Integrating with AWS Cost Explorer

Overview

This guide provides step-by-step instructions for connecting AWS Cost Explorer to Drivetrain so your cloud cost and usage data can be synced for analysis and reporting.

Prerequisites

To connect AWS Cost Explorer to Drivetrain, you need:

• An AWS account with Cost Explorer enabled

• IAM permissions to create policies and roles (or an IAM user) in that account

• The data scope you want to sync (see "Data Scope to Confirm" at the end of this guide)

Integration Methods

Two approaches are available:

Method 1: IAM Role (Recommended, more secure)

• You grant Drivetrain's AWS account permission to assume a read-only role in your account. No long-lived keys are shared.

• You share back: Role ARN

Method 2: Access Key and Secret

• You create an IAM user with read-only Cost Explorer access and share its credentials.

• You share back: Access key, Access secret

AWS Cost Explorer is a global service, so no AWS Region is required.

Method 1: Using IAM Role (Recommended)

Step 1: Create an IAM Policy

Create the policy in the AWS IAM console with this JSON configuration:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:GetDimensionValues", "ce:GetTags", "ce:GetCostForecast", "ce:GetCostCategories", "ce:ListCostCategoryDefinitions" ], "Resource": "*" } ] }

Name the policy "Drivetrain-CostExplorer-Access".

Step 2: Create an IAM Role

1. Go to Roles and select Create role

2. Choose AWS account and enter Drivetrain's Account ID: 865992467666

3. Select the "Drivetrain-CostExplorer-Access" policy

4. Name the role "Drivetrain-Integration" and create it

The role's trust relationship should allow Drivetrain's account to assume it. After creation, the trust policy should look like this:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::865992467666:role/Drivetrain-Integration" }, "Action": "sts:AssumeRole" } ] }

Step 3: Integration Details

Share these with Drivetrain:

1. Role ARN (e.g. arn:aws:iam::<your-account-id>:role/Drivetrain-Integration)

2. The data scope (see "Data Scope to Confirm" below)

Method 2: Using Access Key and Secret

Step 1: Create an IAM Policy

Follow the same steps as Method 1, Step 1, to create the "Drivetrain-CostExplorer-Access" policy.

Step 2: Create User

1. Go to Users and select Add users

2. Enter a username (e.g. "Drivetrain-Integration")

3. Select "Attach policies directly" and choose your "Drivetrain-CostExplorer-Access" policy

4. Complete user creation

Step 3: Generate Access Key and Secret

1. Open the created user in the Users tab

2. Navigate to Security credentials > Access keys

3. Create an access key for third-party service use

4. Copy both the Access key and Secret access key values

Step 4: Integration Details

Share these with Drivetrain:

1. Access key

2. Access secret

3. The data scope (see "Data Scope to Confirm" below)

Data Scope to Confirm

Along with access, confirm what you would like Drivetrain to pull:

• Cost metric(s): unblended, blended, amortized, net amortized, or net unblended cost (and usage quantity, if needed)

• Granularity: daily or monthly

• Group-by dimensions: e.g. service, linked account, region, usage type, instance type

• History: how far back to backfill (e.g. last 12 or 24 months)

Information to Share with Drivetrain

Provide your Data Integration Manager or Customer Success Manager with:

• Role ARN (Method 1) or Access key and Access secret (Method 2)

• Cost metric(s)

• Granularity

• Group-by dimensions

• History / backfill period