete the OptCloudReadOnly stack, and run Connect via AWS Console or CLI again with a new External ID. Do not reuse an old External ID with a new OptCloud dialog, verification will fail.
Troubleshooting
Save connection fails with Role ARN or External ID is wrong
The Account ID you typed must match the 12 digits inside the Role ARN. The External ID shown in the OptCloud dialog must be the same value used as the CloudFormation ExternalId parameter (paste it when uploading the template; CLI script embeds it). Redeploy the stack with that External ID, copy RoleArn again, and retry. Wrong or invented values never create a Connected account.
Role does not exist / NoSuchEntity
Confirm the stack reached CREATE_COMPLETE and that you copied RoleArn from Outputs or describe-stacks (not the stack ID). Role name must start with OptCloud (default OptCloudReadOnly).
CLI deploy fails or cannot find the template file
Save the YAML as optcloud-readonly-role.yaml in the directory where you run aws cloudformation deploy. On localhost, use Download template instead of curl. Ensure AWS CLI credentials belong to the same 12-digit Account ID you entered in OptCloud. If PowerShell reports a syntax error on the copied script, the trailing backslashes are bash line breaks: use Git Bash or WSL, or run each aws command on one line.
Account shows Connected but Overview / Cost Explorer is empty
That is expected until cost sync runs. Connected means STS verification succeeded (Awaiting first sync). Spend charts populate after Cost Explorer / CUR ingestion, not at connect time.
TemplateURL must be a supported URL / Open CloudFormation fails
CloudFormation quick-create only accepts TemplateURL from Amazon S3, not https://optcloud.tech/... Use Download template in OptCloud, then Upload a template file in the Console, paste the dialog External ID into ExternalId, and create stack OptCloudReadOnly. Or use Connect via CLI with the same YAML.
Multi-account Organizations, do I connect every account?
Run Connect via AWS Console or CLI once per account you want listed. Prefer connecting the management (payer) account first for consolidated visibility when sync supports Organizations.
CloudFormation CREATE_FAILED: resource OptCloudReadOnly already exists
A previous connection attempt left an IAM role with a different External ID. Go to IAM → Roles, find OptCloudReadOnly, delete it, then run Connect via AWS Console or CLI again. The new dialog generates a fresh External ID that will match the new stack.
Sync fails with User not enabled for cost explorer access
AWS Cost Explorer must be activated manually before the first query. Open AWS Billing → Cost Explorer and click Enable Cost Explorer. The activation is free and takes a few minutes; after that, the next Sync now will run without this error. Newly activated accounts can take up to 24 hours before historical cost data appears, so 0 cost records on the first sync is normal.
I connected before recommendations launched. Do I need to reconnect?
No. Accounts connected with the first template lack CloudWatch read access, so idle and rightsizing recommendations that depend on utilization metrics will not appear for them. Update the existing OptCloudReadOnly stack with the latest template, keeping the same External ID (see Updating or rotating your connection). The Role ARN does not change and cost and inventory sync keep working during the update. Recommendations that do not need metrics (unattached EBS volumes, unassociated Elastic IPs, old snapshots, gp2 volumes, RDS configuration checks, Savings Plans coverage) work with either template.
Which recommendations does OptCloud generate for AWS, and with what thresholds?
EC2: idle when average CPU is below 5% and network traffic below 1 MB/s over 14 days; rightsizing when average CPU is below 40% over 14 days (memory is not used because it requires the CloudWatch agent inside the instance). EBS: unattached volumes, attached volumes with zero read and write operations over 14 days, and gp2 volumes that can move to gp3. Elastic IPs: not associated, or associated with a stopped instance. Snapshots: older than 90 days and not used by an AMI, or whose source volume no longer exists. RDS: idle with zero connections over 7 days; rightsizing when CPU is below 30% and freeable memory above 70% over 14 days; risk checks for Single-AZ production databases, engine versions near end of support, and backup retention above 14 days. Account level: Savings Plans coverage gaps from Cost Explorer. Savings are calculated from AWS published prices, never from generic percentages. Recommendations refresh every day at 06:30 UTC, after each Sync now, and when you click Refresh recommendations. Opportunities that no longer apply expire automatically; items you approved or dismissed keep your decision.
Recommendations show no idle or rightsizing items
These rules need 7 to 14 days of CloudWatch history and the CloudWatch permission in the OptCloudReadOnly role. Confirm the stack uses the latest template (the role description ends in template v2) and that the resources have been running long enough. Resources launched in the last 14 days are not evaluated for rightsizing yet.
How often does OptCloud sync automatically? Do I need to click Sync now?
No manual action is required after the first sync. OptCloud runs an automatic schedule: resource inventory (EC2, RDS, EBS, etc.) refreshes every 4 hours, and cost data syncs once per day around 06:00 UTC. New resources typically appear within 4 hours of being created. Cost for a given day appears the following day because AWS Cost Explorer has approximately 24 hours of processing lag — this is the same for all FinOps tools. Use Sync now only when you want to see changes immediately, such as right after connecting a new account or creating a large batch of resources.
China or GovCloud regions
Standard OptCloud verification and ingestion target commercial AWS regions. GovCloud/China need a supported pattern, contact us.
Related integrations
Ready to connect AWS?
Open the dashboard to add the account, or book a walkthrough with our team.