AWS setup guide

Overview

This guide explains how to prepare your AWS account so that emma can access your billing data, and what credentials to provide during the connection setup.

emma reads your billing data from an S3 bucket you control — it never accesses your workloads or infrastructure.

Before you start

You need access to the following services in your master (management) AWS account:

• AWS Billing and Cost Management
• Amazon S3

Step 1 — Create an S3 bucket

This bucket will receive your billing export files.

1. Open Amazon S3 and click Create bucket.
2. Enter a Bucket name (e.g. my-company-focus-export). Choose any region.
3. Leave all other settings as default and click Create bucket.

Save the bucket name — you will need it later.

Step 2 — Set up FOCUS billing export

1. Open Billing and Cost Management → Cost and Usage Analysis → Data Exports.
2. Click Create.
3. Fill in:

• Export type → Standard data export
• Export name → any name (e.g. focus-export)
• Data table content → FOCUS 1.0 with AWS columns
• Compression type → Parquet
• File versioning: any format is applicable. Create a new data export file is better for keeping history of changes but consume more space as the files are not deleted.

9. Under Data export storage settings, click Configure next to S3 bucket. Select Use existing bucket and choose the bucket from Step 1.
10. Enter an S3 path prefix (e.g. billing). This is the folder path inside the bucket where files will be stored.
11. Click Create.

Save the Export name and the S3 path prefix — you will need them later.

Step 3 — Create an IAM user

This user will be used by emma to access the S3 bucket — it has no other permissions.

1. Open IAM → Access management → IAM Users → Create user.
2. Enter a User name (e.g. emma-service-user). Do not enable Console access.

1. Click Next.
2. Under Set permissions, select Attach policies directly → Create policy.
3. Paste the following policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::<s3_bucket_name>",
        "arn:aws:s3:::<s3_bucket_name>/*"
      ]
    }
  ]
}

1. Name the policy (e.g. emma-s3-read-policy) and click Create policy.
2. Attach the newly created policy to the user and click Next → Create user.

Step 4 — Create access keys

1. On the Users page, open the user you just created.
2. Go to the Security credentials tab.
3. Scroll to Access keys → Create access key.

1. Select Application running outside AWS → Next → Create access key.

1. Copy the Access key ID and Secret access key.

The Secret access key is shown only once. Copy it immediately.

What to enter in emma