Adding an AWS ViewOnlyAccess Account with a Manual Connection

Overview

This guide explains how to connect an AWS account to Uniskai manually with ViewOnlyAccess access. Instead of using the CloudFormation stack, you set up a Cost and Usage Report (CUR) and create the IAM policy and role yourself, then grant Uniskai a cross-account role to assume. With ViewOnlyAccess, Uniskai can view your resources and possible actions, but cannot use the main optimization functionality.

If you came to this guide from the Cross-account role connection page, skip to Step 4 — Create the Cost and Usage Report.

How it works

Uniskai connects to your account as a cross-account IAM role that it assumes. You create a role in your AWS account that trusts Uniskai's Account ID and requires the External ID shown in Uniskai, so only your Uniskai connection can assume it. The role carries a custom ViewOnlyAccess policy plus the AWS managed ReadOnlyAccess policy, and Uniskai reads your billing data from the Cost and Usage Report (CUR) stored in an S3 bucket you create.

The objects you create:

Resource	Name / Type	Purpose
Cost and Usage Report	`psl-cur-{name}` + S3 bucket `psl-cur-<account-id>`	Provides detailed billing data for Uniskai to read.
IAM policy	Custom ViewOnlyAccess policy + AWS managed ReadOnlyAccess	Grant read access to cost, pricing, recommendations, and the CUR S3 bucket.
IAM role	Cross-account role trusting Uniskai + External ID	The role Uniskai assumes to read your data.

The custom ViewOnlyAccess policy is in aws-viewonlyaccess-manual-policy.txt. It includes an s3:GetObject statement for read access to the CUR bucket — replace %bucket_name% with your CUR S3 bucket name (psl-cur-<account-id>) before saving.

Prerequisites

Before you start:

You can sign in to AWS with permission to create Cost and Usage Reports, S3 buckets, IAM policies, and IAM roles.
You have the Account ID and External ID shown on the Uniskai Manual connection screen.

Setup steps

Step 1 — Open the Account Manager and add an AWS environment

Navigate to the Account Manager tab.
Click Add environment (the menu looks different depending on whether you already have accounts, but the button is the same).
Choose the AWS cloud service.

Step 2 — Select Cross Account Role

Select Cross Account Role.

Step 3 — Configure the connection

You are directed to the Cross-account role connection page.

In the first field, enter an Account name (up to 32 characters, or leave the default AWS).
Choose the Access type: Read-only — this only lets you view your resources and possible actions, without the main functionality. (The selected type is marked with a white dot on a blue background.)
Choose the Connection type: Manual — you will manually create a role using the External ID and Account ID.

In the Uniskai interface the access option is labeled Read-only. On the AWS side this corresponds to the ViewOnlyAccess policy you create in the steps below.

Do not refresh this page during account connection — it will change the External ID.

Step 4 — Create the Cost and Usage Report

Sign in to the AWS Console.
In the search field, type Cost and Usage Reports and open it.
Click Create report.
Name the report using the psl-cur- prefix (for example, psl-cur-{new-report}), and check Include resource IDs and Refresh automatically.
Scroll down and click Next

Step 5 — Configure the S3 bucket

Name the S3 bucket psl-cur-<AWS-account-id> (replace <AWS-account-id> with your account ID) and select the region where you want to store it.
Confirm that the policy will be applied to the S3 bucket, then click Create bucket.

Step 6 — Finish the report

Set the S3 path prefix to psl-cur-AWS-<account-id> (for example, psl-cur-AWS-12345678910).
Under Report data time granularity, select Hourly.
Under Report data integration, select Amazon Athena.
Report versioning is set to Overwrite existing report automatically once Amazon Athena is enabled (the options are disabled).
Compression type is set to Parquet automatically (the field is disabled).
Scroll to the bottom and click Create Report.

Step 7 — Create the IAM policy

At the AWS console enter the IAM
Navigate to Policies in the sidebar and click Create policy.

Select the JSON tab and paste the custom ViewOnlyAccess policy (below).

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ce:Get*",
                "ce:List*",
                "ce:Describe*",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:GetRolePolicy",
                "pricing:*",
                "savingsplans:DescribeSavingsPlans",
                "sts:GetCallerIdentity",
                "cur:DescribeReportDefinitions",
                "organizations:Describe*",
                "organizations:List*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::%bucket_name%/*"
        }
    ]
}

Replace %bucket_name% in the policy with your real CUR S3 bucket name (psl-cur-<account-id>, created in Step 5). The connection will not work if this is left as %bucket_name%.
Click Next, name the policy, and click Create policy

Step 8 — Create the IAM role

Navigate to Roles in the sidebar and click Create role.
Under Trusted entity type, choose AWS account.
In the An AWS account block, select Another AWS account, then paste the
Account ID from Uniskai.
Under Options:
Check Require external ID (Best practice when a third party will assume this role) and paste the External ID from Uniskai.
Leave Require MFA unchecked.
Click Next.

Do not enable Require MFA — Uniskai assumes the role programmatically, so MFA would block the connection.

Step 9 — Attach the policies

Search for the custom ViewOnlyAccess policy you created in Step 7 and select it.
Search for the AWS managed ReadOnlyAccess policy and select it as well. Click Next.

Step 10 — Name and create the role

Enter any Role name and scroll down.
Click Create role.
Click View role, then copy the Role ARN.

Step 11 — Finish the connection in Uniskai

Paste the Role ARN into the Role ARN field in Uniskai.
Click Connect Account.

Results

After completing the steps:

A Cost and Usage Report and a ViewOnlyAccess cross-account role exist in your AWS account.
Uniskai can view your resources and recommendations; it cannot perform optimization actions.
The account is connected and appears in Account Manager.

Key notes / limitations

ViewOnlyAccess has no optimization actions. It only lets you view resources and possible actions; converting to spot, scheduling, removing unused resources, and right-sizing require read/write.
Do not refresh the connection page. Refreshing during setup changes the External ID.
The role needs both policies. Attach the custom ViewOnlyAccess policy (cost + CUR bucket read) and the AWS managed ReadOnlyAccess policy (resource inventory).
The ViewOnlyAccess policy must include the CUR bucket permission. It contains an s3:GetObject statement on arn:aws:s3:::<cur-bucket>/* so Uniskai can read the Cost and Usage Report.
Use the psl-cur naming. Report psl-cur-{name}, bucket psl-cur-<account-id>, path prefix psl-cur-AWS-<account-id>.
You maintain the policy. With a manual connection, if a Uniskai feature later requires additional permissions, you must update the policy yourself.

Verifying it worked

The connection is confirmed after you click Connect Account and Uniskai's credentials check passes; the account then appears as connected in Account Manager. If it reports a problem, re-confirm that the role's trust settings use the correct Account ID and External ID from Uniskai, and that both the ViewOnlyAccess policy and the AWS managed ReadOnlyAccess policy are attached.

Adding an AWS ViewOnlyAccess Account with a Manual Connection

Overview

How it works

Prerequisites