Manual Setup (CUR 2.0)

Connect your AWS billing data to CloudZero using Cost and Usage Report 2.0 (CUR 2.0), AWS's newer billing data format delivered through Data Exports. CUR 2.0 also carries the AWS IAM identity that made each call (called caller identity data), so spend on services like Amazon Bedrock breaks down by who generated it instead of arriving as one total.

You can connect CUR 2.0 on its own, without an existing AWS connection, or add it to an AWS account you have already connected to CloudZero through CUR 1.0. Either way, your CUR 1.0 connection and its historical data stay in place, and CUR 2.0 starts billing data from the current billing month.

Migrate from a CUR 1.0 connection

If you already have a CUR 1.0 Billing (Payer) connection for this AWS account, you do not need to complete the steps below manually. Confirm first that the connection's IAM role trusts both CloudZero accounts (see Step 2) and that your CUR 2.0 Data Export already exists (see Prerequisites); the button reuses the existing role and does not create either for you.

To migrate: Go to Settings > Cloud Connections, open the CUR 1.0 connection's details, and select Migrate to CUR 2.0. CloudZero opens this setup form with the AWS Account ID, S3 Bucket Name, S3 Path Prefix, and Cross-Account IAM Role ARN already filled in from your existing connection. If your CUR 2.0 Data Export lives in a different bucket or path than your CUR 1.0 report, update the S3 Bucket Name and S3 Path Prefix to match, and confirm the reused role's permissions cover that location. Enter your CUR 2.0 Data Export Name and continue from Step 3.

Which account type do you need?

CloudZero uses two types of AWS connections:

Prerequisites

• For Billing connections: a CUR 2.0 Data Export in your AWS Payer account. If you do not have one, see Creating a standard data export in the AWS documentation.
• AWS Organizations with consolidated billing enabled
• CloudZero user with data configuration permissions
• If you have resources in AWS regions where STS is not active by default (for example, ap-east-1 or eu-south-1), activate STS for those regions

Step 1: Start the connection in CloudZero

1. In CloudZero, go to Settings > Cloud Connections.
2. Select Create Connection +.
3. Select the AWS tile, then choose Manual Setup under the account type you are connecting.
4. For Billing (Payer) connections, select Cost and Usage Report 2.0.

Keep this screen open. You need the External ID and generated policy in Step 2. Billing connections also use the IAM Policy Generator on this screen.

Step 2: Set up AWS permissions

Create an IAM role in AWS that grants CloudZero read-only access to your data, and attach the policy that CloudZero generates for you. Follow the section that matches the account type you selected in Step 1.

For a Billing (Payer) Account

1. In the AWS IAM Console, select Create role.
2. For Trusted entity type, select Another AWS account (this lets CloudZero access your data across accounts).
3. Enter the CloudZero account ID: 559846027439.
4. Check Require external ID.
5. Enter the External ID from the CloudZero connection screen.
6. Attach the following AWS managed policies: ComputeOptimizerReadOnlyAccess, ViewOnlyAccess, and AWSBillingReadOnlyAccess.
7. Complete the role creation wizard.
8. On the Trust relationships tab of the role you just created, select Edit trust policy.
9. In the Principal section, add the CloudZero account ID 061190967865 alongside the account ID you already added. Keep your existing sts:ExternalId condition unchanged:

"Principal": {
  "AWS": [
    "arn:aws:iam::559846027439:root",
    "arn:aws:iam::061190967865:root"
  ]
}

10. Select Update policy.
11. In the CloudZero connection screen, enter your S3 Bucket Name in the IAM Policy Generator and select Generate IAM Policy.
12. Open the role you just created in the AWS IAM Console.
13. Add the generated policy to the role by pasting the JSON.

For a Resources (Member) Account

1. In the AWS IAM Console, select Create role.
2. For Trusted entity type, select Another AWS account (this lets CloudZero access your data across accounts).
3. Enter the CloudZero account ID: 061190967865.
4. Check Require external ID.
5. Enter the External ID from the CloudZero connection screen.
6. Attach the following AWS managed policies: ComputeOptimizerReadOnlyAccess, ViewOnlyAccess, and AWSBillingReadOnlyAccess.
7. Complete the role creation wizard.
8. On the Trust relationships tab of the role you just created, select Edit trust policy.
9. In the Principal section, add the CloudZero account ID 559846027439 alongside the account ID you already added. Keep your existing sts:ExternalId condition unchanged:

"Principal": {
  "AWS": [
    "arn:aws:iam::061190967865:root",
    "arn:aws:iam::559846027439:root"
  ]
}

10. Select Update policy.
11. Open the role you just created in the AWS IAM Console.
12. Add the generated policy from the CloudZero connection screen to the role by pasting the JSON.

Step 3: Enter connection details in CloudZero

Complete the section that matches your account type.

For a Billing (Payer) Account

1. Enter a Connection Name (for example, my-aws-billing-cur2). No spaces, periods, or special characters (max 50 characters).
2. Enter the AWS Account ID, the 12-digit account ID that owns the Data Export.
3. Enter the S3 Bucket Name where Data Exports writes your CUR 2.0 Parquet files.
4. Enter the S3 Path Prefix you set in the Data Export; this prefix is prepended to your Data Export Name. A valid prefix must not include a trailing / or ..
5. Enter the Data Export Name, the name of the export you created in AWS (not the bucket name).
6. Enter the Cross-Account IAM Role ARN of the role you created. You can find this on the role's summary page in the AWS IAM Console.
7. Select Create.

The S3 Path Prefix and Data Export Name are separate values. In S3, AWS nests the export beneath the prefix as its own folder, so the prefix should not repeat the export name.

For a Resources (Member) Account

1. Enter a Connection Name (for example, my-aws-resources). No spaces, periods, or special characters (max 50 characters).
2. Enter the Cross-Account IAM Role ARN of the role you created. You can find this on the role's summary page in the AWS IAM Console.
3. Select Save & Continue.

Step 4: Verify the connection

Check the connection status on the Cloud Connections page. Billing connections appear in the Billing Connections table and resource connections appear in the AWS Resources tab. The Status column shows a green healthy indicator when the connection is active.

What to expect

Your cost data appears across the platform within 24 hours.

If you migrated from a CUR 1.0 connection, each connection's details panel links to the other. The CUR 1.0 connection shows Migrated to, and the CUR 2.0 connection shows Migrated from; select either to jump to the linked connection.

You can connect additional AWS accounts at any time by repeating this process. To connect many resource accounts at once, see Connect Resource Accounts at Scale. CloudZero supports organizations with multiple Management Accounts.

If your organization uses AWS resource tags, you can bring them into CloudZero for additional filtering and grouping options. See Use AWS Tags in CloudZero.