AWS
Connect your AWS account to track costs across all services via the Cost Explorer API, with support for multi-account Organizations.
What StackSpend tracks
Once connected, StackSpend imports cost data from AWS Cost Explorer across:
- All AWS services (EC2, S3, RDS, Lambda, and more)
- Service-level cost breakdown
- Account-level breakdown for multi-account setups via AWS Organizations
- Regional cost breakdown
The first sync fetches up to 90 days of historical cost data.
Prerequisites
- An active AWS account
- IAM access to create users and attach policies
Setup
Create an IAM User
In the AWS Console, go to IAM → Users → Create user. Set the username to stackspend-readonly. Click Next.
Attach permissions
Choose Attach policies directly and attach the following policy:
AWSBillingReadOnlyAccess
If you are using AWS Organizations for multi-account cost tracking, also attach:
AWSOrganizationsReadOnlyAccess
Click Next, then Create user.
Create access keys
Click the newly created user, then go to the Security credentials tab. Under Access keys, click Create access key. Select Third-party service as the use case.
Copy the Access Key ID and Secret Access Key. The secret key is only shown once — store it securely before closing the dialog.
Add to StackSpend
Go to Providers → Add provider → AWS:
Add AWS provider
Verify
The initial sync starts automatically after saving and fetches up to 90 days of cost history. Data appears in StackSpend within a few minutes of the sync completing. Keep in mind that the underlying AWS cost data carries a 24–48 hour delay from the provider.
AWSBillingReadOnlyAccess policy on the management account grants access to all member account costs automatically.Data availability
| Property | Value |
|---|---|
| Latency | 24–48 hours (AWS) |
| Historical data | 90 days |
| Setup time | ~5 minutes |
Frequently asked questions
What AWS credentials does StackSpend need?
StackSpend needs a read-only IAM user with the AWSBillingReadOnlyAccess policy, which grants access to the Cost Explorer API. For multi-account setups via AWS Organizations, also attach AWSOrganizationsReadOnlyAccess so member-account costs are included.
Is the AWS connection read-only and safe?
Yes, the connection is strictly read-only. StackSpend uses billing read-only policies to fetch cost data and never modifies your resources — always use a dedicated IAM user rather than root account credentials.
How long does AWS setup take?
Setup takes about 5 minutes: create the IAM user, attach the billing policy, create access keys, and add them to StackSpend. The first sync then fetches up to 90 days of cost history.
Why don't I see cost data yet?
AWS Cost Explorer data is delayed by 24–48 hours at the provider level, so the most recent days take time to appear. This is an AWS limitation that applies regardless of how frequently StackSpend syncs.