Connect AWS

CloudOptify connects to AWS with read-only access and can discover the accounts in your AWS Organization. AWS is available on every plan — the number of connections and analyzed accounts follows your plan’s limits (visible under Subscription). Two authentication methods are supported.

Method 1 — IAM Role (recommended)

With role-based auth, CloudOptify never stores a long-lived secret. You create a role in your AWS account that CloudOptify is allowed to assume; access happens through short-lived temporary credentials, and you can revoke it instantly at any time by deleting the role.

1. In the portal, go to Cloud Connections → Add AWS connection and choose IAM Role.
2. CloudOptify shows you a unique External ID, its principal ARN, and two ready-made policies to copy:
   • a trust policy — allows CloudOptify’s principal to assume the role, only when it presents your External ID (protection against the confused-deputy problem);
   • a permissions policy — the read-only minimum CloudOptify needs (cost data, organization account listing, resource and metric reads).
3. In the AWS console, create a role (IAM → Roles → Create role → Custom trust policy), paste the trust policy, attach the permissions policy, and create it.
4. Paste the Role ARN back into CloudOptify and save. The connection is verified by actually assuming the role before anything is persisted — a misconfigured trust policy or External ID fails immediately with a clear message.

Why this is more secure

There is no credential to leak: nothing long-lived is stored on either side, temporary credentials expire on their own, and deleting the role (or its trust statement) cuts access instantly — no key rotation required.

Method 2 — Access keys

If you prefer, connect with a read-only IAM user’s access keys:

1. Create an IAM user with the read-only policy and generate an access key.
2. Choose Access keys in the connection dialog and enter the Access Key ID and Secret Access Key.
3. CloudOptify verifies the keys before saving. The secret is stored AES-256 encrypted and never shown again.

Select accounts

Once the connection is verified:

1. Open the connection’s Accounts view. If the connection can read your AWS Organization, member accounts are listed automatically.
2. Tick the accounts you want CloudOptify to analyze and save.

Selected accounts are scanned and appear everywhere alongside your Azure subscriptions — same dashboard, same filter, same reports.

Deselecting an account

If an account is used by a Cloud Group, scheduled report, or budget alert, deselecting it shows a warning listing the impact before anything is removed. See Connection lifecycle.

Want exact, per-resource AWS cost?

Connecting an AWS Cost & Usage Report gives you billing-accurate numbers, deeper history, and unlocks tag-based allocation, Cost by Region, and Top Resources. See AWS per-resource cost (CUR) — it’s optional and takes a few minutes.

Next step

Run your first scan to pull cost data from both clouds.