An S3 billing bucket stores billing data for Kion to access. If you already have monthly billing reports and cost and usage reports set up, you can skip to Add the Kion IAM Role.

1. Log in to your AWS management account.
2. Navigate to the AWS CloudFormation service.
3. Click Create Stack.
4. Upload this template: billing-bucket.json.
5. Name the stack: cloudtamer-billing-bucket.
6. Follow the remainder of the prompts.

To download the .json file, go to the AWS Billing Sources, scroll to the bottom of the article, and download the attached file named billing-bucket.json.

Enabling monthly reports allows AWS to send its monthly billing data to the S3 bucket we just created. 

1. Log in to the AWS management account account.
2. Click your username at the top right.
3. Click My Billing Dashboard.
4. Click Billing preferences.
5. Scroll to the bottom of the page and expand Detailed Billing Reports [Legacy].
6. Enable Turn on the legacy Detailed Billing Reports feature to receive ongoing reports of your AWS charges.
7. Name the bucket: cloudtamer-accountnumber-hourly
8. If you are asked to verify the bucket policy, check the box and click Save.
9. Select all of the reports.
10. Click Save preferences.

Enabling cost and usage reports allows AWS to send its cost and usage billing data to the S3 bucket we created. 

1. Log in to the AWS management account account.
2. Click your username at the top right.
3. Click My Billing Dashboard.
4. Click Cost & Usage Reports.
5. Click Create report.
6. Name the report: cloudtamer-accountnumber-hourly
7. Enable Include resource IDs.
8. Enable Automatically refresh your Cost & Usage Report when charges are detected for previous months with closed bills.
9. Click Next.
10. Name the bucket: cloudtamer-accountnumber-hourly
11. If you are asked to verify the bucket policy, check the box and click Save.
12. Enter the report prefix: report
13. For Report Versioning, enter: Create new report version
14. Enable report data integration for Amazon Redshift and Amazon QuickSight.
15. Click Next.
16. Click Review and Complete.

The IAM role allows Kion to access the data in the S3 bucket and create accounts in AWS. We recommend you use the default  govcloud-billing-role-full-access.json file as a best practice. For a list of alternative files with different levels of access, see AWS Billing Sources.

1. Log in to the AWS management account account.
2. Navigate to the AWS CloudFormation service.
3. Click Create Stack.
4. Upload govcloud-billing-role-full-access.json.
5. Name the stack: cloudtamer-service-role
6. Replace the AWS Account with the AWS account number where Kion is installed.
7. Follow the remainder of the prompts.

To download the .json file, go to the AWS Billing Sources, scroll to the bottom of the article, and download the attached file named govcloud-billing-role-full-access.json.

To configure billing for your new instance of Kion in AWS GovCloud, you must configure a partition user in AWS Commercial. This partition user is used for several operations, including accessing the list of available AWS commercial regions and performing AWS commercial operations.

1. In Kion, navigate to Settings > System Settings > AWS Settings > AWS Partitions.
2. Download the AWS CloudFormation template at the top of the page.
3. Deploy the downloaded AWS CloudFormation template in the AWS commercial account that correlates to your AWS GovCloud installation account. This creates your AWS Commercial partition account.
• Do not execute this AWS CloudFormation template in your AWS commercial management (billing) account.
4. In your AWS commercial partition account, navigate to IAM > Users.
5. Select the cloudtamer-service-user.
6. Click Security Credentials.
7. Generate a new access key for this user. Take note of the Access Key ID and the Secret Access Key.
8. In the Kion AWS Partitions settings, select AWS Commercial.
9. Enter the Access Key ID and Secret Access Key that you generated earlier.
10. Click Save.
11. Log in to your AWS commercial management account.
12. Navigate to IAM > Roles.
13. Select the cloudtamer-service-role.
14. In the details section, select Trust Relationships.
15. Edit the trust policy by adding the following code. Replace [ACCOUNTNUMBER] with the account numeber for your AWS commercial partition account.
    

    {
    			"Effect": "Allow",
    			"Principal": {
    				"AWS": "arn:aws:iam::[ACCOUNTNUMBER]:root"
    			},
    			"Action": "sts:AssumeRole"
    }

16. In Kion, navigate to Settings > System Settings > AWS Settings > AWS Regions.

17. Select the AWS regions you plan to use. Ensure you select the region that contains your S3 billing buckets for your AWS commercial management account.

18. Click Update.

This step links Kion to your AWS management account, so Kion can begin reading billing data and operating in AWS. For this example, we are assuming you have the “full-access” configuration.

1. Log in to Kion.
2. Click Accounts on the left menu.
3. Click Billing Sources.
4. Click the Add New + button at the top of the page.
5. For Account Type, select AWS.
6. Select a Billing Report Type. We recommend using the Cost and Usage Report and Detailed Billing Report. Select the Detailed Billing Report if you use C2S and SC2S.
7. Fill in the form with the following information:
   • Billing Source Name. Enter AWS management account.
   • AWS Account Number. Enter the account number of the commercial AWS management account.
   • Billing Report Type. Selecting Cost & Usage Report and Detailed Billing Report generates data from both reports and is recommended. Selecting Only Cost & Usage Report generates data from the Cost and Usage Report (CUR), which supports the use of the AWS Billing Conductor.
   • Monthly Report S3 Bucket: Enter cloudtamer-accountnumber-hourly.
   • Cost & Usage Report S3 Bucket. Enter cloudtamer-accountnumber-hourly.
     • If you are using replication, enter cloudtamer-accountnumber-hourly-replicated.
   • Monthly Report S3 Bucket Region. Select the region where the S3 billing bucket is located. This will be a commercial region.
   • Cost & Usage Report Prefix. Enter: report.
   • Cost & Usage Report S3 Bucket Region. Select the region where the S3 billing bucket is located. This will be a commercial region.
   • Cost & Usage Report Name. Enter cloudtamer-accountnumber-hourly.
   • AWS Account Number Containing S3 Buckets. Enter the account number of the AWS management account.
     • If you are using replication, enter the AWS account number where Kion is installed.
   • Billing S3 Bucket Access Role. Leave this field blank unless you are using replication.
     • If you are using replication, enter: cloudtamer-service-role.
   • Billing Start Date. Set the date to when the monthly reports are first available.
   • AWS Linked Role. The AWS linked role is the name of the IAM role that AWS Organizations automatically configures during account creation. The linked role is used as the default for any new accounts associated with this billing source.
   • Select whether Kion can use this management account to create AWS accounts.
   • Leave Skip Billing Source validation unchecked.
   • Select if you would like to enroll all AWS accounts created in Kion for this billing source in your existing AWS Business or Enterprise Support plan. This option only displays if you already have an AWS support plan.
8. Click Test Billing Connection. The number of reports found is based on how long reporting has been enabled. If you just enabled reporting, it can take up to 24 hours for your first report to come in from AWS. In this case, it is normal to see a report count of 0.
9. Click Create Billing Source.

For Kion to support AWS Organizations lookups and account creation, you must configure your billing source to use your AWS GovCloud Organizations master account. This is the top-level of your AWS Organizations structure within AWS GovCloud.

1. In Kion, navigate to Accounts > Billing Sources.
2. Click the ellipsis menu next to the billing source you configured earlier and select GovCloud Settings.
3. Enter a friendly name for the account.
4. Enter the account number for your GovCloud Organization master account.
5. Click Save.
6. Contact Kion Support for the AWS CloudFormation template to create a role in your GovCloud Organization master account.

1. Log in to Kion.
2. Navigate to Settings > System Settings.
3. Expand the AWS Settings section and select Import AWS Policies.
4. Select AWS Managed IAM Policies.
5. Click Import Policies.

Once the import completes, you will have access to the AWS library of pre-established IAM Policies.

1. Select Users > All Users.
2. Click Add New.
3. Click Create New User.
4. Enter the user's first name.
5. Enter the user's last name.
6. Enter the user's email address. Email addresses do not need to be unique.
7. Enter a user name for the user. User names must be unique within the same IDMS.
8. (Optional) Enter the user's phone number.
9. In the Identity Management System dropdown menu, select an IDMS. If you select an IDMS that is not an Internal type, the user will be updated on their first login with the proper values from the identity provider. This gives you the ability to pre-create users so you can assign them to groups without having them log in first. For information about using an IDMS, see Identity Management.
10. (Optional) Select any groups you want the user to be a member of.
11. (Optional) Select an multi-factor identification (MFA) method you want the user to be forced to register with on their first login. This option will not display if a SAML IDMS is selected. For information about using MFA, see Multi-Factor Authentication.
12. Click Create User.

Creating groups makes it easy to manage teams and users with similar types of access. Rather than managing users one by one, you can group them and grant access, create permissions, and manage them all from one location. 

1. In the left navigation menu, click Users > User Groups.
2. Click Add New.
3. Enter a name to identify the group in Kion. The group name must be unique.
4. (Optional) Enter a description of the user group.
5. Select any users you want to be members of this group.
6. Select users or groups you want to have ownership over the group.
7. Click Create User Group.

1. In the left navigation menu, select Settings > Permissions.
2. Click the Roles tab.
3. Click Create New.
4. In the Role Name field, enter a unique name.
5. Click Create Role.

1. In the left navigation menu, select Settings > Permissions.
2. Click the ellipsis menu on the right side of a permissions scheme card and select Edit.
3. In the dropdown menus, select any roles you would like assigned to the permissions.
4. Click Update Permission Scheme.
5. Repeat this process for every object you want to configure permissions for.

1. Navigate to OUs > All OUs.
2. Click Add New.
3. Enter an OU Name to identify the OU throughout the application. The name must be unique among OUs.
4. In the Parent OU field, select None to designate this as a top-level OU, or select a parent OU to designate this as a child OU.
5. Select at least one user or user group as the OU owner.
6. (Optional) Enter a description.
7. Click Create OU.

By default, Owners have full access to the OU if you are using the Default OU Permissions Scheme.

1. Select Cloud Management > Cloud Rules. 
2. Click Add New.
3. In the Cloud Rule Name field, enter a name to identify the cloud rule throughout the application. This field must be unique among cloud rules.
4. In the Owners dropdown menu, select users and user groups that will have permission to edit this cloud rule.
5. Select AWS Service Control Policies to apply. These SCPs will apply account-wide for accounts associated with the objects this cloud rule is applied to.
6. Select AWS IAM Policies to apply to cloud access roles when this cloud rule is applied.
7. Select AWS AWS CloudFormation Templates to apply to cloud accounts when this cloud rule is applied.
8. Select AWS AMIs to apply. 
9. Select AWS Service Catalog Portfolios to apply.
10. Select Compliance Standards to apply to this cloud rule. Compliance standards are applied to cloud rules, which are applied to projects. All resources within that project will be subject to the compliance checks included in that compliance standard.
11. Click Create Cloud Rule.

1. Navigate to OUs > All OUs.
2. Click on the name of the OU you want to add the cloud rule to.
3. Select the Cloud Management tab.
4. Click the ellipsis menu in the upper right corner of the Cloud Rules box and select Add Existing Cloud Rule.
5. Select the cloud rule you want to add.
6. Click Confirm Selection.

When you add a cloud rule to an OU, it is immediately inherited and all items in the cloud rule are applied to all of the OU's descendant projects.

1. In the left navigation menu, click Financials > All Funding Sources.
2. Click Add New.
3. Enter the Funding Source Name. This name must be unique among funding sources.
4. Enter the Amount of funds in this funding source. This can be increased or decreased later.
5. Enter a Start date. This is the first day of a month.
6. Enter an End date. This is the last day of a month.
7. In the Top-Level OU field, select the OU you want to add this funding source to.
8. Select at least one user or user group as the funding source owner.
9. (Optional) Enter a description.
10. Click Create Funding Source.

1. Click Financials > Allocate Funds.
2. In the Source OU field, select an OU where there are funds available.
3. In the Destination OU field, select the OU where the funds will be transferred.
4. Next to each funding source, enter a dollar amount to allocate to the destination OU. You can allocate from multiple funding sources in the same operation.
5. (Optional) Enter comments.
6. Click Apply.

1. Click Projects> All Projects.
2. Click Add New.
3. Enter a Project Name to identify the project throughout the application. This name must be unique among projects.
4. (Optional) Enter a description.
5. Select an OU to add the project to.
6. Select at least one user or user group as the project owner.
7. In the Project Spend Plan section, click Add Funding Source.
8. Select the funding source that the project will use.
   • You can add more than one funding source to the project spend plan.
   • There must be a funding source available for every month you want the project to operate.
   • You can use more than one funding source in a given month.
   • You can drag and drop the funding sources to prioritize the order in which they are used.
9. Select the start and end months during which the project can use the funding source. Funding sources can only be set on month boundaries since cloud accounts generally finalize spend once a month.
10. In the Planned Amount field, enter the dollar amount available to the project.
11. Click Create Project.

1. In the left navigation menu, click Projects > All Projects.
2. Click the name of the project to which you would like to add a financial enforcement action.
3. Click the Enforcements tab.
4. Click Add.
5. Select Project to apply an enforcement based on the project as a whole, or Service to apply an enforcement based on the value of a single cloud service.
6. Select a timeframe to determine the length of time that is taken into account by the enforcement.
7. If you selected Enforcement Type: Service, select the Service to monitor.
8.  If you selected Enforcement Type: Project, choose what to monitor:
   • Spend. The dollar amount that has been spent in the selected timeframe.
   • Remaining. The dollar amount that is remaining for the selected timeframe.
   • Spend rate. The percentage of money being spent compared to the planned rate established in the project spend plan.
9. In the Amount dropdown, enter a specific amount to use as a threshold, or select Last month's spend to use the total spend for the previous month.
10. Under Events, select a cloud rule to run when the enforcement is triggered.
11. Set the Overburn toggle to ON to add a badge to the OU when the trigger's conditions are met.
12. Select any users and user groups to notify when the enforcement is triggered.
13. (Optional) Enter a description.
14. Click Save. 

Accounts can be added to Kion in a few places:

• Accounts > All Accounts. Navigate to Accounts > All Accounts and click Add. Select whether you want to add new accounts or existing accounts. This brings up the account wizard.
• The Accounts tab of a project. Navigate to the project details page of the project you want to add the account to. Select the Accounts tab and click Add. Select whether you want to add new accounts or existing accounts. This brings up the account wizard.
• The Quick Connect menu. The Quick Connect button is always available at the top of your screen next to the global search. Click the Quick Connect button. Click Accounts. Select whether you want to add new accounts or external accounts. This brings up the account wizard.

To add an account:

1. Navigate to the account wizard using one of the methods above.
2. Select Amazon Web Services.
3. Select AWS GovCloud.
4. Select whether you want to add one account or multiple accounts.
5. Select the billing source for the account.
6. The account wizard will walk you through the remaining steps that are specific to the type of account you are adding. Below are some recommended configurations:
   • Skip account access checking. Enable this if you don't want Kion to verify the role is available. This allows you to preload accounts without having access to them.
   • Add to cache or add to existing project. Add accounts to the Account Cache if you want to preload your accounts and attach them to projects later on.
   • Linked Role. Leave this as OrganizationAccountAccessRole unless you changed the organization role during initial AWS account creation.
   • Include spend from linked GovCloud/Commercial account. Enable this to include the spend data from a linked GovCloud or commercial account. This lets you create combined financial reports without adding the linked account directly to Kion. For more information, see Reporting AWS GovCloud Spend.
   • Sync account information with AWS Organizations. Enable this if you would like to keep the account name and account email updated with those specified in AWS Organizations. You need to ensure the IAM role in the management account has access to Organizations for this to work properly.
   • Add to AWS Organizational Unit. Enable this to add the account to an existing or new AWS organizational unit. This won't affect the account's placement within Kion OUs.

1. Navigate to Settings > System Settings.
2. Expand the AWS Settings section and select Import AWS Policies.
3. Select Customer Managed IAM Policies.
4. Click Import Policies.
5. Select the account to import the IAM policies from.
6. Enable the option to Replace Partition and Account IDs with Application Variables. This replaces any account IDs and partitions found within the IAM policy's text with application variables (i.e., {{CT::AWSAccountId}} and {{CT::AWSPartition}}). This ensures that policies that are account-specific or partition-specific in AWS can be applied across resources in Kion.
7. Click Import.

This process may take a minute or two. Leaving the page will not prevent the policies from loading. Kion will notify you when the import is complete.

1. In the left navigation menu, click Projects > All Projects.
2. Click the name of the project to which you will add a cloud access role.
3. Click the Cloud Management tab.
4. Click the Cloud Access Roles subtab.
5. Click Add.
6. In the Cloud Access Role Name field, enter a name to identify it on the project.
7. In the Access Type dropdown, select one or more types of access you wish to grant. The options are:
   • Web Access. Provides the user access to log in to the cloud console/portal.
   • Short Term Access Key. Provides the user the ability to generate temporary access keys that expire after a certain period of time.
   • Long Term Access Key. Provides the user the ability to generate long-term access keys that may or may not expire depending on the settings defined at a global level. No matter the settings at the global level, if the user is disabled, the LTAKs will be disabled as well.
8. Select the users and groups that will have access to use this role.
9. Select an account to apply the role to.
10. (Optional) Check the Also apply to all future accounts to automatically apply this cloud access role to accounts that are added to this project in the future.
11. Enter the name of the AWS IAM role that will be created in the AWS accounts attached to the project.
    This is the name of the role that displays in the top right of the AWS console. It displays as: rolename/username. Any value in the gray box is a prefix that is set at the global level and cannot be edited here. For information on changing this prefix, see AWS Access.
12. Select AWS IAM policies to associate with this role. These allow console access for AWS.
13. Select AWS permissions boundaries to associate with this role.