Connect Amazon Web Services

Connecting AWS brings your Cost and Usage Report, Cost Explorer data, Savings Plans and reservation coverage into Helias, so you can see spend down to the resource and get rightsizing backed by real utilisation.

Helias reads it through a read-only IAM role that a CloudFormation stack creates in your account. You never share an access key.

Using the console quick-create link this takes about five minutes.

Before you begin

• Signed in to the AWS Console, or the AWS CLI v2 (or AWS CloudShell) authenticated in us-east-1 as the account you are connecting.
• Permission to deploy CloudFormation stacks in us-east-1, and to create IAM roles.
• For an organization: permission to deploy StackSets, and AWS Organizations trusted access for CloudFormation StackSets activated.

You also need a Helias account, which is granted by request and approved by a person. Start at Get access if you do not have one yet.

How the connection works

The stack creates a role named helias-readonly by default, which you can change to match your naming convention, and you can attach an IAM permissions boundary if your organization requires one. When the stack finishes it notifies Helias, which validates the access before storing anything.

The trust policy names one principal and one condition:

Your environment is a separate AWS account used by no other customer, and the External ID is unique to you, so a role connected for another customer cannot be assumed against yours.

What it creates in your account

Unless you are reusing a report you already have, the stack creates three things: the read-only role, an S3 bucket, and a Cost and Usage Report that delivers into it. The report is hourly, in Parquet, includes resource IDs, and carries the Athena integration.

Member accounts in an organization create neither a bucket nor a report, because they are already covered by the management account's report. They get the role and nothing else.

What it costs you

The role is free, and so is the Cost and Usage Report. You pay for S3: storage for the report objects, and the requests Helias makes reading them. That scales with how many resources you run rather than how much you spend, and for most accounts it is a few dollars a month.

The bucket is encrypted with AES256, blocks all public access, and keeps 200 days of reports. It is retained if you delete the stack, so removing the integration never destroys your billing history.

Scope and permissions

Every permission below is read-only. The role can read cost and usage data and describe resources, and it can create nothing, modify nothing and start nothing. The Permissions reference carries the same grants for every provider in one place.

If you connect a single account, connect the management account where you can. It gives cost visibility across the whole organization straight away, and you can roll out to member accounts later. A member account on its own reports only its own costs.

The AWS managed policy

The role carries AWS's own ViewOnlyAccess job-function policy, which is what lets Helias describe the resources behind your spend. It is maintained by AWS, not by us.

The inline policies

These are written by our template, and rendered here from that template rather than transcribed.

Member accounts receive the same role without the actions below, because they own no report and no bucket:

• bcm-data-exports:GetExport
• bcm-data-exports:GetTable
• bcm-data-exports:ListExports
• bcm-data-exports:ListTables
• s3:ListBucket

Connect a single account

1. 1

   Choose the account

   Connect the management account if you have one. Helias generates the stack name, the role name and the report name for you, and pre-fills the External ID and the target role.

2. 2

   Deploy the stack

   Use the quick-create link in the app, which opens the CloudFormation console in us-east-1 with every parameter filled in. Review them, acknowledge the IAM capability, and create the stack.

   If you prefer the CLI, the app gives you the equivalent command. CAPABILITY_NAMED_IAM is required because the template creates a role with a name you can choose.

   aws cloudformation create-stack \
     --region us-east-1 \
     --stack-name <STACK_NAME> \
     --template-url <TEMPLATE_URL> \
     --capabilities CAPABILITY_NAMED_IAM \
     --parameters \
       ParameterKey=HeliasExternalId,ParameterValue=<EXTERNAL_ID> \
       ParameterKey=HeliasRoleArn,ParameterValue=<HELIAS_ROLE_ARN> \
       ParameterKey=HeliasRoleName,ParameterValue=<ROLE_NAME> \
       ParameterKey=HeliasCurBucketName,ParameterValue=<CUR_BUCKET_NAME> \
       ParameterKey=HeliasCurReportName,ParameterValue=<CUR_REPORT_NAME>

3. 3

   Wait for the stack to finish

   The stack notifies Helias on its own when it completes. You do not paste anything back.

Connect your organization

Connecting an organization is two deploys. The first connects the management account and creates the report. The second rolls the role out to every member account.

1. 1

   Deploy the management stack

   Same stack as a single account, on your management account. This is the one that creates the S3 bucket and the Cost and Usage Report covering the whole organization.

2. 2

   Activate trusted access for StackSets

   In AWS Organizations, activate trusted access for CloudFormation StackSets. Without it the service-managed StackSet in the next step cannot be created.

3. 3

   Create the StackSet

   The StackSet is service-managed with auto-deployment enabled, so accounts that join your organization later are onboarded without you returning here.

   aws cloudformation create-stack-set \
     --region us-east-1 \
     --stack-set-name <STACK_SET_NAME> \
     --template-url <TEMPLATE_URL> \
     --capabilities CAPABILITY_NAMED_IAM \
     --permission-model SERVICE_MANAGED \
     --auto-deployment Enabled=true,RetainStacksOnAccountRemoval=false \
     --parameters \
       ParameterKey=HeliasExternalId,ParameterValue=<EXTERNAL_ID> \
       ParameterKey=HeliasRoleArn,ParameterValue=<HELIAS_ROLE_ARN> \
       ParameterKey=HeliasRoleName,ParameterValue=<ROLE_NAME>

4. 4

   Roll it out across the organization

   Deployed to us-east-1 only. An IAM role is global, so one region covers the account.

   aws cloudformation create-stack-instances \
     --region us-east-1 \
     --stack-set-name <STACK_SET_NAME> \
     --deployment-targets OrganizationalUnitIds=<ORGANIZATION_ROOT_ID> \
     --regions us-east-1 \
     --operation-preferences FailureToleranceCount=100,MaxConcurrentCount=10

Member accounts appear in Helias as soon as the management account connects, listed as not connected until the StackSet reaches them. A rollout across a large organization can take several minutes.

Reusing a Cost and Usage Report you already have

If you already produce a report that meets the specification, Helias can read it instead of creating a new one. Nothing is created and nothing in your bucket is modified: the stack creates the role and grants it read on that bucket through the role's own identity policy.

A report is reusable when it is hourly, in Parquet, versioned as

OVERWRITE_REPORT, delivered under a prefix rather than at the bucket root, and includes both resource IDs and the Athena integration. Use the following command to list the reports in your account that qualify.

aws cur describe-report-definitions \
  --region us-east-1 \
  --query "ReportDefinitions[?TimeUnit=='HOURLY' && Format=='Parquet' && ReportVersioning=='OVERWRITE_REPORT' && S3Prefix != '' && contains(AdditionalSchemaElements, 'RESOURCES') && contains(AdditionalArtifacts, 'ATHENA')].{report:ReportName, bucket:S3Bucket, prefix:S3Prefix, region:S3Region}" \
  --output table

Report definitions are only served from us-east-1, so run this there even if your report delivers to another region. Paste the bucket, prefix and report name from the listing into the app. If the listing is empty, create a new report instead.

Reusing a report also skips the backfill step below, because the history is already in it.

Verify the connection

AWS is the one provider where you do not watch checks run. The stack notifies Helias when it completes, Helias validates the access against your account, and the app confirms the connection on its own within a few minutes.

If validation fails, CloudFormation rolls the stack back and the reason is written to the stack's events in your own console. Open the stack in CloudFormation and read the events to see what happened.

After you connect

Your first data appears in Helias within 24 hours of a successful connection, and you get an email when the first insights are ready.

A Cost and Usage Report only contains data from the day it is created, so a new report starts collection once AWS delivers it. A report you already have starts with the history in it.

Until then the connections page shows a collection status: Pending while collection has not started, In progress while it runs, and Completed once data is flowing.

Historical data

A Cost and Usage Report only contains data from the day it is created, so a new report starts with no history. AWS will backfill one on request, for up to twelve months, but only through a support case that you file from your own account.

The app prepares that case for you with the report details filled in. You open it in the AWS Support Console and submit it. Until the backfill lands, Helias shows the account as waiting on your cost history rather than as collecting, because there is nothing yet to collect.

Limits

• A new report has no history. Up to twelve months is recoverable through an AWS support case, as above. Nothing older than twelve months is available from AWS at all.
• Member accounts alone give a narrow view. Reserved Instance and Savings Plans coverage is resolved at the organization level, so a member-only connection reports commitments against that account rather than across your organization.
• Reuse requires an exact report shape. Hourly, Parquet, resource IDs and the Athena integration. A daily or CSV report cannot be reused, and the app will not list it.
• Claude bought through Amazon Bedrock is part of your AWS bill and appears in this connection, not in an Anthropic connection.

Troubleshooting

Disconnecting

You can disconnect at any time from the connections page. Disconnecting releases access to the account, immediately.

It does not change anything in your own cloud. What stays behind is the CloudFormation stack and the read-only IAM role it created. Delete the stack in the AWS Console, which removes the role with it.

Helias holds read-only access, so it cannot remove a grant you made.

The S3 bucket and the reports in it are retained too, so your billing history stays where it is. Delete the bucket yourself if you no longer want it.