Manual Setup (CUR 2.0)

Connect your AWS billing data to CloudZero using Cost and Usage Report 2.0 (CUR 2.0), AWS's newer billing data format delivered through Data Exports. If you already have a legacy CUR connection, you can add CUR 2.0 alongside it; CloudZero retains your existing historical data and uses CUR 2.0 for billing data starting from the current billing month.

Which account type do you need?

CloudZero uses two types of AWS connections:

Prerequisites

• For Billing connections: a CUR 2.0 Data Export in the required format in your AWS Payer account. If you do not have one, see Creating a standard data export in the AWS documentation.
• AWS Organizations with consolidated billing enabled
• CloudZero user with data configuration permissions
• If you have resources in AWS regions where STS is not active by default (for example, ap-east-1 or eu-south-1), activate STS for those regions

Step 1: Start the connection in CloudZero

1. In CloudZero, go to Settings > Cloud Connections.
2. Select Create Connection +.
3. Select the AWS tile, then choose Manual Setup under the account type you are connecting.
4. For Billing (Payer) connections, select Cost and Usage Report 2.0.

Keep this screen open. You need the External ID and generated policy in Step 2. Billing connections also use the IAM Policy Generator on this screen.

Step 2: Set up AWS permissions

Create an IAM role in AWS that grants CloudZero read-only access to your data, and attach the policy that CloudZero generates for you. Follow the section that matches the account type you selected in Step 1.

For a Billing (Payer) Account

1. In the AWS IAM Console, select Create role.
2. For Trusted entity type, select Another AWS account (this lets CloudZero access your data across accounts).
3. Enter the CloudZero account ID: 061190967865.
4. Check Require external ID.
5. Enter the External ID from the CloudZero connection screen.
6. Attach the following AWS managed policies: ComputeOptimizerReadOnlyAccess, ViewOnlyAccess, and AWSBillingReadOnlyAccess.
7. Complete the role creation wizard.
8. In the CloudZero connection screen, enter your S3 Bucket Name in the IAM Policy Generator and select Generate IAM Policy.
9. Open the role you just created in the AWS IAM Console.
10. Add the generated policy to the role by pasting the JSON.

For a Resources (Member) Account

1. In the AWS IAM Console, select Create role.
2. For Trusted entity type, select Another AWS account (this lets CloudZero access your data across accounts).
3. Enter the CloudZero account ID: 061190967865.
4. Check Require external ID.
5. Enter the External ID from the CloudZero connection screen.
6. Attach the following AWS managed policies: ComputeOptimizerReadOnlyAccess, ViewOnlyAccess, and AWSBillingReadOnlyAccess.
7. Complete the role creation wizard.
8. Open the role you just created in the AWS IAM Console.
9. Add the generated policy from the CloudZero connection screen to the role by pasting the JSON.

Step 3: Enter connection details in CloudZero

Complete the section that matches your account type.

For a Billing (Payer) Account

1. Enter a Connection Name (for example, my-aws-billing-cur2). No spaces, periods, or special characters (max 50 characters).
2. Enter the AWS Account ID, the 12-digit account ID that owns the Data Export.
3. Enter the S3 Bucket Name where Data Exports writes your CUR 2.0 Parquet files.
4. Enter the S3 Path Prefix you set in the Data Export.
5. Enter the Data Export Name, the name of the export you created in AWS (not the bucket name).
6. Select Save & Continue.

For a Resources (Member) Account

1. Enter a Connection Name (for example, my-aws-resources). No spaces, periods, or special characters (max 50 characters).
2. Enter the Cross-Account IAM Role ARN of the role you created. You can find this on the role's summary page in the AWS IAM Console.
3. Select Save & Continue.

Step 4: Verify the connection

Check the connection status on the Cloud Connections page. Billing connections appear in the Billing Connections table and resource connections appear in the AWS Resources tab. The Status column shows a green healthy indicator when the connection is active.

What to expect

Your cost data appears across the platform within 24 hours.

You can connect additional AWS accounts at any time by repeating this process. To connect many resource accounts at once, see Connect Resource Accounts at Scale. CloudZero supports organizations with multiple Management Accounts.

If your organization uses AWS resource tags, you can bring them into CloudZero for additional filtering and grouping options. See Use AWS Tags in CloudZero.