Fuselee

Connect providers

Connect AWS

A billing-read IAM user plus a separate, tag-scoped act role.

Two identities, on purpose

Spend is read with an IAM user that can only call Cost Explorer. Enforcement uses a separate role that the user assumes, whose policy only allows stopping/starting instances and deactivating access keys on resources tagged fuselee:managed=true. Untagged resources are unreachable by construction.

Steps

  1. IAM → Users → create fuselee-billing-read with the billing-read policy (ce:GetCostAndUsage, sts:GetCallerIdentity, sts:AssumeRole on the act role). Create an access key.
  2. IAM → Roles → create fuselee-act with the act policy and a trust policy naming that user. Copy the role ARN.
  3. Tag the IAM users and EC2 instances Fuselee may cut off with fuselee:managed = true.
  4. Dashboard → Connect provider → AWS: access key, secret, region, act role ARN. Register a connection whose external id is the tagged IAM user name.

Policies

The exact JSON lives in the fuselee-agent repository under policies/ and is rendered on the provider page. Cost Explorer charges about $0.01 per call, so AWS syncs hourly; a freshly enabled Cost Explorer reports no data for up to 24 hours.