Skip to main content

​
Connect AWS infrastructure cost

This connects an AWS account for general infrastructure spend — compute, storage, networking, everything on your bill. If you’re specifically connecting Amazon Bedrock for LLM usage tracking and model-routing recommendations, use Bedrock integration instead; it’s a separate connection, though it can reuse the same IAM role.

​
What TensorCost reads

  • Baseline cost and usage data for the account, via the cross-account role.
  • Optionally, a Cost and Usage Report (CUR 2.0) export — a detailed, line-item billing export AWS delivers to an S3 bucket you control. CUR access is off by default; turn it on if you want exact line-item costs (this also feeds Bedrock line-item detail if you’ve connected Bedrock).

​
Prerequisites

You’ll need someone who can create an IAM role in the target AWS account — typically an account admin or anyone with iam:CreateRole / cloudformation:CreateStack permissions. No AWS Organizations setup is required unless you want to monitor a whole Organization at once (multi-account support follows the same pattern as Bedrock’s Organization mode).

​
Steps

1

Open the connect form

Build → Connect, Cloud tab → Amazon Web Services → Connect →.
2

Launch the CloudFormation stack

Click Launch CFN Stack. This generates a random External ID and opens the AWS Console with TensorCost’s onboarding template pre-filled — the console always points at the correct template for your environment, so there’s no template URL to copy or hardcode.If you’d rather deploy from the CLI or your own IaC pipeline, copy the template URL and parameter values the console shows next to the launch button.
Before launching, you can check Enable CUR access and fill in your CUR bucket name (and optional path prefix, if your export isn’t at the bucket root) — find both in the AWS Billing console under Cost & Usage Reports. This carries the values into the stack automatically.
3

Create the stack in AWS

Review the stack in the AWS Console (the IAM role and trust policy are visible before you confirm) and click Create stack. It creates exactly one IAM role, scoped read-only, trusting only TensorCost’s backend account and requiring your External ID on every assume-role call.
4

Paste the role ARN back

From the stack’s Outputs tab, copy the role ARN. Back in TensorCost, fill in:
5

Verify, then connect

Click Verify. This performs a real sts:AssumeRole call against what you entered — not a format check. A green check means the role is reachable and correctly configured; click Connect to activate it.

​
What Verify actually checks

Verify (and every scheduled re-check afterward) genuinely attempts to assume the role:
  • The role ARN must match AWS’s IAM role ARN shape, and the account ID embedded in the ARN must match the 12-digit Account ID you typed — a mismatch is caught before TensorCost even calls AWS.
  • TensorCost then calls sts:AssumeRole with your External ID. A working trust policy and matching External ID succeed; anything else surfaces as a specific failure reason (below), not a generic error.

​
Common failures

​
Removing CUR access later

If you enable CUR access, its S3 read permissions are added to the same IAM role — no separate role or reconnect is needed if you decide to turn it off (or on) later; redeploy the stack with EnableCurAccess toggled and TensorCost’s connection keeps working against the same role ARN.