Setting up your dashboard for AWS
Connect your AWS account to Emnode step by step: choose your services, create the read-only roles in AWS, check the connection and switch everything on.
Last updated
This guide follows the AWS setup in Emnode from start to finish: you pick your services, create read-only roles in your AWS account, check they work, then switch everything on.
Allow about ten minutes. You can stop and come back at any point. Still deciding what to grant? Read Connecting AWS: overview first.
Before you start
Everyone needs the top three. The rest depends on the services you pick, and only three of them need anything set up in AWS first. Select a number to see what to have ready.
Select a number above, or step through with the arrows.
1An Emnode admin
Only users with the Admin role see AWS Setup under Settings → Data Integration.
2Someone with AWS console access
They need permission to create IAM roles and CloudFormation stacks in the account you’re connecting. If that isn’t you, you can hand the AWS part to them.
3The AWS account ID
The 12-digit ID of the account you’re connecting, such as 123456789012. You enter it when you check the connection.
4Cost & billing
Needs a FOCUS export. Have ready its s3:// link, its bucket’s region (such as eu-west-2) and, if the bucket uses your own KMS key, the key’s full ARN. The first files can take up to 24 hours, but you can finish setup before then. Create a FOCUS export
5Cost recommendations
Needs a Cost Optimization Hub export in the same account and region as your FOCUS export, so it only comes with Cost & billing. Have ready its s3:// link. Set up the recommendations export
6Security & compliance
Needs Security Hub turned on in at least one region. Have ready that region; if Security Hub isn’t on there, the connection test tells you. Turn on Security Hub
7Five more services
Waste & idle resources, Monitoring coverage, Backup & resilience, Commitment renewals and Free tier usage need nothing set up in AWS first. Tick them in the setup and their roles are created with the rest.
8A separate billing account
Common with AWS Organizations, where exports land in the management (payer) account. You’ll also need access to that account and its ID, and Cost recommendations isn’t available. Set the guide to that path
Step by step
Choose your setup, and the steps show only what applies to you. They use the product's own step names, so you can match each one to the screen.
Your setup
Where do your cost exports land?
The account you're connecting owns the export's S3 bucket.
Usually your AWS Organizations management (payer) account.
How will you create the roles?
One stack creates every role in about two minutes.
You create each role in IAM and paste in its two policies.
About 10 minutes, with one trip to the AWS console to create one stack.
Two stacks with the same passphrase: one in your billing account, one in the account you're connecting.
One role per service, created by hand in IAM in the account you're connecting.
One role per service by hand in the account you're connecting, plus the cost role again in your billing account.
-
Step 1: Choose services
In EmnodeOpen the setup and tick what you want Emnode to show.
- Go to Settings → Data Integration → AWS Setup and click Start setup.
- Choose I've got console access — let's go.
- Tick the services you want. Cost & billing is ticked for you.
- Want savings recommendations? Tick Cost recommendations: it unlocks once Cost & billing is ticked.
- Leave Cost recommendations unticked: it isn't available when your exports land in a separate account.
- Click Continue.
The setup moves on to Data location, or to Connect account if that step doesn't apply.
Nobody can sign in to your AWS console? Choose Ask emnode to help instead, and the Emnode team will set it up with you.
-
Step 2: Data location
In EmnodeThis step only appears if you picked Cost & billing with another service (Cost recommendations doesn't count).
- On Where does your data live?, choose Same account.
- On Where does your data live?, choose Different accounts.
- Click Continue.
The setup moves on to Connect account.
-
Step 3: Connect account
Emnode and AWSTell Emnode where your cost data lands, create the read-only roles in AWS, then come back.
In Emnode Where your cost data lands
- Paste your FOCUS export's
s3://link into Source Bucket. Emnode fills in Source Prefix for you. - Enter the bucket's region in Source region, such as
eu-west-2. - Enter the Billing account ID: the account that owns the export's bucket.
- Picked Cost recommendations? Paste its export's link into the second Source Bucket.
- Click Save and set up the role.
In the AWS console Create the stack
- In Emnode, choose Quick create and click Copy passphrase.
- Click Launch in AWS console. CloudFormation opens in a new tab with the template loaded.
- Check you're signed in to the account you're connecting, and paste the passphrase into ExternalId.
- Tick the IAM acknowledgement and click Create stack.
- Wait for
CREATE_COMPLETE, about two minutes.
In the AWS console Stack 1: your billing account
- In Emnode, choose Quick create and click Copy passphrase.
- Sign in to your billing account in the AWS console.
- In Emnode, under Cost & billing account, click Launch in billing account.
- In CloudFormation, paste the passphrase into ExternalId, tick the IAM acknowledgement and click Create stack.
- When it reaches
CREATE_COMPLETE, click Test cost access in Emnode.
In the AWS console Stack 2: the account you're connecting
- Sign in to the account that holds your other data.
- In Emnode's second section, enter its AWS account ID and click Launch in AWS console.
- Create the stack the same way, with the same passphrase.
- When it reaches
CREATE_COMPLETE, click Test account access in Emnode.
In the AWS console Create the roles by hand
- In Emnode, choose Set up manually and click Show external ID, so each trust policy includes your passphrase.
- In IAM, create a role with a Custom trust policy, and paste the first card's 1 · Trust policy.
- Name the role exactly as the card shows under Create the role with exactly this name.
- Add the card's 2 · Permissions policy as an inline policy named
FinOpsDashboardReadOnly, and attach nothing else. - Repeat for every card.
- Create the cost role again in your billing account, with the same name and policies.
- Back in Emnode, enter Your 12-digit AWS account ID and click Test trust policy, then Test permissions.
In Emnode Back in Emnode
- Click I've created the role — check it.
The setup moves on to Verify.
Someone else runs your AWS? Click Not your side of the house? Copy instructions for your AWS admin and send them the steps. Send the passphrase separately.
- Paste your FOCUS export's
-
Step 4: Verify
In EmnodeA read-only test proves each role works. Nothing in your account changes.
- Enter The AWS account you created the role in, and a name such as
Productionif you like. - Enter the account you're connecting in The AWS account you created the role in. The test checks your billing account too.
- Click Run connection test. Each row ticks as it passes.
- Click Continue.
Connection verified. The checkpoint is saved, so you can leave and come back.
A row failed? Its reason shows underneath. Fix it and click Run again, or carry on and add that service later.
- Enter The AWS account you created the role in, and a name such as
-
Step 5: Configure
In EmnodeEach service has a panel with sensible defaults, and most people change nothing.
- In Security & compliance, check Security Hub Region is where Security Hub runs.
- Click Finish setup.
You're plumbed in. The first data usually lands within 24 hours.
Cost export not delivered yet? Choose Enable anyway (audited), and collection starts when the first files arrive.
If something goes wrong
| What you see | What to do |
|---|---|
| We couldn't use one or more of the roles. | Check each role exists in the account you entered, named exactly as Emnode shows, and that its trust policy includes your passphrase. With Quick create, check the stack reached CREATE_COMPLETE in that account. |
| Installed role deviates from the generated template | Someone has changed a role, or your organisation adds policies or a permissions boundary to every new role. Recreate the role from a fresh launch link, or from its card, with nothing else attached. If your organisation requires a boundary, contact support. |
| No non-empty export objects found under your bucket | AWS can take up to 24 hours to deliver a new export. Click Run again later, or carry on and choose Enable anyway (audited) when you finish. |
| No export partitions directly under your bucket | Source Prefix must be the full path to the data: your S3 path prefix, the export name, then /data/. The message suggests the right value. Correct it on the Cost & billing panel in Configure; if Emnode shows the change as staged, apply it as in Changing your AWS setup. |
| The bucket is in one region but the configured source region is another | Set Source region to the region the message names, on the Cost & billing panel in Configure. If Emnode shows the change as staged, apply it as in Changing your AWS setup. |
| Security & compliance fails, and your Security Hub isn't in EU (London) | The first test always looks in eu-west-2, and the region is only saved when you finish. In Configure, set Security Hub Region, turn Data collection off for Security & compliance and click Finish setup. Then, on Connections, click Set up · ~3 min on Security & compliance, click Test on its panel and finish again. |
| A selected service hasn't passed verification | Go Back to Verify and click Run again. To finish without that service, turn its Data collection off and add it later from Connections. |
| CloudFormation says the stack already exists | You've run the setup before. In Connect account, choose Update existing stack and follow its steps; Changing your AWS setup walks through them. |
| No tab opens after Launch in AWS console | Your browser blocked it. Use open the console here under the button. The link works for about an hour. |
| This AWS account is already connected to a different customer workspace. | An AWS account can belong to only one Emnode workspace. Disconnect it there first, or contact support. |
| Cost recommendations disappeared from your services | It isn't available when your cost exports land in a separate account, so the setup drops it after you choose Different accounts. |
Coming back later
To add or remove services, change where your cost data lands, pause a service or re-check the connection, see Changing your AWS setup. To stop everything, see Disconnecting AWS.
Frequently asked questions
How long does it take?
About ten minutes with AWS console access, of which Quick create takes about two. The first data usually arrives within 24 hours of finishing.
Can I stop part-way through?
Yes. Nothing has to be finished in one sitting, and a passing connection check is saved as a checkpoint. Come back to Connections to carry on.
How many roles does the setup create?
One read-only role per service you pick; Free tier usage shares the Commitment renewals role. With Quick create they sit in one CloudFormation stack, finops-dashboard-collector-role, or one stack in each account if your cost exports land in a separate billing account. Nothing else is created.
Which AWS region should the stack be in?
IAM roles are global, so the region the console opens in doesn't matter. Note it, though: that's where you'll find the stack when you update it later.
Is it safe to email the passphrase?
Send it on its own, never in the same message as the setup instructions. The copied admin instructions leave it out for exactly that reason.
Why are there AccessDenied events in CloudTrail?
The connection check tries each role without your passphrase and with a wrong one, to prove both are refused. A couple of denials from the check are expected.