--- title: Manually integrate your AWS account source: https://docs.newrelic.com/docs/cci/get-started/aws/manual-integrate-aws-account --- Manually integrate your AWS account with Cloud Cost Intelligence by configuring the required AWS resources and settings. This method provides complete control over each configuration step. ## Setup instructions > #### ⚠️ IMPORTANT > > For the following steps, sign in to the **AWS Management Console** and remain signed in throughout the process. ### Create S3 bucket for Cost and Usage reports [#create-s3-bucket] Create an S3 bucket to store AWS Cost and Usage Reports (CUR). We recommend using the `us-east-2` region. 1. Navigate to **S3 service** and click **Create bucket**. 2. Enter a unique bucket name (for example, `-billing`). 3. Configure bucket settings: Enable versioning Disable public access (recommended) Enable default encryption (recommended) 4. **Tags (Optional)**: Add any tags if needed for your organization's resource management and click **Create bucket**. > #### ⚠️ IMPORTANT > > Remember the bucket name for the following steps. ### Configure AWS Cost and Usage Reports [#create-cur] Create a **Cost and Usage Report** to be delivered to your S3 bucket: 1. Navigate to **Billing Dashboard** > **Cost & Usage Analysis** > **Data Exports**, then click **Create**. 2. Configure report settings: Setting Value Description Export Type Standard Data Export Detailed usage and cost information for billing and cost analysis. Export Name Name Name for the CUR report (for example, <company-name>-billing-cci). Data Table CUR 2.0 Supports the latest FOCUS format table structure. Include Resource IDs ON Enables detailed tracking of costs by individual AWS resources. Split Cost Allocation Data OFF Simplifies data structure. Leave off unless detailed cost allocation splits are required. Time granularity Hourly Required for detailed cost and usage analysis. Compression type Parquet Columnar storage format that enhances query performance and reduces storage space. File Versioning Create New Report Version Creates a new version with each update, retaining historical reports for auditing. Data Refresh Settings AUTOMATIC Keeps CUR data up-to-date automatically. Data Export Setting S3 Bucket Select the bucket you created in Create S3 bucket for Cost and Usage reports CUR files are saved in the S3 bucket. Agree to overwrite the policy. S3 path prefix cost-and-usage-reports Organizes Cost and Usage Reports within the S3 bucket. 3. Click **Next** and then **Create report**. > #### ⚠️ IMPORTANT > > Remember the export name for CCI integration. Ensure the S3 path prefix is `cost-and-usage-reports`. First report delivers within 24 hours; subsequent reports deliver periodically. Your export must also include all 114 required columns for CCI to ingest and process your billing data — see the [data dictionary](/attribute-dictionary) for the full list. ### Create IAM policy for CCI access [#create-iam-policy] Create an Identity and Access Management (IAM) policy that grants CCI permissions to access your CUR data: 1. Navigate to **IAM service** > **Policies** and click **Create policy**. 2. Switch to the **JSON editor** and paste the following policy: ```json { "Version": "2012-10-17", "Statement": [ { "Action": ["s3:Get*", "s3:List*"], "Effect": "Allow", "Resource": [ "arn:aws:s3:::/*", "arn:aws:s3:::" ], "Sid": "AccessMasterPayerBillingBucket" }, { "Effect": "Allow", "Action": [ "pricing:DescribeServices", "pricing:GetAttributeValues", "pricing:GetProducts", "pricing:GetPriceListFileUrl", "pricing:ListPriceLists" ], "Resource": ["*"] } ] } ``` > #### ⚠️ IMPORTANT > > Replace `bucket-name` with your S3 bucket name from [Create S3 bucket for Cost and Usage reports](#create-s3-bucket). 3. Click **Next**. 4. Name the policy `CCI-Access-Policy` (or your preferred name), add a description, and click **Create policy**. ### Create IAM role for CCI to assume [#create-iam-role] Create an IAM role that CCI will assume to access your CUR data: 1. Navigate to **IAM service** > **Roles** and click **Create role**. 2. Select **Custom Trust Policy** in the trusted entity type section and paste the following role definition: ````json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::207192125115:user/cci_global_user" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "" } } } ] } ``` The `externalId` is generated when you start the CCI integration. ```` 3. Click **Next**. 4. Attach the policy created in [Create IAM policy for CCI access](#create-iam-policy) and click **Next**. 5. Name the role `CCI-Access-Role` (or your preferred name), add a description (optional), and click **Create role**. 6. Note the **Role ARN (Amazon Resource Name)** from the role summary page. > #### ⚠️ IMPORTANT > > You'll need the **Role ARN** during the **CCI integration**. ### Manually integrate your AWS account [#access-integration] 1. Navigate to [**one.newrelic.com**](https://one.newrelic.com/) > **Integrations & Agents** > **Cloud Cost Intelligence - AWS**. 2. Select **Manually integrate your AWS account** and click **Continue**. ### Provide connection details [#provide-connection-details] Enter the required details: - **Connection name**: Default name provided. Edit for custom name. - **Cross-account IAM role ARN**: Enter the IAM role ARN (Amazon Resource Name) to allow Cloud Cost Intelligence to access your S3 bucket (format: `arn:aws:iam:::role/`). - **External ID**: Copy the external ID and add it to your IAM role trust policy in AWS. - **Data export name**: Enter the name of the data export file. For report `cci-ingestion-test`, the path is `cost-and-usage-reports/cci-ingestion-test/data`. - **S3 bucket name**: Enter the exact bucket name. Use `us-east-2` region for optimal performance. ### Configure trust policy [#configure-trust-policy] Add the New Relic global user (`arn:aws:iam::207192125115:user/cci_global_user`) to your IAM role trust policy: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::207192125115:user/cci_global_user" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "" } } } ] } ``` > #### ⚠️ IMPORTANT > > Set `sts:ExternalId` to the external ID from [Provide connection details](#provide-connection-details). Activate AWS Security Token Service (STS) for regions where it's not active by default (for example, `ap-east-1`, `eu-south-1`). ### Test connection [#test-connection] Click **Test connection** to verify the connection to your AWS environment. > #### ⚠️ IMPORTANT > > Initial data processing takes a few hours after setup completes. ## Optional: Enable advanced features Enable these optional features to enhance your AWS cost analysis. ### Real-time cost estimation [#real-time-cost-estimation] To enable real-time estimated cost viewing in CCI, meet the prerequisites for your instrumentation method: | **Method** | **Description** | **When to choose** | **Prerequisites** | | ------------------------------------- | ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Infrastructure agent and integrations | Uses the New Relic Infrastructure Agent for detailed monitoring. | For deep visibility/control, ideal for standalone **EC2**, **EKS/EC2**, or **ECS/EC2 setups**. | Standalone EC2: Install the New Relic infrastructure agent. EKS/EC2: Install the Kubernetes integration. ECS/EC2: Install the ECS integration. Not supported for AWS Fargate. | | Cloud integration (metrics) | Utilizes AWS CloudWatch metrics for near real-time monitoring. | When real-time data is essential for dynamic environments. | Integrate your AWS services with New Relic via [CloudWatch Metric Streams](https://docs.newrelic.com/docs/infrastructure/amazon-integrations/aws-integration-for-metrics/via-cloudformation-cwms/). | | Cloud integration (polling) - legacy | Collects data by polling AWS services at intervals. | For environments tolerating less frequent updates. | Set up [AWS polling integrations](https://docs.newrelic.com/docs/infrastructure/amazon-integrations/connect/set-up-aws-api-polling/). | ### Kubernetes cost allocation [#k8s-cost-allocation] - [Install the Kubernetes integration](https://docs.newrelic.com/install/kubernetes/). AWS Fargate integration is not supported. - Beyond standard **Kubernetes labels (`app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/component`, and `app.kubernetes.io/part-of`)**, add custom labels such as **`environment`** and **`team`**, and custom resource tags such as **`project`** and **`costCenter`** for better cost segmentation and analysis. ## Recommendations - Configure [cost allocation tags](https://docs.aws.amazon.com/tag-editor/latest/userguide/tagging.html) in your AWS account. Apply at least two custom resource tags consistently across AWS resources for effective cost filtering and grouping. - Use an S3 bucket in the `us-east-2` region for optimal performance and cost efficiency. ## Access control advisory All users with access to the designated New Relic account/organization can view your AWS cloud cost data. Select the appropriate New Relic account/organization that aligns with your internal access control policies. > #### ⚠️ IMPORTANT > > **S3 bucket access** > > New Relic only requires read access to your S3 bucket, limited to a single IAM role. Maintain this access level to protect your data. [Overview of Cloud Cost Intelligence - AWS](https://docs.newrelic.com/docs/cci/get-started/aws/aws-cci) [Automate AWS with CloudFormation](https://docs.newrelic.com/docs/cci/get-started/aws/automated-setup-cloudformation) [Manually integrate your AWS account](https://docs.newrelic.com/docs/cci/get-started/aws/manual-integrate-aws-account)