Docs / Onboarding / AWS

Onboard Amazon Web Services

Deploy one CloudFormation template that creates the linked role aws_audit. Register only a display name and the 12-digit account ID where you install the stack. Production uses OIDC federation — no access keys.

Prerequisites

• Permission to create CloudFormation stacks (and optionally StackSets) in your organization.
• For org-wide inventory: Resource Explorer OrgView enabled in the AWS console / Quick Setup (CloudPulse does not create indexes or views).
• The 12-digit account ID where the primary stack will live (usually your audit / delegated-admin account).

Steps — single account or primary stack

1. Accounts → Add AWS. Enter a display name and the 12-digit AWS account ID. CloudPulse generates an External ID in the background (you do not paste it). Organization ID is discovered when CloudPulse first reads the estate.
2. Download the CloudFormation template (aws-audit-customer-stack.yaml from the Accounts form (requires manage-accounts capability).
3. Create the stack in that account. The template creates role aws_audit with inventory/read policies and (when configured) OIDC trust for CloudPulse’s managed identity. The IAM user for local keys is only created when the stack runs in the registered account; hosted CloudPulse does not use customer access keys.
4. Save the account in CloudPulse. No Credentials tab — federation is configured from the stack + CloudPulse federation settings.

Organization members (multi-account)

Use the same YAML as an Organizations StackSet so every member account gets aws_audit (exclude the account that already has the primary stack). Org administrators typically deploy StackSet with automatic deployment for new accounts. Without member roles, inventory enrich for member resources stays empty or soft-fails.

Billing (optional but recommended)

• Ensure the payer account has aws_audit with Cost Explorer / billing permissions (same template family as the audit stack).
• For detailed warehouse ingest: create a CUR 2.0 Data Export (CSV) in the payer console — never Legacy CUR. Then use Accounts → Billing → Discover.
• Until CUR is configured, Cost Explorer–backed views still work; some tag-level features remain limited.

You vs CloudPulse support

API

GET /v1/accounts/aws-stack-template?audit_account_id=…&external_id=…
GET /v1/accounts/{account_id}/aws-stack-template

Requires manage-accounts capability. Production rejects IAM user access-key material on create/patch.