Step 1
Skip to Step 5 if you came to this guide from the Cross-account role connection page.
Navigate to the ‘Account Manager’ tab.
If you don't have any accounts, your Account Manager menu will appear as shown below. Click the ‘Add environment’ button.
Your Account Manager menu will display as shown below if you have existing accounts. Click the ‘Add environment’ button.
Step 2
Click on the AWS (Amazon Web Services) button.
Step 3
Click on the ‘Cross Account Role’ (which allows access through IAM roles) button.
Step 4
You will be directed to the ‘Cross-account role connection’ page.
Step 5
In the first field, enter the Account name. You can use a specific name or it will be named by default as ‘AWS,’ with the specific name not exceeding 32 characters.
Step 6
Next, select the Access type:
Read/write: Allows you to use all functions such as converting to spot, scheduling resources, removing unused resources, and right-sizing your resources.
Read-only: Allows you to only view your resources and possible actions but does not provide access to the main functionality.
In this case, we select the Read/Write access type : User can Review Policy for following connection mode :
Read-write policy
Read-write policy
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"pricing:*",
"ce:DescribeCostCategoryDefinition",
"ce:GetRightsizingRecommendation",
"ce:GetCostAndUsage",
"ce:GetSavingsPlansUtilization",
"ce:GetReservationPurchaseRecommendation",
"ce:ListCostCategoryDefinitions",
"ce:GetCostForecast",
"ce:GetReservationUtilization",
"ce:GetSavingsPlansPurchaseRecommendation",
"ce:GetDimensionValues",
"ce:GetSavingsPlansUtilizationDetails",
"ce:GetCostAndUsageWithResources",
"ce:GetReservationCoverage",
"ce:GetSavingsPlansCoverage",
"ce:GetTags",
"ce:GetUsageForecast",
"cur:DescribeReportDefinitions",
"compute-optimizer:GetEBSVolumeRecommendations",
"compute-optimizer:GetLambdaFunctionRecommendations",
"ebs:ListSnapshotBlocks",
"ebs:ListChangedBlocks",
"bedrock:GetModelInvocationLoggingConfiguration",
"bedrock:ListProvisionedModelThroughputs",
"bedrock:GetProvisionedModelThroughput",
"bedrock:ListModelCustomizationJobs",
"bedrock:GetModelCustomizationJob",
"bedrock:ListCustomModels",
"bedrock:GetCustomModel",
"bedrock:ListKnowledgeBases",
"bedrock:GetKnowledgeBase",
"bedrock:ListAgents",
"bedrock:GetAgent",
"bedrock:ListDataSources",
"bedrock:GetDataSource",
"bedrock:ListAgentAliases",
"bedrock:GetAgentAlias",
"bedrock:ListAgentVersions",
"bedrock:GetAgentVersion",
"bedrock:ListAgentActionGroups",
"bedrock:GetAgentActionGroup",
"bedrock:ListAgentKnowledgeBases",
"bedrock:ListTagsForResource",
"memorydb:DescribeSnapshots",
"memorydb:DescribeSubnetGroups",
"memorydb:DescribeReservedNodes",
"ec2:DescribeRouteTables",
"ec2:DescribeSpotPriceHistory",
"cloudformation:UpdateStack",
"elasticloadbalancing:ModifyTargetGroup",
"iam:CreateServiceLinkedRole",
"iam:PutRolePolicy"
],
"Resource": "*"
},
{
"Sid": "LambdaStackCleanup",
"Effect": "Allow",
"Action": [
"cloudformation:DeleteStack",
"cloudformation:DescribeStacks",
"lambda:DeleteFunction",
"lambda:InvokeFunction",
"iam:DeleteRole",
"iam:DeletePolicy",
"iam:DetachRolePolicy",
"iam:DeleteRolePolicy",
"logs:DeleteLogGroup"
],
"Resource": [
"arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/Uniskai-connection-lambda-*",
"arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:Uniskai-connection-lambda-*",
"arn:aws:iam::${AWS::AccountId}:role/UniskaiLambdaRole-*",
"arn:aws:iam::${AWS::AccountId}:policy/UniskaiLambdaPolicy-*",
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:Uniskai-connection-lambda-*"
]
}
]
}
Tagging policy
Tagging policy
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"apigateway:DELETE",
"apigateway:POST",
"cassandra:Alter",
"cassandra:AlterMultiRegionResource",
"cassandra:TagMultiRegionResource",
"cassandra:UnTagMultiRegionResource",
"elasticbeanstalk:AddTags",
"elasticbeanstalk:RemoveTags",
"elasticfilesystem:TagResource",
"elasticfilesystem:UntagResource",
"emr-serverless:TagResource",
"emr-serverless:UntagResource",
"memorydb:TagResource",
"memorydb:UntagResource",
"s3:ReplicateTags",
"timestream:TagResource",
"timestream:UntagResource",
"bedrock:TagResource",
"bedrock:UntagResource"
],
"Resource": "*"
}
]
}
Step 7
Then, select the Connection method (the selected option is marked with a white dot on a blue background):
Auto (default): Uniskai creates the connection role for you through an AWS CloudFormation stack. You only need to select a region, launch the stack in the AWS Console, and click Connect once the stack is created.
Manual: You create the Cost and Usage Report, IAM policy and IAM role in the AWS Console yourself, using the Account ID and External ID shown on the page. This gives you full control over the setup.
Each option shows a Short guide with step-by-step instructions on the page.
Step 8
At the moment, we choose the Auto. Otherwise, go to another manual
Step 9
After selecting Auto, go to the Connection Setup section and select the region where you want to place the S3 bucket with CUR. Then click Connect to launch the CloudFormation stack in the AWS Console. If you already have an S3 bucket with CUR in one of your regions, we will not create a new one and will use your existing S3 bucket instead.
Step 10
Sign in to the AWS Console.
Step 11
You will see the Quick Create stack page.
Step 12
Scroll down to the bottom of the page and select the checkboxes
Step 13
Navigate to the next page:
Step 14
Wait until the stack's status becomes "CREATE_COMPLETE" and return to Uniskai, the account will be added automatically. You can view the connected account on the Account Manager page.
The CloudFormation stack includes a Lambda function used only during the initial setup. It is deleted automatically after the first data refresh — no manual cleanup is required.