Connect your AWS account

CloudQuell reads your billing data through a read-only IAM role and your AWS Cost and Usage Report (CUR). Nothing is written back to your account, and no agent runs inside it — CloudQuell assumes a role you control and reads the CUR files delivered to an S3 bucket you own.

Does connecting cost anything?

AWS generally doesn’t charge to generate the Cost and Usage Report; the main cost is standard S3 storage for the delivered Parquet files, which is usually small (the export overwrites, so files don’t accumulate over time). CloudQuell doesn’t charge you to connect, and it only reads your data — nothing is written back to your account. Any provider-side charges that apply are set by AWS, can change, and are yours; treat this as general guidance, not a guarantee, and check AWS’s current pricing.

There are two ways to set this up:

• Quick create (recommended) — launch a pre-filled CloudFormation stack that provisions everything in one shot. About 5 minutes.
• Manual setup — create the IAM role and CUR export yourself, pasting the policy JSONs CloudQuell provides. About 15 minutes. Use this if your organization restricts third-party CloudFormation stacks.

Both paths produce exactly the same access: the same read-only role policies and the same daily CUR 2.0 export. The stack template is generated from the same policy definitions the manual flow shows you — published at www.cloudquell.com/security.

Prerequisites

• An AWS account (a management/payer account if you want to cover linked accounts).
• Permission to create IAM roles, S3 buckets, and Data Exports in that account (quick create needs permission to run CloudFormation too).
• A CloudQuell account — sign up and verify your email first. Free starts under $10K/month cloud spend.

Quick create (recommended)

1. Start the integration and choose Quick create

In CloudQuell, add an AWS integration and pick Quick create (CloudFormation). The wizard shows a Launch stack in AWS Console button — it opens the CloudFormation quick-create page in a new tab with everything pre-filled, including your organization’s unique ExternalId (see why that matters below).

2. Create the stack

On the AWS quick-create page:

1. Make sure you’re signed in to the account you want to connect — your management (payer) account covers all linked accounts under it.
2. Keep the region on us-east-1 (N. Virginia). The link pins it, and the stack refuses to launch anywhere else (AWS Data Exports lives there).
3. Leave the pre-filled parameters unchanged, tick the IAM acknowledgement (“AWS CloudFormation might create IAM resources with custom names”), and click Create stack.
4. Wait about 2 minutes for CREATE_COMPLETE.

The stack creates three things:

Resource	What it’s for
IAM role (<stack-name>-role)	The read-only role CloudQuell assumes. Trust is locked to your ExternalId.
S3 bucket	Where AWS delivers your CUR files. Retained even if you later delete the stack — your billing history is never destroyed.
CUR 2.0 Data Export	A daily, resource-level, Parquet export delivered to that bucket.

3. Paste back the stack outputs

Open the stack’s Outputs tab and paste RoleArn and BucketName into the CloudQuell wizard, then click Verify & Connect. CloudQuell assumes the role with your ExternalId, verifies access, and pre-fills the CUR report path for you — the remaining steps (default cost settings, CUR check) take under a minute.

Note

Reconnecting an account you connected before? The stack (and its bucket) may still exist from last time — skip the launch and paste the existing stack’s Outputs instead of creating a new one.

That’s it — skip ahead to First-ingest timeline.

Manual setup

Prefer to create everything yourself, or your org forbids third-party stacks? Choose Manual setup in the wizard. The flow is unchanged from what it’s always been:

1. Check or create your CUR 2.0 export

CloudQuell reads daily Parquet CUR 2.0 files from S3. If you already have a daily CUR 2.0 export, just point CloudQuell at its S3 bucket. If not, the wizard walks you through creating one in the AWS Billing console (Data Exports → Standard data export, CUR 2.0, daily granularity, resource IDs included, Parquet + overwrite).

2. Create the read-only IAM role

In your AWS IAM console, create a role that CloudQuell can assume. The wizard shows you the exact trust policy and inline read-only policy to paste — both are also published at www.cloudquell.com/security.

Tip

Keep the role read-only. CloudQuell never needs write access to your AWS account, and the published policy grants only the read and billing permissions required.

3. Paste the role ARN back into CloudQuell

Copy the ARN of the role you created and paste it back into the wizard. CloudQuell assumes the role using your ExternalId and begins ingesting.

The ExternalId

Whichever path you choose, the role’s trust policy is scoped with a unique ExternalId that CloudQuell generates for your organization. This is a security best practice: CloudQuell can only assume the role when it presents the matching ExternalId, and because the value is unique to your organization, no other tenant can have CloudQuell assume your role — this prevents the “confused deputy” problem. In quick create it’s baked into the stack parameters; in manual setup it’s embedded in the trust policy JSON you paste.

First-ingest timeline

Your first analytics appear the same day you connect. CloudQuell backfills up to 12 months of historical cost data from Cost Explorer so you have trend context from the start, while the CUR provides detailed line items going forward (plus whatever history already exists in your S3 bucket — a brand-new export starts delivering within about a day). After that, ingestion keeps pace with the daily CUR deliveries. The CUR is the authoritative record of your bill — its completeness directly affects your Attribution Coverage.

Note

The Free plan lets you query the most recent 6 months of that history; paid plans extend the window. See retention limits.

Multiple accounts

Connect from your management (payer) account and the linked accounts under it are covered by the same integration — you can then filter and allocate spend per linked account across CloudQuell. Free covers up to 3 connected integrations across all providers; paid tiers are unlimited (see Plans & billing).

Next steps

• Tour the dashboard to read your first spend data.
• Understand Attribution Coverage.
• Connect an AI agent to query costs in plain language.