AWS Console

Set up the Infracost AWS integration by clicking through the AWS Console — for teams that don't want to run Terraform or deploy a CloudFormation stack. Prefer infrastructure as code? See the Terraform guide or CloudFormation guide instead — both are easier to keep up to date and to roll out across many accounts. Prefer scripting it with the CLI instead of clicking through the console? See the AWS CLI guide.

note

This integration requires access to your AWS organization's management account. Reach out to support@infracost.io before getting started if you have questions.

This guide covers the required cross-account role setup. Two further capabilities are documented on their own pages, since each involves several AWS services:

• Cost and usage data exports — required, for FOCUS billing data, Cost Optimization Hub recommendations, and S3 Storage Lens metrics. You can either follow that guide to create the exports, or bring your own existing exports instead.
• Cost Anomaly Detection — optional, surfaces AWS-detected cost anomalies alongside your cost data.

Prerequisites

• Access to the AWS Console on your AWS organization's management account, and on every member account you want Infracost to see
• Permission to create IAM roles and policies in those accounts
• Your Infracost External ID — in Infracost Cloud, go to Org Settings > General and copy the External ID. It is also shown on the AWS integration page. Used as the external ID for the cross-account role.
• Infracost's AWS account ID: 237144093413 (do not change this unless instructed by Infracost)

Step 1: Create the cross-account role

Repeat this step identically in your management account first, then in each member account you want Infracost to see. Every substep is the same for both account types except substep 4, where you paste a different policy depending on which type of account you're in.

note

Not sure which account is your management account? It's the AWS Organizations root/payer account — check AWS Organizations > AWS accounts from any account, or IAM Identity Center > Settings if you use SSO.

1. Create the role

1. Sign in to the AWS Console and open the IAM service.
2. In the left navigation, click Roles, then Create role.
3. Under Trusted entity type, select Custom trust policy.
4. Replace the default JSON with the following, substituting your Infracost External ID:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::237144093413:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "YOUR_EXTERNAL_ID"
        }
      }
    }
  ]
}

5. Click Next.

tip

Prefer clicking through fields instead of pasting JSON? Select AWS account as the trusted entity type instead, enter 237144093413 as the account ID, check Require external ID, and enter your Infracost External ID directly — this produces an equivalent trust policy without needing the JSON above.

2. Attach the AWS-managed view-only policy

1. On the Add permissions page, search for and check ViewOnlyAccess (the AWS-managed policy at job-function/ViewOnlyAccess).
2. Click Next.

3. Name and create the role

1. Role name: infracost-readonly
2. Click Create role.

4. Add the Infracost read-only policy

This is the one substep that differs by account type — management accounts get more permissions (billing, cost, and organization data that only the management account can see), while member accounts get a smaller set.

1. Open the role you just created (IAM > Roles > infracost-readonly).
2. On the Permissions tab, click Add permissions > Create inline policy.
3. Switch to the JSON editor and paste one of the two policies below:
   • On the management account: use the management account policy.
   • On every other account: use the member account policy.

Management account policy (management account only)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InfracostManagementAccountReadOnly",
      "Effect": "Allow",
      "Resource": "*",
      "Action": [
        "acm:ListTagsForCertificate",
        "amplify:ListApps",
        "amplify:ListTagsForResource",
        "apigateway:GET",
        "apprunner:ListServices",
        "apprunner:ListTagsForResource",
        "bcm-data-exports:Get*",
        "bcm-data-exports:List*",
        "ce:Describe*",
        "ce:Get*",
        "ce:List*",
        "compute-optimizer:Get*",
        "cost-optimization-hub:Get*",
        "cost-optimization-hub:List*",
        "ec2:DescribeClientVpnEndpoints",
        "ec2:DescribeLaunchTemplates",
        "ec2:DescribeTransitGatewayAttachments",
        "ecr:ListTagsForResource",
        "globalaccelerator:ListTagsForResource",
        "macie2:ListTagsForResource",
        "organizations:DescribeOrganization",
        "pricing:Describe*",
        "pricing:Get*",
        "pricing:List*",
        "rds:ListTagsForResource",
        "s3:GetBucketLocation",
        "s3:GetBucketTagging",
        "s3:GetStorageLensConfiguration",
        "s3:GetStorageLensConfigurationTagging",
        "s3:GetStorageLensDashboard",
        "s3:ListStorageLensConfigurations",
        "savingsplans:ListTagsForResource",
        "scheduler:ListTagsForResource",
        "tag:GetResources",
        "trustedadvisor:Get*",
        "trustedadvisor:List*"
      ]
    }
  ]
}

Member account policy (every other account)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InfracostMemberAccountReadOnly",
      "Effect": "Allow",
      "Resource": "*",
      "Action": [
        "acm:ListTagsForCertificate",
        "amplify:ListApps",
        "amplify:ListTagsForResource",
        "apigateway:GET",
        "apprunner:ListServices",
        "apprunner:ListTagsForResource",
        "ec2:DescribeClientVpnEndpoints",
        "ec2:DescribeLaunchTemplates",
        "ec2:DescribeTransitGatewayAttachments",
        "ecr:ListTagsForResource",
        "globalaccelerator:ListTagsForResource",
        "macie2:ListTagsForResource",
        "rds:ListTagsForResource",
        "s3:GetBucketLocation",
        "s3:GetBucketTagging",
        "savingsplans:ListTagsForResource",
        "scheduler:ListTagsForResource",
        "tag:GetResources"
      ]
    }
  ]
}

4. Click Next.
5. Policy name: infracost-readonly (or anything memorable). Click Create policy.

5. Add the role introspection policy

Infracost uses this second inline policy to check its own permissions, so it can tell you which features are available given the access you've granted, without failing at feature-detection time.

1. Still on the infracost-readonly role, click Add permissions > Create inline policy again.
2. Paste the following into the JSON editor, replacing 111111111111 with this account's ID:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InspectRole",
      "Effect": "Allow",
      "Action": [
        "iam:GetRole",
        "iam:ListRolePolicies",
        "iam:GetRolePolicy",
        "iam:ListAttachedRolePolicies",
        "iam:SimulatePrincipalPolicy"
      ],
      "Resource": "arn:aws:iam::111111111111:role/infracost-readonly"
    },
    {
      "Sid": "InspectAttachedPolicies",
      "Effect": "Allow",
      "Action": [
        "iam:GetPolicy",
        "iam:GetPolicyVersion"
      ],
      "Resource": "*"
    }
  ]
}

3. Click Next.
4. Policy name: infracost-role-introspection. Click Create policy.

6. Note the role ARN

On the role's summary page, copy the ARN, for example arn:aws:iam::111111111111:role/infracost-readonly. You'll need this from the management account in Step 2 below.

note

When new features are added, this role's policies may need to be updated to include new permissions. Infracost will notify you when an update is required — see Upgrading below.

Step 2: Add the integration in Infracost Cloud

After creating the role in your management account (and any member accounts), add the integration to Infracost from the dashboard:

1. Go to Org Settings > Integrations > Add integrations, then click Add integration for Amazon Web Services.
2. Enter an Alias to identify the integration, and the Role ARN of the management account's infracost-readonly role (for example, arn:aws:iam::111111111111:role/infracost-readonly).
3. Click Test connection to verify Infracost can assume the role.
4. Once the test passes, save the integration.

(Optional) Improve console links for SSO users

If your team signs in through IAM Identity Center (AWS SSO), set your access portal URL so console links to resources on findings route through the portal and open in the correct account — without it, the links can fail for federated users who aren't already signed in.

In the dashboard, go to Org Settings > Agent settings and set AWS access portal to your portal URL, for example https://your-subdomain.awsapps.com/start. You can find this in the AWS console under IAM Identity Center > Settings > AWS access portal URL. Leave it blank to keep using direct console links.

Next steps

Your cross-account role is set up, but Infracost still needs cost and usage data exports to show FOCUS billing data, Cost Optimization Hub recommendations, and S3 Storage Lens metrics — this is a required step. If you don't already have these exports, follow the Cost and usage data exports guide next.

Optionally, also set up Cost Anomaly Detection so Infracost can surface AWS-detected cost anomalies.

Upgrading

As Infracost adds support for additional capabilities there may be a need to update the role's permissions.

tip

Don't forget to review the terraform-aws-integration release notes — the Terraform module and CloudFormation template are the source of truth for what permissions this role needs, even if you manage the role by hand.

When Infracost notifies you of a required update, edit the relevant inline policy on the infracost-readonly role (IAM > Roles > infracost-readonly > Permissions) and add the new actions AWS specifies.

Removing

1. Open IAM > Roles > infracost-readonly.
2. Delete the role's inline policies (infracost-readonly, infracost-role-introspection, and any others you added, such as infracost-kms-decrypt or infracost-s3-access).
3. Delete the role itself.
4. Repeat on each account where you created the role.

Any resources you created for data exports or anomaly detection are not removed automatically — see those pages' own removal notes.

Troubleshooting

Test connection fails with "Access Denied" or "AssumeRole" errors

• Double-check the Infracost External ID in the role's trust policy exactly matches the value shown in Org Settings > General.
• Confirm the trust policy's principal is arn:aws:iam::237144093413:root — a typo here is the most common cause.
• Confirm you're providing the role ARN from the management account, not a member account.

Infracost reports missing permissions for a feature you expect to have

Re-check that you attached the correct read-only policy for the account type — the management account policy includes several actions (bcm-data-exports:*, ce:*, compute-optimizer:*, cost-optimization-hub:*, organizations:DescribeOrganization) that the member account policy intentionally omits.