Skip to content

Commit e3d1b80

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #259964 from bandersmsft/ghissue117316
MCM - Update for aws setup
2 parents 6133e1d + 7627f0a commit e3d1b80

File tree

2 files changed

+60
-56
lines changed

2 files changed

+60
-56
lines changed

‎articles/cost-management-billing/costs/aws-integration-manage.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ titleSuffix: Microsoft Cost Management
44
description: This article helps you understand how to use cost analysis and budgets in Cost Management to manage your AWS costs and usage.
55
author: bandersmsft
66
ms.author: banders
7-
ms.date: 11/09/2023
7+
ms.date: 11/30/2023
88
ms.topic: how-to
99
ms.service: cost-management-billing
1010
ms.subservice: cost-management
@@ -153,19 +153,19 @@ This error means that Cost Management is unable to see the Cost and Usage report
153153

154154
**Error code:** _AccessDeniedListReports_
155155

156-
This error means that Cost Management is unable to list the object in the S3 bucket where the CUR is located. AWS IAM policy requires a permission on the bucket and on the objects in the bucket. See [Create a role and policy in AWS](aws-integration-set-up-configure.md#create-a-role-and-policy-in-aws).
156+
This error means that Cost Management is unable to list the object in the S3 bucket where the CUR is located. AWS IAM policy requires a permission on the bucket and on the objects in the bucket. See [Create a role and policy in AWS](aws-integration-set-up-configure.md#create-a-policy-and-role-in-aws).
157157

158158
### Collection failed with Access Denied - Download report
159159

160160
**Error code:** _AccessDeniedDownloadReport_
161161

162-
This error means that Cost Management is unable to access and download the CUR files stored in the Amazon S3 bucket. Make sure that the AWS JSON policy attached to the role resembles the example shown at the bottom of the [Create a role and policy in AWS](aws-integration-set-up-configure.md#create-a-role-and-policy-in-aws) section.
162+
This error means that Cost Management is unable to access and download the CUR files stored in the Amazon S3 bucket. Make sure that the AWS JSON policy attached to the role resembles the example shown at the bottom of the [Create a role and policy in AWS](aws-integration-set-up-configure.md#create-a-policy-and-role-in-aws) section.
163163

164164
### Collection failed since we did not find the Cost and Usage Report
165165

166166
**Error code:** _FailedToFindReport_
167167

168-
This error means that Cost Management can't find the Cost and Usage report that was defined in the connector. Make sure it isn't deleted and that the AWS JSON policy attached to the role resembles the example shown at the bottom of the [Create a role and policy in AWS](aws-integration-set-up-configure.md#create-a-role-and-policy-in-aws) section.
168+
This error means that Cost Management can't find the Cost and Usage report that was defined in the connector. Make sure it isn't deleted and that the AWS JSON policy attached to the role resembles the example shown at the bottom of the [Create a role and policy in AWS](aws-integration-set-up-configure.md#create-a-policy-and-role-in-aws) section.
169169

170170
### Unable to create or verify connector due to Cost and Usage Report definitions mismatch
171171

‎articles/cost-management-billing/costs/aws-integration-set-up-configure.md

Lines changed: 56 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ titleSuffix: Microsoft Cost Management
44
description: This article walks you through setting up and configuring AWS Cost and Usage report integration with Cost Management.
55
author: bandersmsft
66
ms.author: banders
7-
ms.date: 04/05/2023
7+
ms.date: 11/30/2023
88
ms.topic: how-to
99
ms.service: cost-management-billing
1010
ms.subservice: cost-management
@@ -33,96 +33,79 @@ Use the **Cost & Usage Reports** page of the Billing and Cost Management console
3333
8. For **S3 bucket**, choose **Configure**.
3434
9. In the Configure S3 Bucket dialog box, enter a bucket name and the Region where you want to create a new bucket and choose **Next**.
3535
10. Select **I have confirmed that this policy is correct**, then select **Save**.
36-
11. (Optional) For Report path prefix, enter the report path prefix that you want prepended to the name of your report.
37-
If you don't specify a prefix, the default prefix is the name that you specified for the report. The date range has the `/report-name/date-range/` format.
36+
11. (Optional) For Report path prefix, enter the report path prefix that you want prepended to the name of your report.
37+
If skipped, the default prefix is the name that you specified for the report. The date range has the `/report-name/date-range/` format.
3838
12. For **Time unit**, choose **Hourly**.
3939
13. For **Report versioning**, choose whether you want each version of the report to overwrite the previous version, or if you want more new reports.
4040
14. For **Enable data integration for**, no selection is required.
4141
15. For **Compression**, select **GZIP**.
4242
16. Select **Next**.
43-
17. After you've reviewed the settings for your report, select **Review and Complete**.
44-
45-
Note the report name. You'll use it in later steps.
43+
17. After you review the settings for your report, select **Review and Complete**.
44+
Note the report name. You use it in later steps.
4645

4746
It can take up to 24 hours for AWS to start delivering reports to your Amazon S3 bucket. After delivery starts, AWS updates the AWS Cost and Usage report files at least once a day. You can continue configuring your AWS environment without waiting for delivery to start.
4847

4948
> [!NOTE]
5049
> Cost and usage reports configured at the member (linked) account level aren't currently supported.
5150
52-
## Create a role and policy in AWS
51+
## Create a policy and role in AWS
5352

5453
Cost Management accesses the S3 bucket where the Cost and Usage report is located several times a day. The service needs access to credentials to check for new data. You create a role and policy in AWS to allow Cost Management to access it.
5554

5655
To enable role-based access to an AWS account in Cost Management, the role is created in the AWS console. You need to have the _role ARN_ and _external ID_ from the AWS console. Later, you use them on the **Create an AWS connector** page in Cost Management.
5756

58-
Use the Create a New Role wizard:
57+
### Use the Create Policy wizard
5958

60-
1. Sign in to your AWS console and select **Services**.
61-
2. In the list of services, select **IAM**.
62-
3. Select **Roles** and then select **Create Role**.
63-
4. On the **Select trusted entity** page, select **AWS account** and then under **An AWS account**, select **Another AWS account**.
64-
5. Under **Account ID**, enter **432263259397**.
65-
6. Under **Options**, select **Require external ID (Best practice when a third party will assume this role)**.
66-
7. Under **External ID**, enter the external ID, which is a shared passcode between the AWS role and Cost Management. The same external ID is also used on the **New Connector** page in Cost Management. Microsoft recommends that you use a strong passcode policy when entering the external ID. The external ID should comply with AWS restrictions:
67-
- Type: String
68-
- Length constraints: Minimum length of 2. Maximum length of 1224.
69-
- Must satisfy regular expression pattern: [\w+=,.@: /-]*
70-
> [!NOTE]
71-
> Don't change the selection for **Require MFA**. It should remain cleared.
72-
8. Select **Next: Permissions**.
73-
9. Select **Create policy**. A new browser tab opens where you create a policy.
74-
10. Select **Choose a service**.
59+
1. Sign in into your AWS console and select **Services**.
60+
2. In the list of services, select **IAM**.
61+
3. Select **Policies**.
62+
4. Select **Create policy**.
63+
5. Select **Choose a service**.
7564

76-
Configure permission for the Cost and Usage report:
65+
### Configure permission for the Cost and Usage report
7766

7867
1. Enter **Cost and Usage Report**.
7968
2. Select **Access level** > **Read** > **DescribeReportDefinitions**. This step allows Cost Management to read what CUR reports are defined and determine if they match the report definition prerequisite.
80-
3. Select **Add additional permissions**.
69+
3. Select **Add more permissions**.
8170

82-
Configure permission for your S3 bucket and objects:
71+
### Configure permission for your S3 bucket and objects
8372

8473
1. Select **Choose a service**.
8574
2. Enter **S3**.
8675
3. Select **Access level** > **List** > **ListBucket**. This action gets the list of objects in the S3 Bucket.
8776
4. Select **Access level** > **Read** > **GetObject**. This action allows the download of billing files.
88-
5. Select **Resources**.
89-
6. Select **bucket – Add ARN**.
90-
7. In **Bucket name**, enter the bucket used to store the CUR files.
91-
8. Select **object – Add ARN**.
92-
9. In **Bucket name**, enter the bucket used to store the CUR files.
93-
10. In **Object name**, select **Any**.
94-
11. Select **Add additional permissions**.
77+
5. Select **Resources** > **Specific**.
78+
6. In **bucket**, select the **Add ARNs** link to open another window.
79+
7. In **Resource Bucket name**, enter the bucket used to store the CUR files.
80+
8. Select **Add ARNs**.
81+
9. In **object**, select **Any**.
82+
10. Select **Add more permissions**.
9583

96-
Configure permission for Cost Explorer:
84+
### Configure permission for Cost Explorer
9785

9886
1. Select **Choose a service**.
9987
2. Enter **Cost Explorer Service**.
10088
3. Select **All Cost Explorer Service actions (ce:\*)**. This action validates that the collection is correct.
101-
4. Select **Add additional permissions**.
89+
4. Select **Add more permissions**.
10290

103-
Add permission for AWS Organizations:
91+
### Add permission for AWS Organizations
10492

10593
1. Enter **Organizations**.
10694
2. Select **Access level** > **List** > **ListAccounts**. This action gets the names of the accounts.
107-
3. Select **Add Additional permissions**.
95+
3. Select **Add more permissions**.
10896

109-
Configure permissions for Policies
97+
### Configure permissions for Policies
11098

11199
1. Enter **IAM**.
112100
1. Select Access level > List > **ListAttachedRolePolicies** and **ListPolicyVersions** and **ListRoles**.
113101
1. Select Access level > Read > **GetPolicyVersion**.
114102
1. Select **Resources** > policy, and then select **Any**. These actions allow verification that only the minimal required set of permissions were granted to the connector.
115-
1. Select role - **Add ARN**. The account number should be automatically populated.
116-
1. In **Role name with path**, enter a role name and note it. You need to use it in the final role creation step.
117-
1. Select **Add**.
118-
1. Select **Next: Tags**. You may enter tags you wish to use or skip this step. This step isn't required to create a connector in Cost Management.
119-
1. Select **Next: Review Policy**.
120-
1. In Review Policy, enter a name for the new policy. Verify that you entered the correct information, and then select **Create Policy**.
121-
1. Go back to the previous tab and refresh the policies list. On the search bar, search for your new policy.
122-
1. Select **Next: Review**.
123-
1. Enter the same role name you defined and noted while configuring the IAM permissions. Verify that you entered the correct information, and then select **Create Role**.
124-
125-
Note the role ARN and the external ID used in the preceding steps when you created the role. You'll use them later when you set up the Cost Management connector.
103+
1. Select **Next**.
104+
105+
### Review and create
106+
1. In Review Policy, enter a name for the new policy. Verify that you entered the correct information.
107+
1. Add tags. You can enter tags you wish to use or skip this step. This step isn't required to create a connector in Cost Management.
108+
1. Select **Create policy** to complete this procedure.
126109

127110
The policy JSON should resemble the following example. Replace `bucketname` with the name of your S3 bucket, `accountname` with your account number and `rolename` with the role name you created.
128111

@@ -162,6 +145,27 @@ The policy JSON should resemble the following example. Replace `bucketname` with
162145
}
163146
```
164147

148+
### Use the Create a New Role wizard
149+
150+
1. Sign in to your AWS console and select **Services**.
151+
2. In the list of services, select **IAM**.
152+
3. Select **Roles** and then select **Create Role**.
153+
4. On the **Select trusted entity** page, select **AWS account** and then under **An AWS account**, select **Another AWS account**.
154+
5. Under **Account ID**, enter **432263259397**.
155+
6. Under **Options**, select **Require external ID (Best practice when a third party will assume this role)**.
156+
7. Under **External ID**, enter the external ID, which is a shared passcode between the AWS role and Cost Management. Note the external ID, because you use it on the **New Connector** page in Cost Management. Microsoft recommends that you use a strong passcode policy when entering the external ID. The external ID should comply with AWS restrictions:
157+
- Type: String
158+
- Length constraints: Minimum length of 2. Maximum length of 1224.
159+
- Must satisfy regular expression pattern: `[\w+=,.@: /-]*`
160+
> [!NOTE]
161+
> Don't change the selection for **Require MFA**. It should remain cleared.
162+
8. Select **Next**.
163+
9. On the search bar, search for your new policy and select it.
164+
10. Select **Next**.
165+
11. In **Role details**, enter a role name. Verify that you entered the correct information. Note the name entered because you use it later when you set up the Cost Management connector.
166+
12. Optionally, add tags. You can enter any tags like or skip this step. This step isn't required to create a connector in Cost Management.
167+
13. Select **Create role**.
168+
165169
## Set up a new connector for AWS in Azure
166170

167171
Use the following information to create an AWS connector and start monitoring your AWS costs.
@@ -185,7 +189,7 @@ Use the following information to create an AWS connector and start monitoring yo
185189
1. Select **Add connector**.
186190
1. On the **Create connector** page, in **Display name**, enter a name for your connector.
187191
:::image type="content" source="./media/aws-integration-setup-configure/create-aws-connector01.png" alt-text="Example of the page for creating an AWS connector" :::
188-
1. Optionally, select the default management group. It will store all discovered linked accounts. You can set it up later.
192+
1. Optionally, select the default management group. It stores all discovered linked accounts. You can set it up later.
189193
1. In the **Billing** section, select **Auto-Renew** to **On** if you want to ensure continuous operation. If you select the automatic option, you must select a billing subscription.
190194
1. For **Role ARN**, enter the value that you used when you set up the role in AWS.
191195
1. For **External ID**, enter the value that you used when you set up the role in AWS.
@@ -220,7 +224,7 @@ When you select a connector on the **Connectors for AWS** page, you can:
220224

221225
## Set up Azure management groups
222226

223-
Place your Azure subscriptions and AWS linked accounts in the same management group to create a single location where you can see cross-cloud provider information. If you haven't already configured your Azure environment with management groups, see [Initial setup of management groups](../../governance/management-groups/overview.md#initial-setup-of-management-groups).
227+
Place your Azure subscriptions and AWS linked accounts in the same management group to create a single location where you can see cross-cloud provider information. If you want to configure your Azure environment with management groups, see [Initial setup of management groups](../../governance/management-groups/overview.md#initial-setup-of-management-groups).
224228

225229
If you want to separate costs, you can create a management group that holds just AWS linked accounts.
226230

@@ -260,6 +264,6 @@ AWS linked accounts always inherit permissions from the management group that th
260264

261265
## Next steps
262266

263-
- Now that you've set up and configured AWS Cost and Usage report integration, continue to [Manage AWS costs and usage](aws-integration-manage.md).
267+
- Now that you set up and configured AWS Cost and Usage report integration, continue to [Manage AWS costs and usage](aws-integration-manage.md).
264268
- If you're unfamiliar with cost analysis, see [Explore and analyze costs with cost analysis](quick-acm-cost-analysis.md) quickstart.
265269
- If you're unfamiliar with budgets in Azure, see [Create and manage budgets](tutorial-acm-create-budgets.md).

0 commit comments

Comments
 (0)