Connect AWS (read-only)

AWS has no one-click authorization for third-party read access, so you grant it with a small CloudFormation stack. It creates a role this app can assume to read cost/usage data and resource metadata, never your code, data, or secrets.

  1. 🚀 Launch the stack in AWS
    (opens CloudFormation with everything pre-filled; sign in if prompted)
  2. On the review page, tick “I acknowledge that AWS CloudFormation might create IAM resources”, then Create stack.
  3. When it shows CREATE_COMPLETE (a few seconds), open the Outputs tab and copy the RoleArn.
  4. Paste it below and continue.
Prefer to upload the template manually?
  1. ⬇ Download the template  (a small CloudFormation YAML, generated for this session)
  2. Open AWS Console → CloudFormation → Create stack ↗ (sign in if prompted; any region is fine, the role it creates is global).
  3. Under Specify template, choose Upload a template file → Choose file, select the YAML you just downloaded, then Next.
  4. Give it a Stack name (e.g. source-material-export-readonly) and click Next through the options.
  5. On the review step, check “I acknowledge that AWS CloudFormation might create IAM resources”, then Submit.
  6. When the stack shows CREATE_COMPLETE (a few seconds), open its Outputs tab and copy the RoleArn value.
  7. Paste it below and continue.

The template trusts only this app's AWS identity, gated on a one-time external ID unique to this session. Feel free to review it before deploying:

Show the template 
AWSTemplateFormatVersion: '2010-09-09'
Description: Read-only role for source-material-export (technical due diligence)
Resources:
  DueDiligenceReadOnlyRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: 'arn:aws:iam::828078129978:user/source-material-export'
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: '8trPYhGhexG_1RaC-lyCE-7oh2RvD5fU'
      Policies:
        - PolicyName: DueDiligenceReadOnly
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ce:GetCostAndUsage
                  - ec2:DescribeInstances
                  - rds:DescribeDBInstances
                  - lambda:ListFunctions
                  - s3:ListAllMyBuckets
                  - s3:GetBucketLocation
                  - sts:GetCallerIdentity
                Resource: '*'
Outputs:
  RoleArn:
    Description: Paste this back into the export page
    Value: !GetAtt DueDiligenceReadOnlyRole.Arn

Cost data is optional. Cost history needs Cost Explorer enabled on the account (AWS Billing → Cost Explorer → Enable, management/payer account only, and it can take up to ~24h to activate). If it isn't enabled you'll just see a note in the zip's _errors.txt and still get the full resource inventory.

There is no cost to installing this CloudFormation stack, as the configuration only adds a simple API permission for the tool to retrieve your account metadata. No services are deployed, and there is no charge for adding the API permission.