Skip to main content

Connect AWS to Spotto (Preview): Choose a Path

AWS support is in preview

Spotto enables AWS for a company on request. During the preview, Spotto only reads from AWS. It never changes resources, buys commitments or reads secret values. AWS counts two of the role's actions as writes, generating an IAM credential report and starting a Savings Plans recommendation calculation, but neither changes your resources. Contact us to join the preview.

Spotto connects to AWS by assuming a read-only IAM role, SpottoReadOnlyRole, that you create in each AWS account you want analysed. The role trusts Spotto only when Spotto presents your company's External ID. You never create access keys or share credentials with Spotto.

Two ways in: a Portal user adds the accounts in Spotto and downloads the files, or an AWS administrator without Portal access sends Spotto their details and receives setup files. Then choose how to deploy the role: CloudFormation (simplest, a template uploaded in the AWS console), the Bash or PowerShell wizard (up to 100 accounts in one run), Terraform (one module per account), or manual IAM (allows a custom role name). All paths create the same read-only SpottoReadOnlyRole trusting your External ID. Spotto then validates each account and starts its first scan.Two ways in: a Portal user adds the accounts in Spotto and downloads the files, or an AWS administrator without Portal access sends Spotto their details and receives setup files. Then choose how to deploy the role: CloudFormation (simplest, a template uploaded in the AWS console), the Bash or PowerShell wizard (up to 100 accounts in one run), Terraform (one module per account), or manual IAM (allows a custom role name). All paths create the same read-only SpottoReadOnlyRole trusting your External ID. Spotto then validates each account and starts its first scan.

The setup is the same for one account or a whole organization; you just deploy the role more times. A company can connect up to 25 organizations or standalone accounts, with up to 100 accounts in each organization and 250 AWS accounts in total. Only the commercial AWS partition is supported, not AWS GovCloud (US) or the AWS China Regions.

Choose How To Get Started​

You areStart here
A Portal user (company admin or MSP) with AWS enabled for your companyConfigure AWS accounts in Spotto. You add the accounts in the Portal, deploy the roles, then select Create.
An AWS administrator working with the Spotto team, without Portal access yetAWS setup for your AWS administrator. You send Spotto a few details, deploy what Spotto sends back, and Spotto connects the accounts for you.

Choose How To Deploy The Role​

Recommended: for one standalone account, use CloudFormation. For an organization, use the Bash or PowerShell wizard. If you manage IAM as code, use Terraform.

MethodBest forGet it
CloudFormation templateStandalone accounts and small organizations. No local tools needed.A template for each account, downloaded from Spotto or included in your setup files. See step 1.
Bash wizardOrganizations with several accounts, Linux, macOS and the default AWS CloudShell Bash session. Up to 100 accounts in one run.Get the Bash script and its README. It uses the same setup package and results format.
PowerShell wizardOrganizations with several accounts. Up to 100 accounts in one run, locally or in AWS CloudShell.Get the script and its README. It needs the setup package from Spotto.
Terraform moduleTeams that manage IAM as code. One module instance per account.Get the module. It needs the same setup package.
Manual IAM setupCustom role names or paths, or strict change processesRole instructions from Spotto, with the exact trust policy and policies.

None of these methods create AWS accounts, billing exports, S3 buckets or security services. They only create or update the IAM role.

What Spotto Needs From You​

ItemRequiredWhat it is
The role in each accountYesSpottoReadOnlyRole with the trust policy and permissions Spotto generates for your company. See what the role can read.
The list of accountsYesThe 12-digit account IDs to connect. For an organization, also the organization ID and the management account, which must be one of the connected accounts. Spotto does not discover organization accounts automatically.
A billing exportNo, but recommendedAn existing AWS Data Export (CUR 2.0) or legacy Cost and Usage Report in S3. Without it, Spotto shows resources, security and recommendations but no cost data. See AWS billing exports.
Commitments planningNoExtra Cost Explorer, Savings Plans and Reserved Instance reads, usually on the management account, for organization commitments planning.

Standalone Account Or Organization​

An AWS organization is a management account plus member accounts, and every account you include gets a role. Most companies connect this way. A standalone account is one AWS account on its own, so one role does everything. Each role contains the same discovery policies, plus billing or commitments access only where that account needs it. See what each account's role contains.

The billing export is often defined in the management account but delivered to a bucket in a separate billing or data account. You choose which of the included accounts defines the export and which one stores it. Two of the billing fields sound alike: the export definition account is where the Data Export is set up, and its role reads the export's settings; the billing payer account is whose bill the export covers, used only to label costs, so it needs no access. In most organizations both are the management account. A dedicated billing account is scanned like any other account.

You can also exclude organization accounts on purpose, such as sandbox or log archive accounts, and record why.

How Spotto Reads Your AWS Data​

Spotto has no agent or network connection in your environment. It calls the same public AWS APIs you would, signed with the role's temporary credentials:

Your AWS accounts on the left, Spotto, hosted in Microsoft Azure, on the right. Every connected account has SpottoReadOnlyRole for read-only resource, configuration and security calls; the management account's role also reads the Data Export definition and commitments data; the billing storage account keeps its S3 bucket private and its role can only list and read the export folder. 1 Spotto's AWS identity, an IAM identity in Spotto's own AWS account and the only principal your roles trust, assumes the role with your External ID. 2 AWS returns temporary credentials, valid for an hour. 3 The Spotto engine makes signed, read-only HTTPS calls to AWS APIs and S3, stores the results in Spotto's Azure storage, and the portal shows costs, recommendations and security. Your bucket stays private with S3 Block Public Access on; traffic is encrypted and outbound only, with no VPN, PrivateLink, agents or inbound ports; and deleting the role or its stack stops access.Your AWS accounts on the left, Spotto, hosted in Microsoft Azure, on the right. Every connected account has SpottoReadOnlyRole for read-only resource, configuration and security calls; the management account's role also reads the Data Export definition and commitments data; the billing storage account keeps its S3 bucket private and its role can only list and read the export folder. 1 Spotto's AWS identity, an IAM identity in Spotto's own AWS account and the only principal your roles trust, assumes the role with your External ID. 2 AWS returns temporary credentials, valid for an hour. 3 The Spotto engine makes signed, read-only HTTPS calls to AWS APIs and S3, stores the results in Spotto's Azure storage, and the portal shows costs, recommendations and security. Your bucket stays private with S3 Block Public Access on; traffic is encrypted and outbound only, with no VPN, PrivateLink, agents or inbound ports; and deleting the role or its stack stops access.

The billing bucket never needs to be public: Spotto reads it with the S3 API (ListObjectsV2 and GetObject) as your storage account's role. Two bucket policy patterns do block it, because Spotto connects from outside your network: a policy that only allows requests through your VPC endpoints (aws:SourceVpce), or only from listed IP ranges (aws:SourceIp). Exempt the storage account's SpottoReadOnlyRole ARN from those conditions. A policy that denies requests without HTTPS (aws:SecureTransport) is fine.

What Happens After You Connect​

Spotto proves each role, checks each billing export, then scans every account whose role works. See create and check the status for the full sequence.

Resources, recommendations and security evidence appear when each account's first scan completes. Large organizations take longer. A new export can take up to 24 hours to deliver its first files. After that, Spotto refreshes AWS data automatically.

Some data depends on AWS services you control:

  • Security score: requires Security Hub CSPM with a standard enabled and AWS Config recording. GuardDuty and Inspector findings appear when those services are enabled. See AWS security access.
  • Recommendations: Trusted Advisor checks and AWS Health events need a paid AWS Support plan with API access, such as Business Support+ or Enterprise Support, or a legacy Business or Enterprise On-Ramp plan until it retires. Compute Optimizer and Cost Optimization Hub need to be opted in. Spotto's own rules work without them.