Standard Onboarding

Guides for connecting AWS accounts to Pump, including standard onboarding, multi-account architectures, SSO migration, and management account access.

Connecting AWS

Pump connects to your AWS account using a cross-account IAM role deployed via CloudFormation. The initial connection grants read-only access to your cost and usage data.

Prerequisites

Requirement	Details
AWS account	Active account with billing access
IAM permissions	Ability to create CloudFormation stacks and IAM roles
Pump account	Sign up at app.pump.co and complete email verification

How the connection works

Pump uses AWS's cross-account role pattern. When you deploy the CloudFormation stack, it creates an IAM role in your account that trusts Pump's AWS account. Each connection uses a unique External ID to ensure only Pump can assume the role.

Pump never stores your AWS credentials. Every data request uses temporary STS tokens obtained by assuming the role you created.

Step 1: Deploy the CloudFormation stack and run a savings estimate

This step grants Pump read-only access to your cost and usage data and generates your savings estimate. Nothing is purchased, and no billing relationship is created at this stage.

1. In the Pump onboarding wizard, select Connect AWS.

2. Pump generates a pre-filled CloudFormation Quick-Create URL unique to your account (with your External ID embedded).

3. Click the link to open the AWS Console.

4. Scroll down, check the acknowledgment box, and click Create stack.

5. The stack creates:

   • An IAM role with read-only permissions (see Permissions reference below)

   • A custom resource (Custom::PumpPingResource) that notifies Pump when the stack completes

6. When the stack finishes, Pump is automatically notified and begins pulling your cost data.

7. Pump generates your savings estimate. This typically takes a few minutes.

The estimate shows how much Pump could have saved you based on your historical usage. If the numbers look good and you are interested in onboarding, proceed to Step 2.

Alternative: Estimate from CSV (no permissions required)

If you want to see a savings estimate before granting any AWS access, you can upload Cost Explorer CSVs instead.

1. In the Pump onboarding wizard, select Estimate savings from CSV.

2. In your AWS Console, navigate to Cost Explorer and export two CSV files:

   • Monthly cost data (last 12 months)

   • Daily cost data (last 3 months)

3. Upload both CSV files to Pump.

4. Pump generates your savings estimate within minutes.

The CSV path provides a directional estimate. The CloudFormation path provides a more detailed estimate because Pump can access granular usage data beyond what CSV exports contain. After reviewing a CSV-based estimate, you can proceed to deploy the CloudFormation stack to connect your account.

Alternative: Terraform deployment

If your organization manages infrastructure as code with Terraform, Pump provides a Terraform module as an alternative to CloudFormation. Contact your Pump representative for the module.

Step 2: Standalone vs. Organization

Pump asks whether your AWS account is part of an AWS Organization.

Account type	What happens
Standalone account (not in an Organization)	Self-serve setup continues. You complete the remaining steps in the wizard.
Organization account (member of an AWS Organization)	Pump routes you to book a meeting with the Pump team. Organization setups require coordination with your management account and are handled with a Pump engineer.

Step 3: Authorize Pump as your billing partner

This step transitions Pump from read-only access to billing partner access. Pump becomes the payer account for your AWS usage.

1. In the Pump wizard, review the billing partner agreement.

2. Accept the Terms of Service and Privacy Policy.

3. Pump deploys an updated IAM role with Autopilot permissions (see Permissions reference below). This adds the ability to purchase commitments (Reserved Instances and Savings Plans) on your behalf.

4. Complete your company details and payment method.

After this step, your account is connected. Pump begins managing your commitments and generating savings.

What Pump accesses

Data Pump reads

Data source	What Pump pulls	How it's used
Cost Explorer API	Spend by service, account, region, usage type	Cost visibility, savings calculations, forecasting
Cost and Usage Reports (CUR)	Line-item billing data from S3	RI/SP utilization tracking, detailed cost breakdowns
Organizations API	Account structure, organizational units	Multi-account cost aggregation
EC2/RDS/ElastiCache/Redshift/OpenSearch Describe calls	Instance types, sizes, utilization metadata	Right-sizing recommendations
Compute Optimizer	Resource utilization recommendations	Infrastructure optimization analysis
Pricing API	On-demand and commitment pricing	Savings calculations
Reserved Instance/Savings Plan details	Existing commitments, utilization, coverage	Commitment management and renewal planning

Data Pump never accesses

Pump does not access your application data, infrastructure configurations, S3 bucket contents, IAM users or credentials, CloudWatch logs, or any data outside of billing and resource metadata. Pump cannot create, modify, start, stop, or terminate any AWS resources.

The only write action Pump performs is purchasing commitments (Reserved Instances and Savings Plans) when Autopilot is enabled, and only after you have authorized billing partner access.

Historical data backfill

When you first connect, Pump backfills up to 12 months of historical cost data from Cost Explorer. CUR-based data backfills from the beginning of your account's billing history.

Ongoing data refreshes happen automatically on a rolling basis.

Permissions reference

Read-only role

Deployed during Step 1. Grants visibility into cost and usage data.

Permission group	Actions
Cost Explorer	ce:Get*, ce:List*
Cost and Usage Reports	cur:Describe*, cur:List*
Organizations	organizations:Describe*, organizations:List*
EC2	ec2:DescribeInstances, ec2:DescribeReservedInstances*
RDS	rds:DescribeDBInstances, rds:DescribeReservedDBInstances*
Redshift	redshift:DescribeClusters, redshift:DescribeReservedNodes*
ElastiCache	elasticache:DescribeCacheClusters, elasticache:DescribeReservedCacheNodes*
OpenSearch	es:DescribeDomains, es:DescribeReservedInstances*
Savings Plans	savingsplans:Describe*
Pricing	pricing:*

Autopilot role

Deployed during Step 3. Includes all read-only permissions plus commitment purchasing.

Additional permissions	Actions
EC2 purchases	ec2:PurchaseReservedInstancesOffering
RDS purchases	rds:PurchaseReservedDBInstancesOffering
Savings Plans	savingsplans:* (includes purchase and modification)

Pump Secure role (optional)

Deployed separately if you enable Pump Secure. Grants read-only access to security-related services.

Permission group	Actions
Security services	SecurityHub, GuardDuty, CloudTrail, Macie (read-only)
Resource inventory	EC2, RDS, ECS, EKS Describe calls

Pump Infra role (optional)

Deployed separately for infrastructure analysis features.

Permission group	Actions
Compute Optimizer	compute-optimizer:* (read-only)
Resource inventory	EC2, Lambda, RDS, ECS Describe/Get/List
CloudWatch	Read-only metrics access

Troubleshooting

CloudFormation stack failed to create

Verify that your IAM user or role has permissions to create CloudFormation stacks and IAM roles. The stack requires iam:CreateRole, iam:PutRolePolicy, and cloudformation:CreateStack at minimum.

Pump is not receiving data after stack creation

The CloudFormation stack includes a custom resource that notifies Pump on completion. If this notification fails (due to network restrictions or Lambda execution limits), contact Pump support at support.pump.co.

Organization setup is not self-serve

AWS Organization accounts require coordination between your management account and Pump. If you selected "Organization" during onboarding, a Pump team member will reach out to schedule the setup.