AWS

Connect an AWS account on Account → Cloud accounts. Pick AWS, then Add account. Keep that drawer open while you launch the stack.

Koltto signs in as a dedicated IAM user named KolttoReaders. The CloudFormation stack creates that user (read-only), the access keys, and the Cost and Usage Report (CUR) location. Do not paste a root key.

Spend comes from the Cost and Usage Report in your S3 bucket, not from Cost Explorer. That is the same report AWS billing documents: daily files with resource IDs, delivered by AWS into a bucket you own.

One account vs an organization

The stack runs in one AWS account. That is the whole setup if you only have one account — no extra step.

Setup	What this stack covers
One AWS account (no organization, or the only account)	Inventory, CloudWatch metrics, and cost for that account.
AWS Organizations — payer	Same, in the payer. CUR on the payer can include linked-account spend. Inventory and metrics stay in the payer.
Member / child accounts	Do not launch this stack in a member. It does not create IAM there. Linked-account inventory and metrics are not a self-serve step in the portal yet.

organizations:ListAccounts is allowed so Koltto can see the org roster. The payer stack can assume a role named koltto/KolttoReaders in other accounts later; this template does not create that role.

Launch CloudFormation

1. In the add-account drawer, choose Launch CloudFormation in AWS.
2. Create the stack in us-east-1 (CUR report definitions live there). Stack name defaults to KolttoReaders.
3. Parameters:

Parameter	When to use it
CreateCostReport = Yes (default)	New daily CUR with resource IDs, plus bucket koltto-cur-<account-id> and prefix koltto. The stack also lets AWS Billing deliver objects to that bucket.
CreateCostReport = No	You already have a CUR (legacy report or Data Exports in the same bucket). Set ExistingCurBucket and ExistingCurPrefix. The stack only creates IAM. The existing report should include resource IDs.

Both paths are the same template. Copy the stack Outputs when it finishes (AccountId, AccessKeyId, SecretAccessKey, CurS3Bucket, CurPrefix) and paste them into Koltto, then save.

The bucket name is ready when the stack completes. The first CUR file can take up to 24 hours. In the AWS Billing console, Cost and Usage Reports shows the report the stack created (or the existing one you pointed at). Inventory can start as soon as you save; spend stays empty until that file exists and you run Refresh data → Cost.

What the stack grants

Read-only. Koltto cannot create, start, stop, or delete your resources.

Area	In this stack
Inventory	EC2, EBS, EFS, S3, and load balancers.
Metrics	CloudWatch list and get metric data.
Cost	List and read objects in the CUR bucket (new or existing). Not Cost Explorer.
Identity	Caller identity, Organizations list/describe (roster only).

Not included: Cost Explorer APIs, RDS / database inventory, write actions, and IAM in child accounts.

EC2 memory in Inventory only appears if the instance has the CloudWatch agent (or equivalent) publishing memory. CPU, disk, load balancer, and storage metrics do not need that agent.

Fields in the form

Field	What to enter
Name	A label in Koltto (prod-core).
Description	Optional.
Region	Home region for the API, for example us-east-1.
Account ID	12-digit AWS account ID (stack output AccountId).
Access key ID	Stack output AccessKeyId.
Secret access key	Stack output SecretAccessKey. Stored encrypted. You will not see it again.
CUR S3 bucket	Stack output CurS3Bucket. Required.
CUR prefix	Stack output CurPrefix (koltto when the stack created the report). Optional if your existing report has no prefix.

After save

Inventory starts. Run Refresh data → Cost so Overview and Spend Analytics fill — after the first CUR file is in the bucket. Run Metrics if you want Opportunities.

You can edit CUR bucket and prefix later. Access keys cannot be shown again; to rotate them, add a new account and remove the old one.

AWS RDS / database collectors are not in this product yet — database rows on Opportunities are for Oracle Cloud databases.