Connect an AWS account
One read-only role through CloudFormation. The first read starts as soon as the role is verified.
-
Your external ID
…Generated in your browser for this account and already filled into the template. Keep it with your records.
-
Open CloudFormation
Open CloudFormation quick create
Opens the AWS console in a new tab. Sign in to the management (payer) account first.
What you will see
- Stack name cloudblame-readonly, parameters already filled in.
- Tick “I acknowledge that AWS CloudFormation might create IAM resources with custom names”.
- Create stack. About a minute. Then open the Outputs tab and copy RoleArn.
CloudFormation stops with “CloudCostControlReadOnly already exists”? The account was connected before: re-connect it from Accounts, or delete the old cloudblame-readonly stack and open quick create again.
Open the stack in CloudFormation
- Select cloudblame-readonly and choose Update.
- Replace the current template with the template URL below.
- Keep every parameter as it is: the external ID stays the same.
- Tick the IAM acknowledgement and submit. About a minute.
Template URL
https://cloudblame-public-619141388163.s3.eu-central-1.amazonaws.com/readonly-role.yamlThe stack is gone? Create it again with the same external ID: Open CloudFormation quick create
-
In the stack’s Outputs tab, copy RoleArn.
Shown next to the account ID, for example the team or the environment.
-
Verify and connect
Cloudblame assumes the role once to check it, saves the account and starts the first read. The read takes a few minutes; you can leave this page.