[{"data":1,"prerenderedAt":883},["ShallowReactive",2],{"docs-page-en-\u002Fdocs\u002Faws-setup":3,"docs-navigation-en":780,"docs-surround-en-\u002Fdocs\u002Faws-setup":878},{"id":4,"title":5,"body":6,"claimDependencies":763,"description":12,"extension":767,"locale":768,"meta":769,"missingMedia":770,"navigation":147,"owner":771,"path":772,"reviewStatus":773,"seo":774,"staleLinks":775,"stem":776,"technicalRisk":777,"translationKey":778,"__hash__":779},"docs_en\u002Fdocs\u002F2.aws-setup.md","AWS Setup Guide",{"type":7,"value":8,"toc":743},"minimark",[9,13,18,21,55,59,66,84,88,93,96,101,106,109,113,116,195,201,205,477,481,484,489,527,532,549,552,556,559,586,590,593,604,607,611,615,623,627,635,639,642,650,654,658,663,676,681,692,697,705,709,712,736,739],[10,11,12],"p",{},"This guide will walk you through connecting your AWS account to Jetscale securely using IAM role-based access.",[14,15,17],"h2",{"id":16},"prerequisites","Prerequisites",[10,19,20],{},"Before starting, ensure you have:",[22,23,24,39,49],"ol",{},[25,26,27,31,32],"li",{},[28,29,30],"strong",{},"Enabled AWS Cost Optimization Hub","\nFollow the ",[33,34,38],"a",{"href":35,"rel":36},"https:\u002F\u002Faws.amazon.com\u002Faws-cost-management\u002Fcost-optimization-hub\u002Fgetting-started\u002F",[37],"nofollow","AWS Cost Optimization Hub Getting Started Guide",[25,40,41,31,44],{},[28,42,43],{},"Enabled AWS Compute Optimizer",[33,45,48],{"href":46,"rel":47},"https:\u002F\u002Faws.amazon.com\u002Fcompute-optimizer\u002Fgetting-started\u002F#topic-0",[37],"AWS Compute Optimizer Getting Started Guide",[25,50,51,54],{},[28,52,53],{},"AWS Account Administrator Access","\nYou'll need permissions to create IAM roles and policies",[14,56,58],{"id":57},"overview","Overview",[10,60,61,62,65],{},"Jetscale connects to your AWS account using a ",[28,63,64],{},"cross-account IAM role"," with read-only permissions. This approach:",[67,68,69,72,75,78,81],"ul",{},[25,70,71],{},"Does not require AWS access keys or passwords",[25,73,74],{},"Provides secure, auditable access via AWS STS (Security Token Service)",[25,76,77],{},"Uses External ID for additional security against confused deputy attacks",[25,79,80],{},"Can be revoked instantly by deleting the IAM role",[25,82,83],{},"Follows AWS security best practices",[14,85,87],{"id":86},"setup-process","Setup Process",[89,90,92],"h3",{"id":91},"step-1-generate-an-external-id","Step 1: Generate an External ID",[10,94,95],{},"The External ID is a unique identifier that adds an extra layer of security to the cross-account role assumption.",[10,97,98],{},[28,99,100],{},"You have two options:",[102,103,105],"h4",{"id":104},"option-a-we-generate-it-for-you-recommended","Option A: We Generate It For You (Recommended)",[10,107,108],{},"Jetscale will generate a secure External ID and share it with you during onboarding.",[102,110,112],{"id":111},"option-b-you-generate-it","Option B: You Generate It",[10,114,115],{},"If you prefer to generate your own External ID, use one of these methods:",[117,118,123],"pre",{"className":119,"code":120,"language":121,"meta":122,"style":122},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Generate a UUID (most common)\nuuidgen\n\n# Generate random hex string\nopenssl rand -hex 32\n\n# Generate base64 encoded random string\nopenssl rand -base64 32\n","bash","",[124,125,126,135,142,149,155,172,177,183],"code",{"__ignoreMap":122},[127,128,131],"span",{"class":129,"line":130},"line",1,[127,132,134],{"class":133},"sHwdD","# Generate a UUID (most common)\n",[127,136,138],{"class":129,"line":137},2,[127,139,141],{"class":140},"sBMFI","uuidgen\n",[127,143,145],{"class":129,"line":144},3,[127,146,148],{"emptyLinePlaceholder":147},true,"\n",[127,150,152],{"class":129,"line":151},4,[127,153,154],{"class":133},"# Generate random hex string\n",[127,156,158,161,165,168],{"class":129,"line":157},5,[127,159,160],{"class":140},"openssl",[127,162,164],{"class":163},"sfazB"," rand",[127,166,167],{"class":163}," -hex",[127,169,171],{"class":170},"sbssI"," 32\n",[127,173,175],{"class":129,"line":174},6,[127,176,148],{"emptyLinePlaceholder":147},[127,178,180],{"class":129,"line":179},7,[127,181,182],{"class":133},"# Generate base64 encoded random string\n",[127,184,186,188,190,193],{"class":129,"line":185},8,[127,187,160],{"class":140},[127,189,164],{"class":163},[127,191,192],{"class":163}," -base64",[127,194,171],{"class":170},[10,196,197,200],{},[28,198,199],{},"Security Note:"," If you generate your own External ID, please share it with us via encrypted email. Share the decryption password through a separate communication channel.",[89,202,204],{"id":203},"step-2-create-the-iam-role","Step 2: Create the IAM Role",[22,206,207,213,233,460],{},[25,208,209,212],{},[28,210,211],{},"Navigate to IAM Console","\nGo to AWS Console → IAM → Roles → Create Role",[25,214,215,218],{},[28,216,217],{},"Select Trusted Entity",[67,219,220,223,226],{},[25,221,222],{},"Choose \"AWS account\"",[25,224,225],{},"Select \"Another AWS account\"",[25,227,228,229,232],{},"Enter the ",[28,230,231],{},"Jetscale Account ID"," (provided by Jetscale team)",[25,234,235,238,241,242],{},[28,236,237],{},"Configure Trust Policy",[239,240],"br",{},"Add the External ID to your trust relationship:",[117,243,247],{"className":244,"code":245,"language":246,"meta":122,"style":122},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"arn:aws:iam::[JETSCALE_ACCOUNT_ID]:root\"\n      },\n      \"Action\": \"sts:AssumeRole\",\n      \"Condition\": {\n        \"StringEquals\": {\n          \"sts:ExternalId\": \"[YOUR_UNIQUE_EXTERNAL_ID]\"\n        }\n      }\n    }\n  ]\n}\n","json",[124,248,249,255,281,295,300,321,335,355,360,381,395,409,430,436,442,448,454],{"__ignoreMap":122},[127,250,251],{"class":129,"line":130},[127,252,254],{"class":253},"sMK4o","{\n",[127,256,257,260,264,267,270,273,276,278],{"class":129,"line":137},[127,258,259],{"class":253},"  \"",[127,261,263],{"class":262},"spNyl","Version",[127,265,266],{"class":253},"\"",[127,268,269],{"class":253},":",[127,271,272],{"class":253}," \"",[127,274,275],{"class":163},"2012-10-17",[127,277,266],{"class":253},[127,279,280],{"class":253},",\n",[127,282,283,285,288,290,292],{"class":129,"line":144},[127,284,259],{"class":253},[127,286,287],{"class":262},"Statement",[127,289,266],{"class":253},[127,291,269],{"class":253},[127,293,294],{"class":253}," [\n",[127,296,297],{"class":129,"line":151},[127,298,299],{"class":253},"    {\n",[127,301,302,305,308,310,312,314,317,319],{"class":129,"line":157},[127,303,304],{"class":253},"      \"",[127,306,307],{"class":140},"Effect",[127,309,266],{"class":253},[127,311,269],{"class":253},[127,313,272],{"class":253},[127,315,316],{"class":163},"Allow",[127,318,266],{"class":253},[127,320,280],{"class":253},[127,322,323,325,328,330,332],{"class":129,"line":174},[127,324,304],{"class":253},[127,326,327],{"class":140},"Principal",[127,329,266],{"class":253},[127,331,269],{"class":253},[127,333,334],{"class":253}," {\n",[127,336,337,340,343,345,347,349,352],{"class":129,"line":179},[127,338,339],{"class":253},"        \"",[127,341,342],{"class":170},"AWS",[127,344,266],{"class":253},[127,346,269],{"class":253},[127,348,272],{"class":253},[127,350,351],{"class":163},"arn:aws:iam::[JETSCALE_ACCOUNT_ID]:root",[127,353,354],{"class":253},"\"\n",[127,356,357],{"class":129,"line":185},[127,358,359],{"class":253},"      },\n",[127,361,363,365,368,370,372,374,377,379],{"class":129,"line":362},9,[127,364,304],{"class":253},[127,366,367],{"class":140},"Action",[127,369,266],{"class":253},[127,371,269],{"class":253},[127,373,272],{"class":253},[127,375,376],{"class":163},"sts:AssumeRole",[127,378,266],{"class":253},[127,380,280],{"class":253},[127,382,384,386,389,391,393],{"class":129,"line":383},10,[127,385,304],{"class":253},[127,387,388],{"class":140},"Condition",[127,390,266],{"class":253},[127,392,269],{"class":253},[127,394,334],{"class":253},[127,396,398,400,403,405,407],{"class":129,"line":397},11,[127,399,339],{"class":253},[127,401,402],{"class":170},"StringEquals",[127,404,266],{"class":253},[127,406,269],{"class":253},[127,408,334],{"class":253},[127,410,412,415,419,421,423,425,428],{"class":129,"line":411},12,[127,413,414],{"class":253},"          \"",[127,416,418],{"class":417},"swJcz","sts:ExternalId",[127,420,266],{"class":253},[127,422,269],{"class":253},[127,424,272],{"class":253},[127,426,427],{"class":163},"[YOUR_UNIQUE_EXTERNAL_ID]",[127,429,354],{"class":253},[127,431,433],{"class":129,"line":432},13,[127,434,435],{"class":253},"        }\n",[127,437,439],{"class":129,"line":438},14,[127,440,441],{"class":253},"      }\n",[127,443,445],{"class":129,"line":444},15,[127,446,447],{"class":253},"    }\n",[127,449,451],{"class":129,"line":450},16,[127,452,453],{"class":253},"  ]\n",[127,455,457],{"class":129,"line":456},17,[127,458,459],{"class":253},"}\n",[25,461,462,465],{},[28,463,464],{},"Name Your Role",[67,466,467,474],{},[25,468,469,470,473],{},"Role name: ",[124,471,472],{},"jetscale-readonly-access"," (or your preferred name)",[25,475,476],{},"Description: \"Jetscale read-only access for cost optimization\"",[89,478,480],{"id":479},"step-3-attach-permissions","Step 3: Attach Permissions",[10,482,483],{},"Jetscale requires read-only access to analyze your infrastructure and costs. The permissions policy includes:",[10,485,486],{},[28,487,488],{},"Core Services:",[67,490,491,497,503,509,515,521],{},[25,492,493,496],{},[28,494,495],{},"Cost Management",": Cost Explorer, Cost Optimization Hub, Compute Optimizer",[25,498,499,502],{},[28,500,501],{},"EC2",": Instance metadata, volumes, pricing information",[25,504,505,508],{},[28,506,507],{},"RDS",": Database instances, clusters, and configuration",[25,510,511,514],{},[28,512,513],{},"S3",": Bucket information and analytics",[25,516,517,520],{},[28,518,519],{},"ElastiCache",": Cache cluster information",[25,522,523,526],{},[28,524,525],{},"CloudWatch",": Metrics and monitoring data",[10,528,529],{},[28,530,531],{},"Security Considerations:",[67,533,534,537,540,543,546],{},[25,535,536],{},"All permissions are read-only (Describe, Get, List actions only)",[25,538,539],{},"No write, modify, or delete permissions",[25,541,542],{},"No access to actual data stored in databases or S3 buckets",[25,544,545],{},"No access to secrets or credentials",[25,547,548],{},"Limited to metadata and configuration information",[10,550,551],{},"During onboarding, the Jetscale team will provide the complete IAM policy document and help validate permissions.",[89,553,555],{"id":554},"step-4-share-role-arn","Step 4: Share Role ARN",[10,557,558],{},"Once the role is created:",[22,560,561,572],{},[25,562,563,564,567,568,571],{},"Copy the ",[28,565,566],{},"Role ARN"," (format: ",[124,569,570],{},"arn:aws:iam::123456789012:role\u002Fjetscale-readonly-access",")",[25,573,574,575],{},"Share it with your Jetscale contact along with:\n",[67,576,577,580,583],{},[25,578,579],{},"AWS Account ID",[25,581,582],{},"External ID (if you generated it yourself)",[25,584,585],{},"AWS Region (if you want to limit scope)",[14,587,589],{"id":588},"validation","Validation",[10,591,592],{},"The Jetscale team will validate the connection during onboarding by:",[22,594,595,598,601],{},[25,596,597],{},"Attempting to assume the role",[25,599,600],{},"Running read-only queries against key services",[25,602,603],{},"Confirming data access for cost analysis",[10,605,606],{},"If any permissions are missing, we'll work with you to resolve them before proceeding.",[14,608,610],{"id":609},"security-best-practices","Security Best Practices",[89,612,614],{"id":613},"regular-reviews","Regular Reviews",[67,616,617,620],{},[25,618,619],{},"Review CloudTrail logs periodically to audit Jetscale's API calls",[25,621,622],{},"Set up CloudWatch alarms for unusual activity",[89,624,626],{"id":625},"least-privilege","Least Privilege",[67,628,629,632],{},[25,630,631],{},"The provided policy follows AWS least-privilege principles",[25,633,634],{},"Request permission adjustments if your security policy requires it",[89,636,638],{"id":637},"role-expiration-optional","Role Expiration (Optional)",[10,640,641],{},"Consider adding a maximum session duration to the role:",[67,643,644,647],{},[25,645,646],{},"Recommended: 12 hours",[25,648,649],{},"This limits the validity of assumed credentials",[14,651,653],{"id":652},"troubleshooting","Troubleshooting",[89,655,657],{"id":656},"common-issues","Common Issues",[10,659,660],{},[28,661,662],{},"\"Access Denied\" errors during validation:",[67,664,665,668,671],{},[25,666,667],{},"Verify the External ID matches exactly",[25,669,670],{},"Confirm the Jetscale Account ID is correct",[25,672,673,674],{},"Check that the role's trust policy allows ",[124,675,376],{},[10,677,678],{},[28,679,680],{},"Missing cost data:",[67,682,683,686,689],{},[25,684,685],{},"Ensure Cost Explorer is enabled (24-hour activation period)",[25,687,688],{},"Confirm Cost Optimization Hub is enabled",[25,690,691],{},"Verify Compute Optimizer has opt-in status",[10,693,694],{},[28,695,696],{},"Regional access issues:",[67,698,699,702],{},[25,700,701],{},"Jetscale analyzes resources across all enabled regions",[25,703,704],{},"Ensure the role is global (not region-specific)",[14,706,708],{"id":707},"support","Support",[10,710,711],{},"Need help with AWS setup?",[67,713,714,724,730],{},[25,715,716,719,720],{},[28,717,718],{},"Email",": ",[33,721,723],{"href":722},"mailto:support@jetscale.ai","support@jetscale.ai",[25,725,726,729],{},[28,727,728],{},"Setup Calls",": Available for hands-on guidance",[25,731,732,735],{},[28,733,734],{},"Documentation",": Detailed permission requirements provided during onboarding",[10,737,738],{},"All permission issues will be resolved during the validation process. We're here to help!",[740,741,742],"style",{},"html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}",{"title":122,"searchDepth":137,"depth":137,"links":744},[745,746,747,753,754,759,762],{"id":16,"depth":137,"text":17},{"id":57,"depth":137,"text":58},{"id":86,"depth":137,"text":87,"children":748},[749,750,751,752],{"id":91,"depth":144,"text":92},{"id":203,"depth":144,"text":204},{"id":479,"depth":144,"text":480},{"id":554,"depth":144,"text":555},{"id":588,"depth":137,"text":589},{"id":609,"depth":137,"text":610,"children":755},[756,757,758],{"id":613,"depth":144,"text":614},{"id":625,"depth":144,"text":626},{"id":637,"depth":144,"text":638},{"id":652,"depth":137,"text":653,"children":760},[761],{"id":656,"depth":144,"text":657},{"id":707,"depth":137,"text":708},[764,765,766],"cloud-access-model","product-capabilities","security-model","md","en",{},[],"Cloud Platform","\u002Fdocs\u002Faws-setup","legacy-import",{"title":5,"description":12},[],"docs\u002F2.aws-setup","high","aws-setup","X99mRiKG_r5OznLpPxgd0MINWyLAIla5abwPnf7b6T4",[781],{"title":782,"path":783,"stem":784,"children":785,"page":-1},"Docs","\u002Fdocs","docs",[786,789,793,794,798,802,824,828,866,870,874],{"title":787,"path":783,"stem":788},"Jetscale Documentation","docs\u002Findex",{"title":790,"path":791,"stem":792},"Getting Started with Jetscale","\u002Fdocs\u002Fgetting-started","docs\u002F1.getting-started",{"title":5,"path":772,"stem":776},{"title":795,"path":796,"stem":797},"Azure Setup Guide","\u002Fdocs\u002Fazure-setup","docs\u002F3.azure-setup",{"title":799,"path":800,"stem":801},"How Jetscale Works","\u002Fdocs\u002Fhow-it-works","docs\u002F4.how-it-works",{"title":803,"path":804,"stem":805,"children":806,"page":-1},"Integrations","\u002Fdocs\u002Fintegrations","docs\u002F4.integrations\u002Findex",[807,808,812,816,820],{"title":803,"path":804,"stem":805},{"title":809,"path":810,"stem":811},"GitHub Integration","\u002Fdocs\u002Fintegrations\u002Fgithub","docs\u002F4.integrations\u002F1.github",{"title":813,"path":814,"stem":815},"Jira Integration","\u002Fdocs\u002Fintegrations\u002Fjira","docs\u002F4.integrations\u002F2.jira",{"title":817,"path":818,"stem":819},"Slack Integration","\u002Fdocs\u002Fintegrations\u002Fslack","docs\u002F4.integrations\u002F3.slack",{"title":821,"path":822,"stem":823},"Bitbucket Integration","\u002Fdocs\u002Fintegrations\u002Fbitbucket","docs\u002F4.integrations\u002F4.bitbucket",{"title":825,"path":826,"stem":827},"AI-Powered Analysis","\u002Fdocs\u002Fai-analysis","docs\u002F5.ai-analysis",{"title":829,"path":830,"stem":831,"children":832,"page":-1},"Supported Services","\u002Fdocs\u002Fservices","docs\u002F5.services\u002Findex",[833,834,838,842,846,850,854,858,862],{"title":829,"path":830,"stem":831},{"title":835,"path":836,"stem":837},"EBS Optimization","\u002Fdocs\u002Fservices\u002Febs","docs\u002F5.services\u002F1.ebs",{"title":839,"path":840,"stem":841},"EC2 Optimization","\u002Fdocs\u002Fservices\u002Fec2","docs\u002F5.services\u002F2.ec2",{"title":843,"path":844,"stem":845},"EKS Optimization","\u002Fdocs\u002Fservices\u002Feks","docs\u002F5.services\u002F3.eks",{"title":847,"path":848,"stem":849},"ElastiCache Optimization","\u002Fdocs\u002Fservices\u002Felasticache","docs\u002F5.services\u002F4.elasticache",{"title":851,"path":852,"stem":853},"RDS Optimization","\u002Fdocs\u002Fservices\u002Frds","docs\u002F5.services\u002F5.rds",{"title":855,"path":856,"stem":857},"S3 Optimization","\u002Fdocs\u002Fservices\u002Fs3","docs\u002F5.services\u002F6.s3",{"title":859,"path":860,"stem":861},"Azure SQL Optimization","\u002Fdocs\u002Fservices\u002Fazure-sql","docs\u002F5.services\u002F7.azure-sql",{"title":863,"path":864,"stem":865},"Azure VM Optimization","\u002Fdocs\u002Fservices\u002Fazure-vm","docs\u002F5.services\u002F8.azure-vm",{"title":867,"path":868,"stem":869},"Recommendation Workflow","\u002Fdocs\u002Frecommendation-workflow","docs\u002F6.recommendation-workflow",{"title":871,"path":872,"stem":873},"API Reference","\u002Fdocs\u002Fapi-reference","docs\u002F7.api-reference",{"title":875,"path":876,"stem":877},"FAQ","\u002Fdocs\u002Ffaq","docs\u002F8.faq",[879,881],{"title":790,"path":791,"stem":792,"description":880,"children":-1},"Start saving on cloud costs in 5 minutes",{"title":795,"path":796,"stem":797,"description":882,"children":-1},"This guide will walk you through connecting your Azure subscription to Jetscale securely using Azure App Registration with service principal authentication.",1788204003184]