Skip to main content

Multi-Account Setup Guide

Learn how to monitor multiple AWS accounts in CloudWise.

Overview​

CloudWise can monitor several AWS accounts under one CloudWise login. Free covers 1 AWS account; Shield and Agentic cover up to 5. Compliance connects no AWS account by design: regulated teams work from Air-Gapped uploads instead. Each AWS account gets its own read-only IAM role, created by the same CloudFormation template. CloudWise never asks for IAM users or access keys.

Adding Multiple AWS Accounts​

Step 1: Prepare Your AWS Accounts​

For each AWS account you want to monitor:

  1. Make sure you can create an IAM role and a CloudFormation stack in it
  2. Make sure Cost Explorer is enabled
  3. Have the account open in your browser; you'll create the stack in your own console

Step 2: Add First Account​

  1. Run the Connect flow (new sign-ups land there; existing users go to Settings → AWS Accounts)
  2. Click the one-click setup button and create the stack it opens in your console
  3. CloudWise verifies the role and starts the first scan on its own

The AWS Setup Guide walks through each step, including the manual fallback.

Step 3: Add Additional Accounts​

  1. Repeat the Connect flow from Settings → AWS Accounts for each additional AWS account
  2. Each connection gets its own role and its own External ID (one-click passes it in; manual setup shows it after you enter the 12-digit account ID); nothing is shared between accounts
  3. Use descriptive names to identify each account (e.g., "Production", "Development", "Staging")

IAM Setup for Each Account​

Every account uses the same public template, cloudcostwise.io/cloudwise-cur-setup-template.yaml. It creates one read-only role, its inline policy, and the cost-report bucket. Every action the role allows is on the public permission list. See IAM Best Practices for the trust policy.

Account Management​

Viewing All Accounts​

  • The Settings → AWS Accounts page shows all connected accounts
  • Each account displays its connection status and last scan
  • You can see which accounts are active or have connection issues

Account Naming​

  • Use clear, descriptive names for each account
  • Consider using naming conventions like:
    • Company-Production
    • Company-Development
    • Company-Staging
    • Department-ProjectName

Switching Between Accounts​

  • The CloudWise dashboard allows you to filter data by specific accounts
  • Use the account selector to view costs for individual accounts
  • You can also view combined costs across all accounts

Cost Data Consolidation​

Combined View​

  • CloudWise aggregates costs across all connected accounts
  • The main dashboard shows total spending across the accounts you connected
  • Individual service breakdowns include data from all accounts

Account-Specific Analysis​

  • Filter by specific accounts to analyze individual account costs
  • Set up separate budget alerts for each account
  • Compare spending patterns between different accounts

Best Practices​

Account Organization​

  • Group related accounts (production vs. development)
  • Use consistent naming conventions
  • Document which account serves which purpose

Security Considerations​

  • Keep each account's CloudWise stack as the template created it
  • Watch AssumeRole events for the CloudWise role in AWS CloudTrail
  • To revoke access to one account, delete its CloudFormation stack. The role is deleted even when the delete stops at a cost-report bucket that is not empty; empty the bucket and delete the stack again to remove it

Cost Management​

  • Set different budget thresholds for different account types
  • Monitor production accounts more closely than development
  • Consider the purpose of each account when setting alerts

Troubleshooting​

Connection Issues​

  1. Run Troubleshoot Connection on the account card in Settings → AWS Accounts
  2. Check that Cost Explorer is enabled in the AWS account
  3. Check that no Service Control Policy blocks sts:AssumeRole on the CloudWise role
  4. If the stack was edited by hand, re-run the Connect flow for that account

Missing Cost Data​

  1. Waste findings come from the first scan; cost data follows once AWS delivers the account's Cost and Usage Report
  2. For a brand-new Cost and Usage Report, AWS can take up to 24 hours to deliver the first one
  3. Verify the account has actual AWS usage to report
  4. Contact support if data is still missing after that

Permission Errors​

  1. Run Troubleshoot Connection to see exactly which actions are denied
  2. Update the account's stack to the latest template
  3. Check if there are any organizational policies blocking access

Need Help?​

For assistance with multi-account setup: