Connecting AWS: overview
What connecting AWS involves, the read-only roles you create, who needs to be involved, and which services need something set up in AWS first.
Last updated
Connecting AWS lets Emnode read your spend, savings recommendations, Security Hub findings, idle resources, alarm coverage, backups and commitments, so it can show you where your money and risk sit. You decide which of these to connect. Each one gets its own read-only IAM role that you create in your own AWS account, and nothing else is created.
Setup runs from Settings → Data Integration → AWS Setup and takes about ten minutes, plus the time to create a cost export in AWS if you don't have one yet. This page covers what you'd be granting and what has to exist in AWS first. When you're ready, Setting up your dashboard for AWS takes you through the wizard.
Who needs to be involved
- An Emnode admin. The Data Integration section is only shown to users with the Admin role.
- Someone who can sign in to your AWS console as an admin. They create the IAM roles, usually by launching a CloudFormation stack.
- Someone with access to your billing account, if it's a different one. With AWS Organizations, cost exports often land in the management (payer) account, and part of the setup happens there.
One person can cover all three. If the AWS work sits with a colleague, start the setup yourself and use Not your side of the house? Copy instructions for your AWS admin to send them the AWS steps. The copied text leaves out your connection passphrase, which you send separately. Would you rather do it with Emnode? Choose Ask emnode to help instead after you click Start setup, and the team will be in touch.
How the connection works
Emnode reads your AWS through IAM roles that live in your account. The recommended way to create them is Quick create, which launches a CloudFormation stack called finops-dashboard-collector-role; you can also create the roles by hand. Either way, you can read every permission before you approve it.
Each role trusts only Emnode's named collectors, and only when they present your workspace's unique connection passphrase, the value AWS calls an external ID. A request without the passphrase, or with the wrong one, is refused, and the setup's own test proves it. You never give Emnode an access key or a password.
Each role can also read its own definition. Emnode uses that to confirm the role still matches what the setup generated, and flags the connection if someone has edited it.
What gets created in your account
The stack, its roles and the passphrase that guards them. Select a number to see what each part does.
Select a number above, or step through with the arrows.
1Emnode
Uses the roles to read, and only to read. It can never change or create anything in your account, and it can’t remove its own roles: only you can.
2Your passphrase
Each role trusts only Emnode’s named collectors, and only when they present your workspace’s unique external ID. Without it, or with a wrong one, the role refuses. Disconnecting rotates it.
3One stack
Quick create puts every role in one CloudFormation stack, finops-dashboard-collector-role, so deleting the stack removes them all. You can create the roles by hand instead.
4One role per service
Each service you choose gets its own role, named finops-dashboard-data-collector-…, with one inline policy, FinOpsDashboardReadOnly. Services you skip get nothing.
5Self-check
Each role can also read its own definition. Emnode uses this to confirm the role still matches what the setup generated, and flags the connection if it has been edited.
6Scoped reads
The cost roles read only the bucket and folder you name, plus one KMS key if you give one. The other roles read their own service’s settings, findings or inventory.
What each role can read
Every role is read-only and holds one inline policy, FinOpsDashboardReadOnly. Role names start finops-dashboard-data-collector and end with the suffix shown. A service you don't choose gets no role.
| Service | Role suffix | What it can read |
|---|---|---|
| Cost & billing | -focus-sync | Files in the one S3 bucket and folder your FOCUS export uses, decrypting with one named KMS key if you give one. It can also list the accounts in your AWS Organization. |
| Cost recommendations | -costopt | Files in the bucket and folder your Cost Optimization Hub export uses, plus one named KMS key if you give one. |
| Security & compliance | -compliance | Security Hub's enabled standards and findings. |
| Waste & idle resources | -wastage | EC2 instances, volumes, snapshots, images, Elastic IPs, NAT gateways and Reserved Instances; RDS, DynamoDB, ElastiCache, EFS, Lambda, SQS and load balancers; CloudWatch metrics; S3 lifecycle and versioning settings. |
| Monitoring coverage | -monitoring | CloudWatch alarms, alarm history, anomaly detectors and metrics, plus lists of EC2, RDS, Lambda and load balancers to measure coverage. |
| Backup & resilience | -continuity | AWS Backup vaults, plans, jobs and restore testing, plus EC2, RDS, DynamoDB and EFS details and S3 versioning and replication settings. |
| Commitment renewals | -commitment | Your Reserved Instance and Savings Plans inventory. |
| Free tier usage | None of its own Adds to the commitment role | Free-tier usage meters and basic details of your AWS organisation. |
None of these roles can create, change or delete anything. The exact policies are generated for your workspace and shown in full during setup.
What to set up in AWS first
Three services read data that AWS only produces once you switch it on. The other five work as soon as their role exists.
Select a number above, or step through with the arrows.
1Cost & billing needs a FOCUS export
AWS delivers a FOCUS cost export into an S3 bucket. The setup asks for its bucket, folder and region before it builds the role, because the role is scoped to them. Set up the FOCUS export.
2Cost recommendations needs Cost Optimization Hub
Turn on Cost Optimization Hub, then export its recommendations to the same account and region as your FOCUS export. It’s only offered alongside Cost & billing, and not when billing exports land in a separate account. Set up the export.
3Security & compliance needs Security Hub
Security Hub must be on in one region, and Emnode reads that region only. If it isn’t on, the connection test tells you. Set up Security Hub.
4The other five are ready
Waste & idle resources, Monitoring coverage, Backup & resilience, Commitment renewals and Free tier usage read what’s already in your account. Nothing needs switching on first.
A new setup ticks Cost & billing for you; everything else is opt-in. If you're starting with cost, create the FOCUS export before you begin. The setup asks where it lands before it builds the role, and AWS can take up to 24 hours to deliver the first files.
Accounts and limits
The connection reads the AWS account you create the roles in. If your billing exports land somewhere else, usually the management (payer) account, choose Different accounts during setup. You then launch a cost-only stack in the billing account and a second stack where the rest of your data lives, and each account is tested on its own. Cost recommendations isn't available in that arrangement.
An AWS account can be connected to only one Emnode workspace. If it's already connected to another, the connection test stops and asks you to disconnect it there first or contact support. To bring in more AWS accounts, see Adding AWS accounts.
Staying in control
Nothing you pick is final. From the Connections screen you can add services, or pause one with its Data collection switch, at any time. Changes to a live connection are staged: they only take effect once you've updated the stack in AWS and the connection test passes. Collectors run on a schedule, and the first data usually arrives within 24 hours.
Deleting the stack or the roles in AWS cuts Emnode off. Disconnect in Emnode stops collection and rotates your passphrase so the installed roles can never be used again, but it can't delete anything in your account: removing the stack is your step. Disconnecting has the full checklist.
Frequently asked questions
Do I give Emnode an access key or a password?
No. Emnode reads through roles you create in your own account, and each role accepts only Emnode's collectors presenting your workspace's passphrase. There are no keys to store or rotate.
Can Emnode change anything in my AWS account?
No. Every role is read-only, so Emnode can never change or create anything in your account. It can't remove its own roles either: deleting them is always your step.
What is the connection passphrase?
Your workspace's unique external ID. Every role's trust policy requires it, so nobody else can use the role even if they know its name. Share it separately from any setup instructions.
Which services need something set up in AWS first?
Cost & billing needs a FOCUS export, Cost recommendations needs Cost Optimization Hub and an export of its recommendations, and Security & compliance needs Security Hub on in one region. The other five need nothing beyond their role.
Do I have to connect everything at once?
No. Start with Cost & billing, which the setup ticks for you, and add the rest from the Connections screen whenever you like.
Why do the names in AWS say “finops-dashboard”?
It's the fixed prefix the setup gives its stack, roles and policy, so you can always find and remove them. Look for the finops-dashboard-collector-role stack and roles starting finops-dashboard-data-collector.
How long until I see data?
Usually within 24 hours of finishing setup. A brand-new AWS export can take up to 24 hours to deliver its first files, so allow for that too.
How do I cut off access quickly?
Use Disconnect in Emnode so collection stops, then delete the finops-dashboard-collector-role stack, or the roles, in AWS. Disconnecting covers every step.