The IAM role allows Kion to access the data in the S3 bucket and create accounts in AWS. We recommend you use the default  billing-role-full-access.json file as a best practice. For a list of alternative files with different levels of access, see AWS Billing Sources.

1. Log in to the AWS management account account.
2. Navigate to the AWS CloudFormation service.
3. Click Create Stack.
4. Upload billing-role-full-access.json.
5. Name the stack: cloudtamer-service-role
6. Replace the AWS Account with the AWS account number where Kion is installed.
7. Follow the remainder of the prompts.

To download the .json file, go to the AWS Billing Sources, scroll to the bottom of the article, and download the attached file named billing-role-full-access.json.

1. Log in to Kion.
2. Navigate to Settings > System Settings.
3. Expand the AWS Settings section and select Import AWS Policies.
4. Select AWS Managed IAM Policies.
5. Click Import Policies.

Once the import completes, you will have access to the AWS library of pre-established IAM Policies.

1. Select Users > All Users.
2. Click Add New.
3. Click Create New User.
4. Enter the user's first name.
5. Enter the user's last name.
6. Enter the user's email address. Email addresses do not need to be unique.
7. Enter a user name for the user. User names must be unique within the same IDMS.
8. (Optional) Enter the user's phone number.
9. In the Identity Management System dropdown menu, select an IDMS. If you select an IDMS that is not an Internal type, the user will be updated on their first login with the proper values from the identity provider. This gives you the ability to pre-create users so you can assign them to groups without having them log in first. For information about using an IDMS, see Identity Management.
10. (Optional) Select any groups you want the user to be a member of.
11. (Optional) Select an multi-factor identification (MFA) method you want the user to be forced to register with on their first login. This option will not display if a SAML IDMS is selected. For information about using MFA, see Multi-Factor Authentication.
12. Click Create User.

Creating groups makes it easy to manage teams and users with similar types of access. Rather than managing users one by one, you can group them and grant access, create permissions, and manage them all from one location. 

1. In the left navigation menu, click Users > User Groups.
2. Click Add New.
3. Enter a name to identify the group in Kion. The group name must be unique.
4. (Optional) Enter a description of the user group.
5. Select any users you want to be members of this group.
6. Select users or groups you want to have ownership over the group.
7. Click Create User Group.

1. In the left navigation menu, select Settings > Permissions.
2. Click the Roles tab.
3. Click Create New.
4. In the Role Name field, enter a unique name.
5. Click Create Role.

1. In the left navigation menu, select Settings > Permissions.
2. Click the ellipsis menu on the right side of a permissions scheme card and select Edit.
3. In the dropdown menus, select any roles you would like assigned to the permissions.
4. Click Update Permission Scheme.
5. Repeat this process for every object you want to configure permissions for.

1. Navigate to OUs > All OUs.
2. Click Add New.
3. Enter an OU Name to identify the OU throughout the application. The name must be unique among OUs.
4. In the Parent OU field, select None to designate this as a top-level OU, or select a parent OU to designate this as a child OU.
5. Select at least one user or user group as the OU owner.
6. (Optional) Enter a description.
7. Click Create OU.

By default, Owners have full access to the OU if you are using the Default OU Permissions Scheme.

1. Select Cloud Management > Cloud Rules. 
2. Click Add New.
3. In the Cloud Rule Name field, enter a name to identify the cloud rule throughout the application. This field must be unique among cloud rules.
4. In the Owners dropdown menu, select users and user groups that will have permission to edit this cloud rule.
5. Select AWS Service Control Policies to apply. These SCPs will apply account-wide for accounts associated with the objects this cloud rule is applied to.
6. Select AWS IAM Policies to apply to cloud access roles when this cloud rule is applied.
7. Select AWS AWS CloudFormation Templates to apply to cloud accounts when this cloud rule is applied.
8. Select AWS AMIs to apply. 
9. Select AWS Service Catalog Portfolios to apply.
10. Select Compliance Standards to apply to this cloud rule. Compliance standards are applied to cloud rules, which are applied to projects. All resources within that project will be subject to the compliance checks included in that compliance standard.
11. Click Create Cloud Rule.

1. Navigate to OUs > All OUs.
2. Click on the name of the OU you want to add the cloud rule to.
3. Select the Cloud Management tab.
4. Click the ellipsis menu in the upper right corner of the Cloud Rules box and select Add Existing Cloud Rule.
5. Select the cloud rule you want to add.
6. Click Confirm Selection.

When you add a cloud rule to an OU, it is immediately inherited and all items in the cloud rule are applied to all of the OU's descendant projects.

1. Navigate to OUs > All OUs.
2. Select the OU you would like to create a threshold on.
3. Click the Financials tab.
4. Click OU Thresholds.
5. Click Create.
6. Select a type of threshold time frame. All time frame types are customizable down to individual months.
7. Select a threshold type.
• Fixed Amount. Set a total amount for the threshold, and distribute it between each month within your time frame. This type is recommended if you have a fixed, maximum amount you plan to spend during the time frame.
• Cumulative. Set amounts for each month within your time frame that are added together to create a total. This type is recommended if you would like to plan your spend by month without a fixed maximum amount for the time frame.
8. Click Continue to Threshold Settings.
9. Fixed AmountCumulative

   9. Enter a Threshold Total.
   10. Select whether you would like to have your threshold total evenly distributed throughout your time frame or if you would like to set each month's amount manually.
   11. Click Continue to Threshold Set Up.
   12. Edit any of the monthly amounts as desired.
   13. Click Create Threshold.

   9. Enter an amount for each month within your time frame.
   10. Click Create Threshold.

1. Click Projects> All Projects.
2. Click Add New.
3. Enter a Project Name to identify the project throughout the application. This name must be unique among projects.
4. (Optional) Enter a description.
5. Select an OU to add the project to.
6. Select at least one user or user group as the project owner.
7. In the Project Spend Plan section, click Add Funding Source.
8. Select the funding source that the project will use.
   • You can add more than one funding source to the project spend plan.
   • There must be a funding source available for every month you want the project to operate.
   • You can use more than one funding source in a given month.
   • You can drag and drop the funding sources to prioritize the order in which they are used.
9. Select the start and end months during which the project can use the funding source. Funding sources can only be set on month boundaries since cloud accounts generally finalize spend once a month.
10. In the Planned Amount field, enter the dollar amount available to the project.
11. Click Create Project.

Accounts can be added to Kion in a few places:

• Accounts > All Accounts. Navigate to Accounts > All Accounts and click Add. This brings up the account wizard.
• The Accounts tab of a project. Navigate to the project details page of the project you want to add the account to. Select the Accounts tab. Click Add. This brings up the account wizard.
• The Quick Connect menu. The Quick Connect button is always available at the top of your screen next to the global search. Click the Quick Connect button. Click Accounts. Select whether you want to add new accounts or existing accounts. This brings up the account wizard.
• The Accounts Not in Kion list of a billing source. This option is only for existing AWS and Azure accounts. Navigate to Accounts > Billing Sources. Click the name of the billing source the account you want to add is under. Expand the Accounts not in Kion list. Click the ellipsis menu next to the account you want to add, and select whether you want to add it to a project or to the account cache.

To add an account:

1. Navigate to the account wizard using one of the methods above.
2. Select Amazon Web Services.
3. Select AWS Commercial.
4. Select whether you want to add one account or multiple accounts.
5. Select the billing source for the account.
6. The account wizard will walk you through the remaining steps that are specific to the type of account you are adding. Below are some recommended configurations:
   • Skip account access checking. Enable this if you don't want Kion to verify the role is available. This allows you to preload accounts without having access to them.
   • Add to cache or add to existing project. Add accounts to the Account Cache if you want to preload your accounts and attach them to projects later on.
   • Linked Role. Leave this as OrganizationAccountAccessRole unless you changed the organization role during initial AWS account creation.
   • Include spend from linked GovCloud/Commercial account. Enable this to include the spend data from a linked GovCloud or commercial account. This lets you create combined financial reports without adding the linked account directly to Kion. For more information, see Reporting AWS GovCloud Spend.
   • Sync account information with AWS Organizations. Enable this if you would like to keep the account name and account email updated with those specified in AWS Organizations. You need to ensure the IAM role in the management account has access to Organizations for this to work properly.
   • Add to AWS Organizational Unit. Enable this to add the account to an existing or new AWS organizational unit. This won't affect the account's placement within Kion OUs.

1. Navigate to Settings > System Settings.
2. Expand the AWS Settings section and select Import AWS Policies.
3. Select Customer Managed IAM Policies.
4. Click Import Policies.
5. Select the account to import the IAM policies from.
6. (Optional) Enable the option to Replace Partition and Account IDs with Application Variables. This replaces any account IDs and partitions found within the IAM policy's text with application variables (i.e., {{CT::AWSAccountId}} and {{CT::AWSPartition}}). This ensures that policies that are account-specific or partition-specific in AWS can be applied across resources in Kion.
7. Click Import.

This process may take a minute or two. Leaving the page will not prevent the policies from loading. Kion will notify you when the import is complete.

1. In the left navigation menu, click Projects > All Projects.
2. Click the name of the project to which you will add a cloud access role.
3. Click the Cloud Management tab.
4. Click the Cloud Access Roles subtab.
5. Click Add.
6. In the Cloud Access Role Name field, enter a name to identify it on the project.
7. In the Access Type dropdown, select one or more types of access you wish to grant. The options are:
   • Web Access. Provides the user access to log in to the cloud console/portal.
   • Short Term Access Key. Provides the user the ability to generate temporary access keys that expire after a certain period of time.
   • Long Term Access Key. Provides the user the ability to generate long-term access keys that may or may not expire depending on the settings defined at a global level. No matter the settings at the global level, if the user is disabled, the LTAKs will be disabled as well.
8. Select the users and groups that will have access to use this role.
9. Select an account to apply the role to.
10. (Optional) Check the Also apply to all future accounts to automatically apply this cloud access role to accounts that are added to this project in the future.
11. Enter the name of the AWS IAM role that will be created in the AWS accounts attached to the project.
    This is the name of the role that displays in the top right of the AWS console. It displays as: rolename/username. Any value in the gray box is a prefix that is set at the global level and cannot be edited here. For information on changing this prefix, see AWS Access.
12. Select AWS IAM policies to associate with this role. These allow console access for AWS.
13. Select AWS permissions boundaries to associate with this role.