Connector docs — AWS

Exactly what CostMon asks for to read AWS

CostMon calls AWS Cost Explorer's GetCostAndUsage once per sync, daily granularity, grouped by linked account and service. Nothing else in your AWS account is touched.

See the security model →See the solution page →

What CostMon calls

The literal API surface, nothing more

Cost Explorer — GetCostAndUsage: Daily granularity, metrics UnblendedCost and NetAmortizedCost, grouped by LINKED_ACCOUNT and SERVICE. Called from us-east-1, which is where Cost Explorer's API lives regardless of your resources' region.

What you supply

Credential and config fields

access_key_idAccess key IDrequired

secret_access_keySecret access keysecretrequired

session_tokenSession tokensecretoptional

Accepted by the fetcher, not yet in the setup form

assume_role_arn: The fetcher supports assuming a cross-account role (see the trust policy below) and reads the ARN from the connector's stored config, but this field isn't in the setup form yet. Set it through the API directly. Amazon Bedrock's connector exposes the same capability as a real form field today.
region: Accepted for parity with other connectors. Cost Explorer is a global API served from us-east-1, so this doesn't change which region's spend you see.

Minimum permission

Copy this, not a broader role

Minimum IAM policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CostMonReadOnly",
      "Effect": "Allow",
      "Action": "ce:GetCostAndUsage",
      "Resource": "*"
    }
  ]
}

Cross-account trust policy (if you assume a role instead of using a key pair)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "<CostMon's AWS account ID>" },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": { "sts:ExternalId": "costmon-<your-connector-id>" }
      }
    }
  ]
}

Scope of access

What AWS access can't reach

Your EC2 instances, S3 buckets, or anything running inside them
IAM users, roles, or policies other than the one you granted CostMon
Any AWS API outside Cost Explorer's GetCostAndUsage

Worth knowing

The external ID is derived from your connector's ID (costmon-<connector-id>), not stored separately, so a config update can never overwrite it and accidentally weaken the trust condition.

FAQ

Common questions about the AWS connector

Can CostMon see which EC2 instances or S3 buckets I'm running?

No. Cost Explorer's GetCostAndUsage returns totals grouped by account and service, not a list of your resources. CostMon never calls an API that would return that.

Do I have to use a static access key, or can I use role assumption?

Either works in the fetcher. A static key pair is what the setup form asks for today; cross-account role assumption with the external ID above is supported by the connector but has to be set through the API until the form catches up.

Why does the policy say Resource: *?

GetCostAndUsage is an account-level, not resource-level, API call. AWS doesn't support scoping it to a specific resource ARN, so the action itself (ce:GetCostAndUsage) is the whole scope.

A rate you looked up will change again.

Provider pricing pages change without notice. CostMon tracks the bill that pays for it.

Start free See recent price changes