Connect CostGuard for AWS

Finout's CostGuard module provides actionable cost optimization insights. CostGuard scans surface idle resources, rightsizing opportunities, and offers commitment purchase recommendations. In order to do this, CostGuard needs read only permissions to certain metrics. The role created during the standard AWS cost data integration has the necessary permissions to perform CostGuard scans and discover linked accounts within the master payer account. However, to run CostGuard scans for resources within linked accounts, you need to create a CloudFormation StackSet that applies the necessary configurations across all linked accounts.

Important: This onboarding procedure assumes that the AWS account has already been onboarded. If it has not, please follow the procedure outlined in Connect to AWS, as per the instructions.

Setting up CostGuard for AWS involves two steps:

• Step 1 – Connect Finout to CloudWatch: Grant Finout read-only permissions to your AWS accounts to allow Finout to ingest the relevant CloudWatch metrics needed to calculate CostGuard scans.

  • There are two options to connect CostGuard for AWS:

    • Create a New CloudFormation StackSet

    • Add Permissions Manually

• Step 2 (optional) – Enable additional metrics: EC2-GPU optimization scans require metrics that CloudWatch does not collect by default. This step walks you through the configuration needed to ingest them.

Step 1 – Connect Finout to CloudWatch

Create a New CloudFormation StackSet

This procedure applies to AWS Multi-Accounts.

1. Open the AWS CloudFormation console.

   

1. Choose StackSet from the navigation on the left-hand side of the screen. The Specify StackSet details step appears.

1. Click Create StackSet. The Choose a template step appears.

   
2. Choose a template - Fill in the following information:

   1. Permissions: Since we are using the self-managed permissions, AWS manages the roles and you can skip this section.

      
   2. Prepare template - Choose Template is ready.

      
   3. Specify template - Under the template source, choose Amazon S3 URL, and specify the following URL: https://finout-public-assets.s3.amazonaws.com/FinoutMetricsReadOnlyRole.json

      
   4. Click Next. You are brought to the Specify stack set details step.

      
3. Specify stack set details - Fill in the following information:

   1. Stack set name - Specify a name for the CloudFormation stack (e.g. finout-readonly-role).

      
   2. Parameters - Add the External ID from the Finout-provided section.

      
   3. Click Next. You are brought to the Configure stack set options step.

4. Configure stack set options:

   1. Execution configuration: Set Manage execution to Active.

      
   2. Capabilities - Mark I acknowledge the IAM notice.

      
   3. Click Next. You are brought to the Set deployment options step.

      
5. Set deployment options:

   1. Add stacks to stack set - Mark Deploy new stacks.

      
   2. Accounts - You have two options:

      

      • Mark Deploy new stacks in accounts for specifying which accounts to deploy the stack set.

      • Mark Deploy stacks in organizational units to deploy all accounts.

   3. Specify Regions - Choose us-east-1

      
   4. (Optional) Deployment options - Configure the concurrency.

   5. Click Next.

6. Review all the information, then click Next to launch the new stack set.

7. Once the StackSets is complete, share your organization ID with Finout Support.

Add Permissions Manually

Use the following JSON file to add permissions manually to your accounts:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudwatch:ListMetrics",
        "cloudwatch:GetMetricData",
        "cloudwatch:GetMetricStatistics"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeVolumes"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "organizations:ListAccounts",
      "Resource": "*"
    }
  ]
}
}

The latest IAM policy with details about each statement can be found below.

Note: Finout applies a validation process on IAM policies applied per account, so please make sure to contact us before modifying the policy on your own.

Finout IAM Policy Details

Cloudwatch Metrics

{
  "Effect": "Allow",
  "Action": [
    "cloudwatch:ListMetrics",
    "cloudwatch:GetMetricData",
    "cloudwatch:GetMetricStatistics",
    "cloudwatch:Describe*"
  ],
  "Resource": "*"
},

This policy allows Finout read-only permission to Cloudwatch metrics - these are crucial for all recommendations provided by CostGuard (Idle and Rightsizing recommendations).

EBS Volumes

{
  "Effect": "Allow",
  "Action": [
    "ec2:DescribeVolumes"
  ],
  "Resource": "*"
},

This section of the policy allows CostGuard to provide recommendations for unattached EBS volumes.

Organization Discovery

{
  "Effect": "Allow",
  "Action": "organizations:ListAccounts",
  "Resource": "*"
} 

This section allows CostGuard to provide recommendations on all your accounts in the organization.

Step 2 (optional) – Enable additional metrics

This step is optional. If you are not interested in GPU scans, skip it.

EC2-GPU Scans Setup (Beta)

To enable EC2-GPU cost optimization scans, additional setup is required. Follow these guidelines to get started.

Enabling GPU metric collection via CloudWatch Agent will incur standard CloudWatch custom metric charges on your AWS account. See AWS CloudWatch pricing for details.