AWS integration
LiveAWS cost management and CUR analysis, from a read-only role
CloudQuell connects to AWS the way a cost tool should: a read-only cross-account IAM role scoped to billing and read APIs, assumed with a unique ExternalId so no one else can borrow it. Nothing is written back to your account, and no agent runs inside it — you hand over a role ARN and a bucket name, and CloudQuell stores no AWS keys.
From there it reads your Cost and Usage Report at resource-level and backfills up to a year from Cost Explorer, so allocation, anomaly baselines, and commitment analysis have history on day one. First analytics appear the same day you connect.
What CloudQuell ingests
AWS's own billing record — nothing estimated, nothing sampled — at the grain the CUR publishes it.
- Cost & Usage Report (CUR 2.0)
- A daily, resource-level Parquet export delivered to a bucket you own. This is the authoritative line-item record: every charge, by service, account, resource, and usage type.
- 12 months of history
- On connect, CloudQuell backfills up to a year of daily cost from Cost Explorer, so trends, baselines, and allocation aren't blank while the CUR accumulates going forward.
- Resource tags
- Cost-allocation tags ride along on every line item and drive tag coverage and allocation rules — the mechanism for putting an owner on each dollar.
- Commitment records
- Reserved Instance and Savings Plan purchases and usage, so coverage, utilization, and Effective Coverage % are computed from the same export as everything else.
What the data looks like normalized
A CUR line item lands in the same unified ledger as every other source, so an EC2 charge and a Snowflake warehouse answer to one schema.
| Normalized field | AWS source | Example |
|---|---|---|
| Date | CUR billing day | 2026-08-04 |
| Provider | constant | AWS |
| Service | product service code | Amazon EC2 |
| Scope | linked account | 4021…8843 (prod) |
| Cost (USD) | amortized / effective cost | $1,284.50 |
| Usage | usage amount + unit | 940 hrs |
| Attribution | resource tags | team=payments · env=prod |
How it connects
One read-only role, assumed with an ExternalId. No stored credentials, no write access, no in-account agent.
- Credential
- A cross-account IAM role you create, assumed by CloudQuell with a unique ExternalId (confused-deputy protection). CloudQuell stores no AWS access keys.
- Access scope
- Read-only. The published policy grants only the billing and read permissions the analytics need; nothing is written back and no agent runs in your account.
- Setup
- Quick-create with a CloudFormation stack in about five minutes, or wire the role and CUR export manually in about fifteen. You provide a role ARN and a bucket name.
- Time to first data
- Same day. Historical analytics appear as soon as the role is live; a brand-new CUR export begins delivering within about a day.
- Where to connect
- From your management (payer) account, so every linked account is covered by the one connection.
What it unlocks
Once the CUR is flowing, the rest of CloudQuell runs on it.
Cost allocation
Score tag coverage, then close the gap with allocation rules that assign shared and untagged cost to cost centers until the whole bill sums to teams.
The allocation playbook →Anomaly detection
Per-service baselines flag the one service running hot instead of a single number over total spend — routed to Slack, Teams, or email.
Alerts that aren't noise →Commitment analysis
RI and Savings Plan coverage, utilization, and Effective Coverage % — one honest number for whether you've committed to enough and use what you bought.
Effective Coverage % →Rightsizing
Compute Optimizer findings and ranked savings recommendations, each showing the dollar impact of acting, sitting next to the spend they would reduce.
Common questions
- Is CloudQuell's AWS access really read-only?
- Yes. The connector assumes a cross-account IAM role whose published policy grants only billing and read permissions, and it is assumed with a unique ExternalId so the role can't be assumed by anyone else. Nothing is written to your account and no agent runs inside it. You can review the exact policy before you deploy it.
- Do I need to set up a Cost and Usage Report first?
- No — the quick-create CloudFormation stack provisions the CUR 2.0 export for you. If you already publish a CUR, the manual path points CloudQuell at your existing bucket instead. Either way, first analytics land the same day from a 12-month Cost Explorer backfill while the CUR accumulates going forward.
- How much AWS spend can I track on the free plan?
- CloudQuell is free under $10K/month of cloud spend, with up to three connected integrations. Above that, paid plans remove the cap and add anomaly alerts, allocation, and longer retention. Pricing is a flat monthly fee, never a percentage of your bill.
- Which AWS costs can CloudQuell see?
- Everything in the CUR: EC2, S3, RDS, data transfer, support, Marketplace, tax — every line item, by service, linked account, and resource. Connect from the management (payer) account and all linked accounts are covered by the one role.
Free under $10K/month of cloud spend. Read-only role, same-day analytics, flat monthly price.