Docs · Connect an AWS account

Connect an AWS account

CloudPruneAI connects to your AWS account through a read-only IAM role. Two setup paths are available in the dashboard.

Before you start

  • You need permission to create IAM resources in the target AWS account.
  • Have your workspace open in the CloudPruneAI dashboard — the External ID is displayed there and is required for setup.

Quick Setup (recommended)

Uses a CloudFormation template hosted by CloudPruneAI. The External ID from your workspace is pre-filled into the launch URL.

  1. In the dashboard, open Accounts → Connect a cloud account → AWS.
  2. Click Launch CloudFormation Stack. A new AWS Console tab opens.
  3. In the CloudFormation form, check “I acknowledge that AWS CloudFormation might create IAM resources”, then click Create stack.
  4. Wait for status CREATE_COMPLETE (typically 1–2 minutes).
  5. On the stack's Outputs tab, copy the value of RoleArn.
  6. Back in the CloudPruneAI dashboard, paste the ARN and click Verify Connection.

Manual Setup

For teams that require manual IAM role creation. The dashboard shows the exact trust policy and permissions required. Use this mode if internal policy forbids launching third-party CloudFormation templates.

What the role can and cannot do

  • Can: read infrastructure metadata for cost analysis, read Cost Explorer aggregates, read CloudWatch metrics.
  • Cannot: modify, create, or delete any resource. Cannot read S3 object contents, database records, secret values, or log contents.
  • Revocable at any time by deleting the CloudFormation stack (Quick Setup) or removing the IAM role (Manual Setup).

External ID

Each workspace has a unique External ID that must be present in the role's trust policy. This prevents the “confused deputy” attack — even if two customers use the same role name, only requests carrying the correct External ID succeed. The External ID is pre-filled in Quick Setup and shown in the dashboard for Manual Setup.

Troubleshooting

  • Verification fails after paste: confirm the External ID in the trust policy matches the one shown in the dashboard for your workspace.
  • Missing permissions during scan: the Quick Setup template attaches AWS ReadOnlyAccess plus Cost Explorer and CloudWatch reads. Manual setups that stripped those permissions may see reduced coverage. Re-verify from the dashboard after adjusting.
  • Support: if a scan fails or accounts don't verify, email support@cloudpruneai.com with the workspace ID and the account you're trying to connect.