> For the complete documentation index, see [llms.txt](https://help.pump.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.pump.co/aws/onboarding/standard-onboarding.md). # Standard Onboarding ## Connecting AWS Pump connects to your AWS account using a cross-account IAM role deployed via CloudFormation. The initial connection grants read-only access to your cost and usage data. ### Prerequisites | Requirement | Details | | --------------- | ------------------------------------------------------ | | AWS account | Active account with billing access | | IAM permissions | Ability to create CloudFormation stacks and IAM roles | | Pump account | Sign up at app.pump.co and complete email verification | ### How the connection works Pump uses AWS's cross-account role pattern. When you deploy the CloudFormation stack, it creates an IAM role in your account that trusts Pump's AWS account. Each connection uses a unique External ID to ensure only Pump can assume the role. Pump never stores your AWS credentials. Every data request uses temporary STS tokens obtained by assuming the role you created. ### Step 1: Deploy the CloudFormation stack and run a savings estimate This step grants Pump read-only access to your cost and usage data and generates your savings estimate. Nothing is purchased, and no billing relationship is created at this stage. 1. In the Pump onboarding wizard, select **Connect AWS**. 2. Pump generates a pre-filled CloudFormation Quick-Create URL unique to your account (with your External ID embedded). 3. Click the link to open the AWS Console. 4. Scroll down, check the acknowledgment box, and click **Create stack**. 5. The stack creates: * An IAM role with read-only permissions (see Permissions reference below) * A custom resource (`Custom::PumpPingResource`) that notifies Pump when the stack completes 6. When the stack finishes, Pump is automatically notified and begins pulling your cost data. 7. Pump generates your savings estimate. This typically takes a few minutes. The estimate shows how much Pump could have saved you based on your historical usage. If the numbers look good and you are interested in onboarding, proceed to Step 2. #### Alternative: Estimate from CSV (no permissions required) If you want to see a savings estimate before granting any AWS access, you can upload Cost Explorer CSVs instead. 1. In the Pump onboarding wizard, select **Estimate savings from CSV**. 2. In your AWS Console, navigate to **Cost Explorer** and export two CSV files: * Monthly cost data (last 12 months) * Daily cost data (last 3 months) 3. Upload both CSV files to Pump. 4. Pump generates your savings estimate within minutes. The CSV path provides a directional estimate. The CloudFormation path provides a more detailed estimate because Pump can access granular usage data beyond what CSV exports contain. After reviewing a CSV-based estimate, you can proceed to deploy the CloudFormation stack to connect your account. #### Alternative: Terraform deployment If your organization manages infrastructure as code with Terraform, Pump provides a Terraform module as an alternative to CloudFormation. Contact your Pump representative for the module. ### Step 2: Standalone vs. Organization Pump asks whether your AWS account is part of an AWS Organization. | Account type | What happens | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Standalone account** (not in an Organization) | Self-serve setup continues. You complete the remaining steps in the wizard. | | **Organization account** (member of an AWS Organization) | Pump routes you to book a meeting with the Pump team. Organization setups require coordination with your management account and are handled with a Pump engineer. | ### Step 3: Authorize Pump as your billing partner This step transitions Pump from read-only access to billing partner access. Pump becomes the payer account for your AWS usage. 1. In the Pump wizard, review the billing partner agreement. 2. Accept the Terms of Service and Privacy Policy. 3. Pump deploys an updated IAM role with Autopilot permissions (see Permissions reference below). This adds the ability to purchase commitments (Reserved Instances and Savings Plans) on your behalf. 4. Complete your company details and payment method. After this step, your account is connected. Pump begins managing your commitments and generating savings. ### What Pump accesses #### Data Pump reads | Data source | What Pump pulls | How it's used | | ------------------------------------------------------ | --------------------------------------------- | ---------------------------------------------------- | | Cost Explorer API | Spend by service, account, region, usage type | Cost visibility, savings calculations, forecasting | | Cost and Usage Reports (CUR) | Line-item billing data from S3 | RI/SP utilization tracking, detailed cost breakdowns | | Organizations API | Account structure, organizational units | Multi-account cost aggregation | | EC2/RDS/ElastiCache/Redshift/OpenSearch Describe calls | Instance types, sizes, utilization metadata | Right-sizing recommendations | | Compute Optimizer | Resource utilization recommendations | Infrastructure optimization analysis | | Pricing API | On-demand and commitment pricing | Savings calculations | | Reserved Instance/Savings Plan details | Existing commitments, utilization, coverage | Commitment management and renewal planning | #### Data Pump never accesses Pump does not access your application data, infrastructure configurations, S3 bucket contents, IAM users or credentials, CloudWatch logs, or any data outside of billing and resource metadata. Pump cannot create, modify, start, stop, or terminate any AWS resources. The only write action Pump performs is purchasing commitments (Reserved Instances and Savings Plans) when Autopilot is enabled, and only after you have authorized billing partner access. ### Historical data backfill When you first connect, Pump backfills up to 12 months of historical cost data from Cost Explorer. CUR-based data backfills from the beginning of your account's billing history. Ongoing data refreshes happen automatically on a rolling basis. ### Permissions reference #### Read-only role Deployed during Step 1. Grants visibility into cost and usage data. | Permission group | Actions | | ---------------------- | ------------------------------------------------------------------------------ | | Cost Explorer | `ce:Get*`, `ce:List*` | | Cost and Usage Reports | `cur:Describe*`, `cur:List*` | | Organizations | `organizations:Describe*`, `organizations:List*` | | EC2 | `ec2:DescribeInstances`, `ec2:DescribeReservedInstances*` | | RDS | `rds:DescribeDBInstances`, `rds:DescribeReservedDBInstances*` | | Redshift | `redshift:DescribeClusters`, `redshift:DescribeReservedNodes*` | | ElastiCache | `elasticache:DescribeCacheClusters`, `elasticache:DescribeReservedCacheNodes*` | | OpenSearch | `es:DescribeDomains`, `es:DescribeReservedInstances*` | | Savings Plans | `savingsplans:Describe*` | | Pricing | `pricing:*` | #### Autopilot role Deployed during Step 3. Includes all read-only permissions plus commitment purchasing. | Additional permissions | Actions | | ---------------------- | ----------------------------------------------------- | | EC2 purchases | `ec2:PurchaseReservedInstancesOffering` | | RDS purchases | `rds:PurchaseReservedDBInstancesOffering` | | Savings Plans | `savingsplans:*` (includes purchase and modification) | #### Pump Secure role (optional) Deployed separately if you enable Pump Secure. Grants read-only access to security-related services. | Permission group | Actions | | ------------------ | ----------------------------------------------------- | | Security services | SecurityHub, GuardDuty, CloudTrail, Macie (read-only) | | Resource inventory | EC2, RDS, ECS, EKS Describe calls | #### Pump Infra role (optional) Deployed separately for infrastructure analysis features. | Permission group | Actions | | ------------------ | --------------------------------------- | | Compute Optimizer | `compute-optimizer:*` (read-only) | | Resource inventory | EC2, Lambda, RDS, ECS Describe/Get/List | | CloudWatch | Read-only metrics access | ### Troubleshooting #### CloudFormation stack failed to create Verify that your IAM user or role has permissions to create CloudFormation stacks and IAM roles. The stack requires `iam:CreateRole`, `iam:PutRolePolicy`, and `cloudformation:CreateStack` at minimum. #### Pump is not receiving data after stack creation The CloudFormation stack includes a custom resource that notifies Pump on completion. If this notification fails (due to network restrictions or Lambda execution limits), contact Pump support at support.pump.co. #### Organization setup is not self-serve AWS Organization accounts require coordination between your management account and Pump. If you selected "Organization" during onboarding, a Pump team member will reach out to schedule the setup. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://help.pump.co/aws/onboarding/standard-onboarding.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.