Set up CCI

preview

We're still working on this feature, but we'd love for you to try it out!

This feature is currently provided as part of a preview program pursuant to our pre-release policies.

Learn how to set up Cloud Cost Intelligence with AWS by configuring essential integration settings, including IAM roles and data export paths. This guide walks you through the required steps to enable detailed cost analysis and management within your New Relic platform.

Follow these steps to configure Cloud Cost Intelligence:

Start integrating

Click Cloud Cost Intelligence on the left panel, then click Add the integration. Alternatively, click Integrations & Agents on the left panel, look for Cloud Cost Intelligence among all capabilities, and then click Cloud Cost Intelligence.

Select account

Select the New Relic account you want to use for the setup, and click Continue.

Provide connection details

Enter the following details required to fetch cost data from AWS:

Connection name: Filled in by default. Edit if you want a custom name.
Cross-account IAM role ARN: The Amazon Resource Name (ARN) for the IAM role that Cloud Cost Intelligence will assume to access your S3 bucket. An ARN is a unique identifier for various AWS resources, including IAM roles. It follows a standard format that includes the service, region, account ID, and resource specifics—such as arn:aws:iam::<account-id>:role/<role-name>.
External ID: Copy the external ID of your New Relic account and add it to your IAM role configuration as part of the prerequisites. You are required to add it into the trust policy of the IAM role in your AWS account.
Data export name: The name of the data export file. Used to construct the path to the corresponding CUR file. For a report named cci-ingestion-test, the constructed path would be cost-and-usage-reports/cci-ingestion-test/data. This is where CUR data is stored within the S3 bucket.
S3 bucket name: The exact name of your S3 bucket. Ensure it includes the prefix cost-and-usage-reports. Use an S3 bucket located in the us-east-2 region for optimal performance and cost efficiency.

Set up a trust policy

Add the New Relic global user to the trust policy of your IAM role and provide role permissions. This allows the New Relic global user for Cloud Cost Intelligence to assume the IAM role.

To enable Cloud Cost Intelligence to access your AWS resources, configure a trust policy in your AWS Management Console that allows the New Relic global user, arn:aws:iam::207192125115:user/cci_global_user, to assume an IAM role. Below is a sample trust policy document:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::207192125115:user/cci_global_user"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<externalID>"
        }
      }
    }
  ]
}

Important

The sts:ExternalId is a critical component for security. Set it to the external ID you copied in the previous step. This ID ensures that the role is assumed only in the context intended by New Relic, enhancing the security of your integration.
If your resources are in AWS regions where Security Token Service (STS) is not active by default (for example, ap-east-1, eu-south-1), activate STS for those regions.

Test connection

Finally, initiate a test to verify that the connection to your AWS environment is successful.

After a successful setup, it may take a few hours for data to start appearing in the New Relic UI, especially during the first-time setup.