CoreFinOps Docs
On this page

Connect an AWS Account

Establish read-only cross-account AWS access with an ExternalId.

CoreFinOps accesses customer AWS accounts through STS AssumeRole. The customer deploys a read-only IAM role using a CloudFormation template and retains control over that trust relationship. CoreFinOps does not require long-lived customer IAM access keys.

Security

The customer IAM role is read-only. CoreFinOps never writes to, modifies or deletes AWS resources through this connection. The trust relationship is fully controlled from your AWS account and can be revoked at any time.

Connection flow

  1. 1

    Open Settings → AWS Connections

    Start a new connection from the CoreFinOps workspace settings.

  2. 2

    Review the generated setup intent

    Note the trusted principal and ExternalId. Keep the ExternalId private — it belongs to this trust configuration.

  3. 3

    Deploy the CloudFormation template

    Open the offered template in the customer AWS account, inspect the IAM permissions and deploy it using the account owner's AWS identity.

  4. 4

    Copy the resulting role ARN

    Enter the role ARN into the setup form. Verify the account and any account-scope/region settings shown by the wizard.

  5. 5

    Validate the role

    CoreFinOps requests a short-lived session and confirms the identity through STS.

  6. 6

    Run inventory discovery

    Configure a cost export if you want billing facts — inventory and billing are separate data sources.

What access is used for

Supported collection includes resource inventory, CUR/Data Export metadata and S3 objects, and approved AWS-native optimization recommendation APIs. Available coverage depends on the deployed policy, AWS services, account enrollment and region.

Important distinctions

Connection validation does not equal successful cost ingestion. A role can pass STS and still lack permissions to read the export bucket or call a particular recommendation API. Disconnecting CoreFinOps does not delete the IAM role in your AWS account; the AWS administrator must review and remove that role separately to revoke remaining trust.

Troubleshooting

A 400 registration response is an API validation failure; inspect the response body and registration payload rather than assuming it is CORS. AccessDenied typically warrants checking role trust, ExternalId, AWS permissions and the actual account. A succeeded inventory job with absent spend usually points to missing CUR/Data Export configuration or an incomplete ingestion run.