AWS

Connect your AWS account to Yasu using our secure CloudFormation template. This one-click deployment creates a read-only IAM role that enables Yasu to analyze your cloud costs and provide optimization recommendations.

Prerequisites

Before connecting your AWS account, ensure you have:

Administrative access to your AWS account (or permissions to create IAM roles and CloudFormation stacks)
Cost Explorer enabled in your AWS account
Access to the AWS Console

Security First: Yasu uses a cross-account IAM role with read-only permissions. We cannot modify or delete any of your AWS resources.

Quick Setup via CloudFormation

The fastest way to connect your AWS account is through our pre-configured CloudFormation template.

Navigate to Integrations

Log in to your Yasu dashboard at app.yasu.cloud
Go to Settings → Integrations
Click Connect AWS

Deploy the CloudFormation Stack

You’ll be redirected to AWS CloudFormation with our template pre-loaded.

Review the stack name — A unique name is generated for you (e.g., YasuIntegration-abc123)
Review the parameters — These are automatically filled in:
- YasuCustomerId — Your unique Yasu customer ID
- YasuExternalId — A secure token for cross-account access
- BucketName — S3 bucket for Cost and Usage Reports
- ReportName — Name for your AWS CUR report
Scroll to the bottom and check the acknowledgment box:
☑️ I acknowledge that AWS CloudFormation might create IAM resources.
Click Create stack

Do not modify the parameters — They are pre-configured to work with your Yasu account.

Wait for Stack Creation

The CloudFormation stack typically completes in 2-3 minutes. You can monitor the progress in the AWS Console:

CREATE_IN_PROGRESS — Stack is being created
CREATE_COMPLETE — Stack created successfully

Once complete, Yasu automatically detects the connection and begins syncing your data.

Verify Connection in Yasu

Return to your Yasu dashboard. You should see:

✅ Connection status: Active
✅ AWS Account ID: Your connected account
✅ Data sync: In progress

Your first cost-saving insights will appear within 5-10 minutes after connection.

What the CloudFormation Template Creates

Our template creates the following resources in your AWS account:

1. Cross-Account IAM Role

A read-only IAM role that allows Yasu to access your cost and resource data:

arn:aws:iam::YOUR-ACCOUNT-ID:role/YasuCostOptimizationRole

2. IAM Policies with Read-Only Permissions

The role includes two policies. The main policy (YasuCostOptimizationPolicy) grants read-only access across AWS services:

Service	Permissions	Purpose
Cost Explorer	`ce:Describe`, `ce:Get`, `ce:List*`	Cost and usage data
Compute Optimizer	`compute-optimizer:Describe`, `compute-optimizer:Get`	Right-sizing recommendations
EC2	`ec2:Describe`, `ec2:List`	Instance, volume, and snapshot info
RDS	`rds:Describe`, `rds:List`	Database instance details
EKS	`eks:Describe`, `eks:List`	Kubernetes cluster info
Lambda	`lambda:Get`, `lambda:List`	Function configurations
S3	`s3:GetBucketLocation`, `s3:GetBucketTagging`, `s3:List*`	Storage bucket information
CloudWatch	`cloudwatch:Get`, `cloudwatch:List`, `cloudwatch:Describe*`	Utilization metrics
Organizations	`organizations:Describe`, `organizations:List`	Account structure
Savings Plans	`savingsplans:Describe*`	Savings plan coverage
Trusted Advisor	`trustedadvisor:Get`, `trustedadvisor:List`, `support:*`	AWS recommendations
Cost Optimization Hub	`cost-optimization-hub:Get`, `cost-optimization-hub:List`	Consolidated AWS savings recommendations

A second policy (YasuCloudWatchMetricsReadOnly) grants read access to Container Insights logs and Auto Scaling metrics.

View full IAM policies

The policies below are from template version v0.0.1. For the latest version, see the CloudFormation template.Key statements:YasuBillingReadOnly — Read-only access to billing, cost, and resource data:

{
  "Sid": "YasuBillingReadOnly",
  "Effect": "Allow",
  "Action": [
    "application-autoscaling:Describe*",
    "aws-portal:ViewBilling",
    "aws-portal:ViewUsage",
    "budgets:Describe*",
    "budgets:View*",
    "ce:Describe*",
    "ce:Get*",
    "ce:List*",
    "cloudwatch:Get*",
    "cloudwatch:List*",
    "cloudwatch:Describe*",
    "cloudfront:GetDistribution",
    "cloudfront:GetDistributionConfig",
    "cloudfront:ListDistributions",
    "cloudfront:ListTagsForResource",
    "compute-optimizer:Describe*",
    "compute-optimizer:Get*",
    "cost-optimization-hub:Get*",
    "cost-optimization-hub:List*",
    "cur:Describe*",
    "directconnect:Describe*",
    "ec2:Describe*",
    "ec2:List*",
    "ecr:Describe*",
    "ecr:List*",
    "eks:Describe*",
    "eks:List*",
    "elasticache:List*",
    "elasticfilesystem:Describe*",
    "elasticloadbalancing:Describe*",
    "es:Describe*",
    "es:List*",
    "glacier:Describe*",
    "kafka:Describe*",
    "kafka:List*",
    "lambda:Get*",
    "lambda:List*",
    "organizations:Describe*",
    "organizations:List*",
    "pi:Describe*",
    "pi:Get*",
    "pi:List*",
    "pricing:*",
    "rds:Describe*",
    "rds:List*",
    "redshift:Describe*",
    "redshift:List*",
    "route53:Get*",
    "route53:List*",
    "s3:GetBucketLocation",
    "s3:GetBucketTagging",
    "s3:List*",
    "sagemaker:Describe*",
    "sagemaker:List*",
    "savingsplans:Describe*",
    "sqs:List*",
    "ssm:Describe*",
    "ssm:List*",
    "support:*",
    "tag:Get*",
    "tag:GetResources",
    "trustedadvisor:Get*",
    "trustedadvisor:List*"
  ],
  "Resource": "*"
}

YasuContainerInsightsReadOnly — Container Insights log access:

{
  "Sid": "YasuContainerInsightsReadOnly",
  "Effect": "Allow",
  "Action": [
    "logs:List*",
    "logs:Describe*",
    "logs:StartQuery",
    "logs:StopQuery",
    "logs:Filter*",
    "logs:Get*"
  ],
  "Resource": "arn:aws:logs:*:*:log-group:/aws/containerinsights/*"
}

YasuContainerMetricsAccess — Auto Scaling and CloudWatch metrics:

{
  "Sid": "YasuContainerMetricsAccess",
  "Effect": "Allow",
  "Action": [
    "autoscaling:Describe*",
    "cloudwatch:Describe*",
    "cloudwatch:Get*",
    "cloudwatch:List*"
  ],
  "Resource": "*"
}

3. Cost and Usage Report (CUR)

An S3 bucket and CUR configuration for detailed billing data:

Bucket: yasu-cur-{unique-id}
Report granularity: Daily
Format: Parquet (optimized for analysis)

What Yasu Will Scan

Once connected, Yasu analyzes your AWS environment for optimization opportunities:

Cost Optimization Insights

Idle EC2 Instances — Running instances with low CPU/network utilization
Oversized Instances — Instances that can be downsized based on usage patterns
Unattached EBS Volumes — Volumes not connected to any instance
Old EBS Snapshots — Snapshots older than retention policies
Unused Elastic IPs — Static IPs not associated with running resources
Idle RDS Instances — Databases with minimal connections or queries
Underutilized Lambda — Functions with excess memory allocation
S3 Storage Classes — Buckets that could benefit from lifecycle policies

Savings Opportunities

Reserved Instance Coverage — Recommendations for RI purchases
Savings Plans — Compute and EC2 Savings Plan opportunities
Spot Instance Candidates — Workloads suitable for Spot pricing

Cost Optimization Hub Recommendations

Yasu surfaces recommendations from AWS Cost Optimization Hub (COH) — AWS’s own consolidated recommendation engine. COH brings rightsizing, idle-resource, Reserved Instance, and Savings Plans recommendations across your organization into one place, each with an estimated monthly saving.

COH recommendations are read through the AWS Cost Optimization Hub API. Enabling it does not add to your AWS bill.

Two things must be true for COH recommendations to appear in Yasu:

Cost Optimization Hub is enabled (opted in) in your AWS account.
The Yasu IAM role has cost-optimization-hub read permissions — included in the current CloudFormation template.

Enroll in Cost Optimization Hub

Cost Optimization Hub is an opt-in AWS service. Enable it once from your management (payer) account so recommendations cover your whole organization.

AWS Console
AWS CLI

Open the AWS Billing and Cost Management console
In the left navigation, select Cost Optimization Hub
Click Enable Cost Optimization Hub (or Get started)
Confirm the opt-in

aws cost-optimization-hub update-enrollment-status \
  --status Active \
  --region us-east-1

From your management account, add --include-member-accounts to enroll the entire organization:

aws cost-optimization-hub update-enrollment-status \
  --status Active \
  --include-member-accounts \
  --region us-east-1

Cost Optimization Hub is a global service — its API lives in us-east-1, so run the command with --region us-east-1. After enrolling, AWS can take up to 24 hours to generate the first recommendations.

If you’re a new customer, that’s all you need — the CloudFormation template you deployed already grants Yasu the read permission, so COH recommendations appear automatically once AWS has generated them.

Existing Customers: Add the Cost Optimization Hub Permission

If you connected your AWS account before August 2026, your Yasu IAM role was created from an earlier template that did not include Cost Optimization Hub permissions. The template has since been updated, so you need to refresh your role once to add:

cost-optimization-hub:Get*
cost-optimization-hub:List*

Without these permissions, Yasu cannot read Cost Optimization Hub, and COH recommendations will not appear.

Choose either option below.

Option A — Update your CloudFormation stack (recommended)

Update your existing Yasu stack to the latest template. Your parameters and role ARN stay the same; only the permissions change.

AWS Console
AWS CLI

Open AWS CloudFormation
Select your existing Yasu stack (named yasu-* or YasuIntegration-*)
Click Update → Replace existing template

Under Amazon S3 URL, paste:

https://yasu-public.s3.eu-central-1.amazonaws.com/root/yasu-cf-template-latest.json

Click Next through the parameter and options screens — keep all existing parameter values
On the review screen, check I acknowledge that AWS CloudFormation might create IAM resources
Click Update stack

Replace YOUR-STACK-NAME with your stack’s name (find it in the CloudFormation console):

aws cloudformation update-stack \
  --stack-name YOUR-STACK-NAME \
  --template-url https://yasu-public.s3.eu-central-1.amazonaws.com/root/yasu-cf-template-latest.json \
  --parameters \
      ParameterKey=YasuID,UsePreviousValue=true \
      ParameterKey=YasuHandshakeID,UsePreviousValue=true \
      ParameterKey=YasuIamRole,UsePreviousValue=true \
      ParameterKey=ReportName,UsePreviousValue=true \
      ParameterKey=BucketName,UsePreviousValue=true \
      ParameterKey=YasuPingbackArn,UsePreviousValue=true \
      ParameterKey=TemplateVersion,UsePreviousValue=true \
      ParameterKey=TemplateUrl,UsePreviousValue=true \
  --capabilities CAPABILITY_IAM \
  --region us-east-1

The update completes in 1–2 minutes, ending in status UPDATE_COMPLETE. Nothing else in your account changes — the role keeps the same ARN, and Yasu stays connected throughout.

Option B — Add the permission manually

If you’d rather not update the stack, add the two actions to the role’s policy directly:

Open IAM → Roles and find YasuCostOptimizationRole-*
Open the attached YasuCostOptimizationPolicy-* policy and click Edit

Add these two actions to the Action list:

"cost-optimization-hub:Get*",
"cost-optimization-hub:List*"

Click Save changes

A manual edit is overwritten the next time the CloudFormation stack updates. Option A keeps your role in sync with the template going forward.

Then enroll in COH

Adding the permission lets Yasu read Cost Optimization Hub, but AWS only generates recommendations once COH is enabled. If you haven’t already, enroll in Cost Optimization Hub as described above.

Data Sync Schedule

Data Type	Initial Sync	Ongoing Sync
Cost data	Last 12 months	Daily
Resource inventory	Current state	Every 6 hours
Utilization metrics	Last 14 days	Daily
Recommendations	Within 24 hours	Weekly

Troubleshooting

Stack creation failed

Common causes:

Insufficient permissions — Ensure you have cloudformation:*, iam:*, and s3:* permissions
S3 bucket name conflict — The bucket name must be globally unique; try again to generate a new name
Service limits — Check if you’ve hit IAM role limits

Solution: Delete the failed stack and try the connection again from Yasu.

Connection shows as pending

What to check:

Verify the CloudFormation stack status is CREATE_COMPLETE
Check that the stack wasn’t rolled back
Ensure the callback URL is accessible (no VPN/firewall blocking)

Solution: Wait 5 minutes, then refresh. If still pending, delete the stack and reconnect.

Missing cost data

What to check:

Cost Explorer is enabled — Go to AWS Billing → Cost Explorer → Enable
Sufficient history — Cost Explorer needs ~24 hours to populate after first enable
IAM permissions — Verify the role has ce:* permissions

Solution: Enable Cost Explorer if needed, then wait 24 hours for data to populate.

Incomplete resource scan

What to check:

Regional coverage — Some resources may be in regions not yet scanned
API rate limits — Large accounts may take longer to fully scan
Missing permissions — Verify all Describe permissions are in place

Solution: Wait for the full sync cycle (up to 6 hours for large accounts).

Connecting Multiple AWS Accounts

If you have multiple AWS accounts (e.g., production, staging, development), you can connect each one:

Go to Settings → Integrations
Click Connect AWS for each additional account
Deploy the CloudFormation stack in each account

AWS Organizations: If you use AWS Organizations, connect the management account first for organization-wide visibility.

Get started

Configuration

Integrations

Prerequisites

Quick Setup via CloudFormation

What the CloudFormation Template Creates

1. Cross-Account IAM Role

2. IAM Policies with Read-Only Permissions

3. Cost and Usage Report (CUR)

What Yasu Will Scan

Cost Optimization Insights

Savings Opportunities

Cost Optimization Hub Recommendations

Enroll in Cost Optimization Hub

Existing Customers: Add the Cost Optimization Hub Permission

Option A — Update your CloudFormation stack (recommended)

Option B — Add the permission manually

Then enroll in COH

Data Sync Schedule

Troubleshooting

Connecting Multiple AWS Accounts

Next Steps

Connect GCP

Connect Azure

​Prerequisites

​Quick Setup via CloudFormation

​What the CloudFormation Template Creates

​1. Cross-Account IAM Role

​2. IAM Policies with Read-Only Permissions

​3. Cost and Usage Report (CUR)

​What Yasu Will Scan

​Cost Optimization Insights

​Savings Opportunities

​Cost Optimization Hub Recommendations

​Enroll in Cost Optimization Hub

​Existing Customers: Add the Cost Optimization Hub Permission

​Option A — Update your CloudFormation stack (recommended)

​Option B — Add the permission manually

​Then enroll in COH

​Data Sync Schedule

​Troubleshooting

​Connecting Multiple AWS Accounts

​Next Steps

Connect GCP

Connect Azure

Prerequisites

Quick Setup via CloudFormation

What the CloudFormation Template Creates

1. Cross-Account IAM Role

2. IAM Policies with Read-Only Permissions

3. Cost and Usage Report (CUR)

What Yasu Will Scan

Cost Optimization Insights

Savings Opportunities

Cost Optimization Hub Recommendations

Enroll in Cost Optimization Hub

Existing Customers: Add the Cost Optimization Hub Permission

Option A — Update your CloudFormation stack (recommended)

Option B — Add the permission manually

Then enroll in COH

Data Sync Schedule

Troubleshooting

Connecting Multiple AWS Accounts

Next Steps