> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensorcost.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect AWS infrastructure cost

> Connect an AWS account via a cross-account IAM role so TensorCost can read your cost and usage data, with an optional CUR 2.0 export for exact line-item detail.

# Connect AWS infrastructure cost

This connects an AWS account for general infrastructure spend — compute, storage, networking, everything on your bill. If you're specifically connecting Amazon Bedrock for LLM usage tracking and model-routing recommendations, use [Bedrock integration](/bedrock-integration) instead; it's a separate connection, though it can reuse the same IAM role.

## What TensorCost reads

* Baseline cost and usage data for the account, via the cross-account role.
* Optionally, a **Cost and Usage Report (CUR 2.0)** export — a detailed, line-item billing export AWS delivers to an S3 bucket you control. CUR access is off by default; turn it on if you want exact line-item costs (this also feeds Bedrock line-item detail if you've connected Bedrock).

## Prerequisites

You'll need someone who can create an IAM role in the target AWS account — typically an account admin or anyone with `iam:CreateRole` / `cloudformation:CreateStack` permissions. No AWS Organizations setup is required unless you want to monitor a whole Organization at once (multi-account support follows the same pattern as [Bedrock's Organization mode](/bedrock-integration#multi-account-variants)).

## Steps

<Steps>
  <Step title="Open the connect form">
    **Build → Connect**, Cloud tab → **Amazon Web Services** → **Connect →**.
  </Step>

  <Step title="Launch the CloudFormation stack">
    Click **Launch CFN Stack**. This generates a random External ID and opens the AWS Console with TensorCost's onboarding template pre-filled — the console always points at the correct template for your environment, so there's no template URL to copy or hardcode.

    If you'd rather deploy from the CLI or your own IaC pipeline, copy the template URL and parameter values the console shows next to the launch button.

    <Note>
      Before launching, you can check **Enable CUR access** and fill in your CUR bucket name (and optional path prefix, if your export isn't at the bucket root) — find both in the AWS Billing console under **Cost & Usage Reports**. This carries the values into the stack automatically.
    </Note>
  </Step>

  <Step title="Create the stack in AWS">
    Review the stack in the AWS Console (the IAM role and trust policy are visible before you confirm) and click **Create stack**. It creates exactly one IAM role, scoped read-only, trusting only TensorCost's backend account and requiring your External ID on every assume-role call.
  </Step>

  <Step title="Paste the role ARN back">
    From the stack's **Outputs** tab, copy the role ARN. Back in TensorCost, fill in:

    | Field                             | Where it comes from                                          |
    | --------------------------------- | ------------------------------------------------------------ |
    | AWS Account ID                    | The 12-digit account ID you deployed into                    |
    | IAM Role ARN                      | The stack's output                                           |
    | External ID                       | Auto-filled from step 2 — don't retype it                    |
    | CUR S3 bucket / prefix (optional) | Same values you entered before launching, if you enabled CUR |
  </Step>

  <Step title="Verify, then connect">
    Click **Verify**. This performs a real `sts:AssumeRole` call against what you entered — not a format check. A green check means the role is reachable and correctly configured; click **Connect** to activate it.
  </Step>
</Steps>

## What Verify actually checks

Verify (and every scheduled re-check afterward) genuinely attempts to assume the role:

* The role ARN must match AWS's IAM role ARN shape, and the account ID embedded in the ARN must match the 12-digit Account ID you typed — a mismatch is caught before TensorCost even calls AWS.
* TensorCost then calls `sts:AssumeRole` with your External ID. A working trust policy and matching External ID succeed; anything else surfaces as a specific failure reason (below), not a generic error.

## Common failures

| What you see        | Cause                                                                                                    | Fix                                                                             |
| ------------------- | -------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- |
| `InvalidRoleArn`    | The role doesn't exist, or the ARN is malformed                                                          | Re-check the ARN from the stack's Outputs tab                                   |
| `AccountIdMismatch` | The 12-digit Account ID you typed doesn't match the account embedded in the role ARN                     | Fix whichever one is wrong — they must refer to the same account                |
| `AccessDenied`      | The trust policy doesn't allow TensorCost's account to assume the role, or the External ID doesn't match | Redeploy the stack, or check the trust policy wasn't hand-edited after creation |

## Removing CUR access later

If you enable CUR access, its S3 read permissions are added to the same IAM role — no separate role or reconnect is needed if you decide to turn it off (or on) later; redeploy the stack with `EnableCurAccess` toggled and TensorCost's connection keeps working against the same role ARN.