Can I provide my own Cost and Usage report?

Introduction

ProsperOps reads your hourly AWS Cost and Usage Report (CUR) from an S3 bucket in your management account. By default, ProsperOps creates the report and a dedicated bucket for you when you add your AWS organization. If your policies require you to create and own these resources yourself, you can provide your own report and bucket instead.

When you provide your own, ProsperOps only gets read access. The ProsperOps role can look up the report's settings and read the files AWS delivers under its path, and nothing else in the bucket. It can't create, change or delete the bucket, its policy, its files or the report.

The ProsperOps Console gives you Terraform, CloudFormation and AWS CLI templates that create everything for you, plus AWS Console steps. You can also reuse a report you already have, as long as it meets the requirements below.

Before You Begin

Ask us to turn it on. Providing your own report is available on request. Contact your ProsperOps team or help@prosperops.com to enable it for your account.
Have access to your management account. You'll create an S3 bucket, its bucket policy and a legacy CUR export there, along with the ProsperOps IAM role.
Decide up front. You choose who manages the report when you add your organization, and that choice can't be switched later.

NOTE: Some setups aren't supported yet:

Buckets encrypted with AWS KMS keys (SSE-KMS). Use Amazon S3 managed keys (SSE-S3).
Reports set to Overwrite existing report, including reports integrated with Amazon Athena, Redshift or QuickSight.
Billing views other than Primary, such as AWS Billing Conductor billing groups.
Accounts set up with limited IAM permissions for the Savings Analysis.

Report Requirements

Your report and bucket must match the configuration ProsperOps would create. The templates set all of this for you; check each setting if you're reusing an existing report. Settings are listed as the AWS Console names them under Data Exports.

Report setting	Required value
Export type	Legacy CUR export
Time granularity	Hourly
Additional export content	Include resource IDs only
Compression type	Parquet
Report versioning	Create new report version
Data refresh settings	Refresh automatically
Report data integration	None
Billing view	Primary

AWS doesn't let you change the time granularity, report versioning or resource IDs of an existing report. If any of those differ, create a new report.

Bucket setting	Required value
Owner	Your management account, the account that creates the report
Bucket policy	Lets AWS deliver the report (the templates include it)
Encryption	Amazon S3 managed keys (SSE-S3)
Access	Nothing denies the ProsperOps role, including bucket policies that restrict by IP address or VPC endpoint, service control policies (SCPs) and permission boundaries
Region	Any. We recommend us-east-2, where ProsperOps copies your report, to avoid inter-region data transfer charges.

NOTE: AWS only lets CloudFormation create a report definition in us-east-1, so the CloudFormation template creates its bucket there too. The Terraform and AWS CLI templates put the bucket in us-east-2.

Report and Bucket Names

The ProsperOps Console suggests three names for your organization. Use them as they are, or change them before you create anything.

Name	Suggestion	Notes
Report name	`prosperops-cur-parquet-v2`	Only has to be unique within your management account
S3 bucket name	`prosperops-cur-` followed by your organization's ProsperOps ID	Bucket names are unique across all AWS accounts
S3 path prefix	`prosperops-cur`	AWS delivers the report under this prefix

The ProsperOps role can only read s3://<bucket>/<prefix>/<report name>/, so the IAM policy is built from these names. Each name has to follow these rules:

Report name: up to 256 letters, numbers and ! - _ . ( ), with no spaces.
S3 path prefix: the same characters plus /, with no leading or trailing slash.
S3 bucket name: 3 to 63 lowercase letters, numbers and hyphens, starting and ending with a letter or number. Periods aren't supported, and names can't start with xn--, sthree- or amzn-s3-demo-, or end with -s3alias, --ol-s3, --x-s3 or --table-s3.

NOTE: You can't change these names after your organization is added. Contact us if you need to move your report later.

Adding Your AWS Organization

In the ProsperOps Console, start adding your AWS organization and enter your management account number.
Under Cost and Usage Report, choose I'll provide my own. The console lists the settings your report and bucket need.
On the Configure Access step, review the suggested Report name, S3 bucket name and S3 path prefix. To use other names, edit them and click Update templates. The templates and IAM policy are rebuilt for the new names.
Create the report and bucket with one of the tabs:
- Terraform: apply it in the management account. The report definition uses a us-east-1 provider, because the CUR API is only available there.
- CloudFormation: deploy the stack in the management account, in us-east-1.
- AWS CLI: run the commands with credentials for the management account.
- AWS Console: click Create Export, choose Legacy CUR export, and enter the settings and bucket policy shown.
Create the ProsperOps IAM role with the policy shown, the same way as for any organization (see Using the AWS Console to configure ProsperOps access for a Savings Analysis). Its Cost and Usage Report permissions are read-only.
Click Validate Access. ProsperOps checks that the report exists with the required settings, and that the role can read where it's delivered.

Reusing a report you already have? Enter its report name, bucket and prefix in step 3, click Update templates, and skip step 4.

IMPORTANT: If you change the names after creating the role, apply the updated policy to the role before you validate. The policy names your bucket and path.

NOTE: A new report can take up to 24 hours to deliver its first files. You don't need to wait for them: validation passes before the first delivery.

If Validate Access Finds a Problem

Fix what the message describes, then click Validate Access again. If the issue persists, please contact us for assistance.

Message	What it means	What to do
We couldn't find your Cost and Usage Report	There's no legacy CUR export with that exact name in the management account. Report names are case-sensitive.	Check the report name, or create the report with one of the templates.
Your Cost and Usage Report doesn't match the configuration ProsperOps needs	The message lists each setting that differs, with the required value and your report's value. A Report delivery row means AWS can't deliver to the bucket, because of the bucket policy or a missing bucket.	Change those settings. If time granularity, report versioning or resource IDs differ, create a new report.
This account already has a report named …	ProsperOps was set up for this account before, and that report still delivers to the earlier bucket or prefix.	Click Use the existing report to switch to it, apply the updated policy to the role, and validate again. Or change the report name, or delete the old report in AWS.
A list of denied actions	The ProsperOps role can't read the report or its bucket.	Check the role's policy, the bucket policy, and any SCPs or permission boundaries.

NOTE: Use the existing report only appears when ProsperOps can read that report's location. Otherwise, change the report name or delete the old report.

After Your Organization Is Added

ProsperOps never creates, changes or deletes your bucket, its policy, its files or the report. ProsperOps regularly copies new report files into its own storage for analysis.

IMPORTANT: Keep the report, bucket and bucket policy in place, and leave the report's settings as they are. ProsperOps can't use a report that no longer meets the requirements.

If something breaks: ProsperOps keeps running on the data it has already copied, and our team is alerted. Your savings and usage data won't update until the report can be read again.
Retention: ProsperOps only reads the current and previous month, so an S3 lifecycle rule can expire anything older than the previous month.
Full access: When you later update the role for Autonomous Discount Management, its Cost and Usage Report permissions stay read-only.
Moving or renaming: Contact us before you change the report's name, bucket or prefix.