[CLI] AWS Billing Account Onboarding for Target

The Target Company is required to implement the following steps within the AWS Cloud Shell. Please sign in to the AWS console using the Admin account where billing has been set up, and then initiate the Cloud Shell from the navigation bar.

To carry out below steps, Tenant ID is required. Please consult your partner company to share tenant id before moving forward.

Step-1: Configure Cost Export

Use existing report
1. Check if the cost report exists with Time granularity : Daily / Hourly and File format : text/csv
  NONE
```
aws cur --region us-east-1 describe-report-definitions --max-items 5 --query "ReportDefinitions[?TimeUnit=='DAILY'||TimeUnit=='HOURLY' && Format=='textORcsv'].{ReportName:ReportName, S3Bucket: S3Bucket, S3Prefix: S3Prefix}"
```
  - If above command returns only one cost record then capture S3Bucket, S3Prefix and Report Name
  - If above command returns more than one report then choose oldest record from UI.
    - Log into AWS Console and go to Billing service
    - On the billing page, look for Cost & Usage Reports section
    - Out of multiple available reports, choose the oldest and the one having following properties
      1. Time granularity : Daily / Hourly
      2. File format : text/csv
    - Capture the S3 bucket, Report path prefix fields from the report details section for the report you

Creating new report (This step is not required if you have a exiting report)

Create new S3 bucket by entering <S3BucketName> (Skip this step if you want to use exiting S3 bucket)
NONE
```
aws s3 mb s3://<S3BucketName>
```

Apply policy to S3 bucket by entering <S3BucketName> and AWS billing account id (To get Tenant id execute this command : aws sts get-caller-identity --query Account --output text

NONE

aws s3api put-bucket-policy --bucket <S3BucketName> --policy '{
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "billingreports.amazonaws.com"
      },
      "Action": [
        "s3:GetBucketAcl",
        "s3:GetBucketPolicy"
      ],
      "Resource": "arn:aws:s3:::<S3BucketName>",
      "Condition": {
        "StringEquals": {
          "aws:SourceArn": "arn:aws:cur:us-east-1:<AccountId>:definition/*",
          "aws:SourceAccount": "<AccountId>"
        }
      }
    },
    {
      "Sid": "Stmt1335892526596",
      "Effect": "Allow",
      "Principal": {
        "Service": "billingreports.amazonaws.com"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::<S3BucketName>/*",
      "Condition": {
        "StringEquals": {
          "aws:SourceArn": "arn:aws:cur:us-east-1:<AccountId>:definition/*",
          "aws:SourceAccount": "<AccountId>"
        }
      }
    }
  ]
}'

Create new cost and usage report by entering <ReportName> of your choice, <S3BucketName> & <S3BucketPrefix> created/caputured in above steps

NONE

aws cur put-report-definition --region us-east-1 --report-definition '{
    "ReportName": "<ReportName>",
    "TimeUnit": "DAILY",
    "Format": "textORcsv",
    "Compression": "GZIP",
    "AdditionalSchemaElements": [
      "RESOURCES"
    ],
    "S3Bucket": "<S3BucketName>",
    "S3Prefix": "<S3BucketPrefix>",
    "S3Region": "us-east-1",
    "AdditionalArtifacts": [],
    "RefreshClosedReports": true,
    "ReportVersioning": "OVERWRITE_REPORT"
  }'

AWS takes up to 24 hours to create first report to the configured bucket

Step-2: Enable Cost Allocation Tags

List cost allocation tags and capture the tags you want to use as dimensions for grouping and filtering cost data.
CODE
```
aws ce list-cost-allocation-tags
```

Active cost allocation tags which you want from above tags by entering <"TagValue">

CODE

aws ce update-cost-allocation-tags-status --cost-allocation-tags-status TagKey=<"TagValue">,Status=Active TagKey=<"TagValue">,Status=Active

Step-3: Create Role / IAM User

Role Based

Role-based access is generally considered to be more secure than user-based access, as it allows organizations to control access to resources and functions based on defined roles and responsibilities. We recommend using roles over individual users whenever possible.

Create Role by Entering RoleName of your choice and tenantid(provided by your partner) and capture role ARN from output

CODE

aws iam create-role --role-name <RoleName> --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "AWS": "arn:aws:iam::911403356698:root"
        },
        "Action": "sts:AssumeRole",
        "Condition": {
          "StringEquals": {
            "sts:ExternalId": "<tenantid>"
          }
        }
      }
    ]
  }'

Update role policy by entering <RoleName> created above, <PolicyName> of your choice. Enter <S3BucketName> captured from Step-1 while configuring Cost report

CODE

aws iam put-role-policy --role-name <RoleName> --policy-name <PolicyName>  --policy-document '{
  "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<BUCKET_NAME>",
                "arn:aws:s3:::<BUCKET_NAME>/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "organizations:ListAccounts",
                "organizations:DescribeAccount"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ce:Get*",
                "ce:Desc*",
                "ce:List*"
            ],
            "Resource": "*"
            },
            {
            "Effect": "Allow",
            "Action": [
                "iam:GenerateCredentialReport",
                "iam:GenerateServiceLastAccessedDetails",
                "iam:Get*",
                "iam:List*",
                "iam:SimulateCustomPolicy",
                "iam:SimulatePrincipalPolicy"
            ],
            "Resource": "*"
        }
        {
     "Effect": "Allow",
     "Action": [
                "cur:Get*",
                "cur:ValidateReportDestination",
                "cur:Describe*"
      ],
     "Resource": "*"
}
    ]
}'

Access/Secret Key Based (This step is not required if you have created a Role)

Create User by Entering <UserName> of your choice
CODE
```
aws iam create-user --user-name <UserName>
```

Update user policy by Entering <UserName> created above,Enter <PolicyName> of your choice. Enter <S3BucketName> captured from Step-1 while configuring Cost report

CODE

aws iam put-role-policy --role-name <RoleName> --policy-name <PolicyName>  --policy-document '{
  "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<BUCKET_NAME>",
                "arn:aws:s3:::<BUCKET_NAME>/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "organizations:ListAccounts",
                "organizations:DescribeAccount"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ce:Get*",
                "ce:Desc*",
                "ce:List*"
            ],
            "Resource": "*"
            },
            {
            "Effect": "Allow",
            "Action": [
                "iam:GenerateCredentialReport",
                "iam:GenerateServiceLastAccessedDetails",
                "iam:Get*",
                "iam:List*",
                "iam:SimulateCustomPolicy",
                "iam:SimulatePrincipalPolicy"
            ],
            "Resource": "*"
        }
        {
     "Effect": "Allow",
     "Action": [
                "cur:Get*",
                "cur:ValidateReportDestination",
                "cur:Describe*"
      ],
     "Resource": "*"
}
    ]
}'

Create AccessKey and SecretAccessKey

CODE

aws iam create-access-key --user-name ${UserName}

Step-4: Get Account ID

Get your Account ID

CODE

aws sts get-caller-identity --query Account --output text

Step-5: Capture the below details from the above steps and share with your partner.

Account ID
Role ARN or Access/Secret Key
Bucket Name
Report Path Prefix