Be a CAM Administrator or have the appropriate permissions to perform all steps.
An AWS user account with
Admin/Co-Admin
access.
The billing account number is where CUR data is generated.
The Sub Account number(s) that will provide resource metrics.
An S3 bucket for CUR reports and an accessible path.
Details for creating the IAM Service Principal: Access Key ID and Secret Access Key.

Ensure Permissions:
Make sure you have Admin or Co-Admin access to the AWS service account where the billing account resides.
Create the Assume Role:
Navigate to IAM in AWS Console:
Log in to your AWS Management Console.
Navigate to the IAM (Identity and Access Management) section.
Create a New Role:
Click on "
Roles
" in the IAM dashboard.
Click "
Create role.
"
Select Trusted Entity:
Choose "Another AWS account" as the type of trusted entity.
Enter the Account ID of the CAM service account that will assume this role.
Set Permissions:
Attach the necessary permissions policies to the role. For example:
AmazonS3ReadOnlyAccess to read S3 buckets.
ReadOnlyAccess
to view billing data.
Optionally, add custom policies as needed to meet specific requirements.
Add Trust Relationship:
Define the trust relationship to allow the CAM service account to assume this role.
Example JSON for trust policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
    "AWS": "arn:aws:iam::<CAM Account ID>:root"
},
"Action": "sts:AssumeRole"
}
]
}
Replace
<CAM Account ID>
with the actual account ID of the CAM service account.
Review and Create Role:
Review the settings and trust relationships.
Click "
Create role
."
Capture Role ARN:
After creating the role, capture the Amazon Resource Name (ARN) of the role. This ARN will be used to configure the trust policy and for onboarding the billing account into CAM.

Navigate to IAM and Create Role:
Log in to AWS Management Console.
Go to
IAM
>
Roles
>
Create role.
Select "
Another AWS account
" and input CAM's Account ID.
Set Permissions:
Attach
AmazonS3ReadOnlyAccess
and
ReadOnlyAccess
.
Add any additional policies needed.
Create Trust Policy:
Go to the newly created role.

Select the "

Trust relationships

" tab.

Click "

Edit trust relationship

."

Add the following policy (replace

<CAM Account ID>

):

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
 "AWS": "arn:aws:iam::<CAM Account ID>:root"
},
"Action": "sts:AssumeRole"
}
]
}
Review and Finalize:

Review all settings and policies.
Click "
Create role
."
Copy the Role ARN for future use.
For more detailed guidance, refer to AWS and Kyndryl documentation:
AWS IAM Roles Documentation
Kyndryl CAM Onboarding Accounts.

Log in to AWS Management Console:
Navigate to the AWS Management Console.
Ensure you have the necessary permissions to enable Cost and Usage Reports.

Access the Billing Dashboard:
In the AWS Management Console, go to the Billing and Cost Management Dashboard.
Select "
Cost & Usage Reports"
from the left-hand navigation pane.
Create a New Report:
Click "
Create report
."
Enter a report name that is meaningful and easy to identify.
For the Report Content, ensure that "Include resource IDs" is selected. This option provides detailed information on the usage data.
Configure Report Data:
Define the time granularity for the report (daily, hourly).
Set the report versioning to "Overwrite existing report" to keep the latest data.
Choose "
GZIP
" compression for efficient storage.
Set Delivery Options:
Choose an S3 bucket where the CUR will be delivered. You can create a new S3 bucket if one does not exist.
Set the prefix for the report path within the S3 bucket to organize the reports effectively.
Ensure the S3 bucket permissions allow access from the IAM role used by CAM.
Review and Complete:
Review the settings and configurations.
Click "
Review and complete
" to finish the setup.
AWS will start generating the Cost and Usage Reports based on the specified configuration.

{
"ReportName": "KyndrylCAM_CostUsageReport",
"TimeUnit": "DAILY",
"Format": "textORcsv",
"Compression": "GZIP",
"AdditionalSchemaElements": [
  "RESOURCES".  
],
"S3Bucket": "my-cur-bucket",
"S3Prefix": "cost-usage-reports/",
"S3Region": "us-east-1",
"ReportVersioning": "OVERWRITE_REPORT"
}

 

Set Up IAM Role for Access:
Ensure the IAM role used by CAM has the necessary permissions to read from the S3 bucket where the CUR is stored.

Attach the following policy to the IAM role:

{  
"Version": "2012-10-17",
"Statement": [
  {
    "Effect": "Allow",
    "Action": [
        "s3:GetObject",
        "s3:ListBucket"
    ],
     "Resource": [
        "arn:aws:s3:::my-cur-bucket",
        "arn:aws:s3:::my-cur-bucket/*"  
     ]  
  }  
]
}
Integrate with Kyndryl CAM
:

Log in to the Kyndryl CAM Console.
Open the menu and select IAM under the Admin tab.
Click on the "
Add New
" button and select "
Add Connection
" from the dropdown menu.

Enter the required connection name.
Select "
Cloud Provider
" from the "
Select Technology Category
" dropdown.
Select "
AWS
" from the "
Select Connection Type
" dropdown.

Switch on the toggle button labeled "Select here if you use this connection for Billing Data."
Fill in the connection configuration details:
Cost and Usage Report Path:
Enter the path for the Cost and Usage Report.
Account Number:
Enter the AWS Account Number.
S3 Storage:
Enter the S3 Bucket name.
In the Credential Details section, enter the following:

Access Key:
Enter the Access Key ID. Enter the Secret Access Key.
Secret Key:

Click on "
Test Connection
" to ensure the credentials are valid.

Click on the "
Add
" button.
The onboarded provider account will be listed on the connection page.

Log in to the Kyndryl CAM Console.
Open the menu and select IAM under the Admin tab.
Click on the "
Add New
" button and select "
Add Connection
" from the dropdown menu.

Enter the required connection name.
Select "
Cloud Provider
" from the "
Select Technology Category
" dropdown.
Select "
AWS
" from the "
Select Connection Type
" dropdown.

Do
not
switch on the toggle button for "Select here if you use this connection for Billing Data."
Fill in the connection configuration details:
Account Number:
Enter the AWS Account Number.
S3 Storage:
Enter the S3 Bucket name.
In the Credential Details section, enter the following:
Access Key:
Enter the Access Key ID.
Secret Key:
Enter the Secret Access Key.
Click on "
Test Connection
" to ensure the credentials are valid.

Click on the "
Add
" button.
The onboarded provider account will be listed on the connection page.