Source boundary
AWS
Confirm source eligibility in your workspace before creating access.
- Financial source
- Cost and Usage Report 2.0 manifests and report objects
- Reviewed
- 2026-09-17
- Cost bases
- net, billed, amortized, list, contracted, credits, tax
- Useful dimensions
- payer account, linked account, service, operation, region, resource, cost-allocation tags, Bedrock publisher, model, inference type and reported usage
Known limits
- Resource visibility depends on CUR 2.0 configuration.
- Recent report partitions can change after first delivery.
- The provider-specific Bedrock section and optional monitoring remain flag-disabled pending external validation.
Prepare the connection
Eligibility
An AWS management or payer account, a CUR 2.0 Data Export delivered to S3, and an eligible PruneFox workspace are required.
Connect a read-only CUR role using the generated external ID. Access keys are available only for compatibility and are stored encrypted.
Authentication choices
- IAM role delegation — recommendedPruneFox stores only safe federation configuration references; provider tokens are not persisted.
- Access keyPruneFox stores the credential encrypted in the isolated credential broker and never returns it to the browser.
Connection details
| Field | Why it is needed | Example format |
|---|---|---|
| Read-only IAM role ARN | Role that PruneFox may assume to read the bounded CUR source. | arn:aws:iam::123456789012:role/PruneFoxReadOnly |
| External ID | Must match the value in the role trust policy. | Write-only value |
| CUR 2.0 S3 bucket | Bucket receiving the AWS Data Export. | northstar-cost-reports |
| Bucket region | AWS region where the report bucket is stored. | us-east-1 |
| Export path prefix | Prefix configured on the AWS Data Export, without the bucket name. | billing/cur2 |
| Data Export name | CUR 2.0 export name used below the prefix. | organization-cost-detail |
Permission boundary
| Resource | Read or bounded staging permissions | Purpose |
|---|---|---|
| Exact CUR bucket and prefix | s3:GetBucketLocation, s3:ListBucket, s3:GetObject | Locate manifests and read only objects named by an approved CUR 2.0 manifest. |
Connection sequence
- Create a CUR 2.0 Data Export with CSV/GZIP and resource IDs when needed.
- Deliver it to one dedicated S3 bucket and prefix.
- Create a read-only IAM role whose trust policy requires the PruneFox principal and matching external ID.
- Enter the role and exact report location, then validate the payer identity and latest complete manifest.
Validation and first sync
Validation checks the assumed identity, payer/report identity, bucket region, exact prefix, export name, manifest completeness, and object access.
Only manifest-listed objects are streamed and reconciled. Corrected partitions replace affected provider identities without duplicating totals.
Freshness: Recent CUR partitions can change after first delivery; the last published complete-through date remains visible during later failures.
Remove access
Revoke the PruneFox connection, remove the role trust, and then delete the dedicated role when no sync is active.
Troubleshooting
Check CUR 2.0 format, bucket region, prefix, export name, manifest delivery, trust principal, external ID, and object permissions.
Verify the first completed period
Compare one bounded completed period with the provider billing source. Match currency and cost basis, inspect credits and adjustments, and confirm that missing dimensions remain unavailable rather than zero.
Troubleshoot safely
Use the visible connection state, provider name, affected date range, and expected outcome. Never send credentials, raw billing exports, payment data, or customer records through support.