AWS Onboarding Process

Step-by-step guide to onboard your AWS payer account to Wiv, including prerequisites, CloudFormation setup, and linked account deployment.

Written By Dotan Cohen

Last updated About 1 month ago

Prerequisites

The Wiv CloudFormation stack automatically enables AWS Compute Optimizer, Cost Optimization Hub, and Trusted Access for your organization — no manual opt-in steps required. These services are controlled by the EnableComputeOptimizer, EnableCostOptimizationHub, and EnableTrustedAccess parameters (all default to Yes).

Enabling resource costs

To enable Wiv to extract resource costs accurately, enable resource-level data tracking at daily granularity:

Navigate to Cost Management Preferences
Select the Cost Explorer tab
Enable the Resource-level data at daily granularity option
Select All Services (available at no additional cost)
Click Save Preferences

Wiv onboarding process — payer

The Wiv onboarding stack connects your AWS Management (Payer) account to the Wiv platform. It sets up a Cost & Usage Report (CUR) delivered to a dedicated S3 bucket, configures Athena for cost querying, creates a cross-account IAM role with an external ID, and deploys WivAccessRole to all linked accounts via StackSet.

CUR 2.0 (recommended) uses the BCM Data Exports API with Athena Partition Projection — no Glue Crawler required. Legacy CUR uses a Glue Crawler to keep the Athena table in sync. You select the CUR type during manual onboarding; automated onboarding deploys CUR 2.0 by default.

Automated onboarding

Open your AWS payer account in a new tab
From the Wiv console go to Integrations > AWS > New AWS integration
Add an integration name and click "Connect via CloudFormation"

This will open the CloudFormation stack in a new tab in your payer account.

No need to change anything — mark the 2 checkboxes and click "Create stack". The stack will run and you will see "Deployment in progress" until it completes.

For adding AWS linked accounts, scroll down to Adding AWS organization units and linked accounts to the StackSet.

Manual onboarding

Click "connect by entering your onboarding info manually".

Choose between 2 types of CUR: 2.0 or Legacy.

Click "Connect AWS account" which will open CloudFormation in a new tab. Leave all default values, check the boxes, then click "Create Stack".

It will take approximately 5 minutes to complete the installation of all stacks at the account. Wait until you see that all is completed:

After the deployment was successful you will need to provide Role ARN and External ID from the nested stack WivOnBoarding-OrgRoleManagement-XXXXXXXXXXXX.

CloudFormation parameters reference

When the CloudFormation stack launches, you can review and adjust the following parameters. Most values are pre-populated by Wiv — only change them if you have a specific requirement.

Security configuration

Parameter	Default	Description
External ID	Auto-populated	Used for additional security on the cross-account IAM role. Pre-filled by Wiv — do not change.
Organization ID	Empty	AWS Organization ID (e.g. `o-xxxxxxxxxx`). When provided, uses an organization-based trust policy instead of an account-based one. Leave empty if not applicable.
OU ID	Empty	Organizational Unit ID (e.g. `ou-xxxx-xxxxxxxx`). When provided, the StackSet deploys only to accounts in this OU. Leave empty to deploy to the entire organization.
Bypass pre-check validation	No	Set to Yes to skip pre-check validation (region, management account, CUR quota, Lambda concurrency). Only use this if you have already verified all prerequisites manually.

Split Cost Allocation Data (Container Cost Visibility)

Parameter	Default	Description
Enable Split Cost Allocation for Amazon ECS	Yes	Enables container-level cost visibility for ECS workloads in your CUR.
Enable Split Cost Allocation for Amazon EKS	Yes	Enables container-level cost visibility for EKS workloads in your CUR.
EKS Split Cost Allocation Method	ResourceRequests	How EKS pod costs are allocated. Choose one: ResourceRequests (allocates by pod CPU/memory requests — recommended default), Prometheus (uses actual utilization via Amazon Managed Service for Prometheus), or ContainerInsights (uses CloudWatch metrics).
Enable Amazon Managed Service for Prometheus (optional)	No	Enables AMP for utilization-based EKS cost allocation. Requires AWS Organizations all-features enabled. Only applicable when `EKS Split Cost Allocation Method` is set to `Prometheus`.
Enable Amazon CloudWatch Container Insights (optional)	No	Enables CloudWatch Container Insights for granular EKS cost visibility across clusters with multiple containers on shared EC2 instances. Only applicable when `EKS Split Cost Allocation Method` is set to `ContainerInsights`.

Cost optimization services

Parameter	Default	Description
Enable Compute Optimizer	Yes	Automatically opts in your entire organization to AWS Compute Optimizer and enrolls all member accounts.
Enable Cost Optimization Hub	Yes	Automatically opts in your entire organization to AWS Cost Optimization Hub and enrolls all member accounts.
Enable Trusted Access	Yes	Enables Trusted Access for Compute Optimizer across the organization, allowing cross-account recommendations.

Leaving all three cost optimization parameters set to Yes (the default) is strongly recommended. They enable the full range of Wiv's optimization recommendations at no additional AWS cost.

Integration configuration

Parameter	Default	Description
Integration Name	Auto-populated	The name for this integration as it appears in Wiv. Pre-filled from the Wiv console — do not change.
OnBoarding ID	Auto-populated	Internal Wiv onboarding identifier. Pre-filled automatically — do not change.
Deploy Organization Role StackSet	Yes	Deploys the `WivAccessRole` to all member accounts via StackSet. Set to No only for a single linked-account deployment where a StackSet is not needed.
Allow Bedrock InvokeModel	Yes	Bring your own cloud (BYOC): when Yes, grants `bedrock:InvokeModel` on `WivAccessRole` so Wivy can invoke Amazon Bedrock in your AWS account and run against your modules and configuration. When No, that permission is omitted. `bedrock:ListFoundationModels` remains granted either way.

EventBridge

Parameter	Default	Description
Enable EventBridge permissions and resources	Yes	Creates EventBridge rules, API destinations, and connections for the cross-account role. Set to No only if your security policy prohibits EventBridge integration.

Adding AWS organization units and linked accounts to the StackSet

as part of our automated onboarding process we deployed our role automatically across all the organization

Go to "WivOrgStackSet" under "Actions" click on "Add stacks to StackSet".

Under "Set deployment options" choose "Deploy to organization" to deploy the role for all organization Linked accounts. Or "Deploy to organizational units (OUs)" to target specific OUs (you will need to provide "AWS OU ID").

Under "Specify regions" choose "us-east-1" (this is not important as the role is a Global resource and not regional).

Leave all other options as default and run the stackset. You will see all your chosen Linked accounts under the "Stack instances" tab.

The end result should be a "SUCCEEDED" message in the "Operations" tab.

All resources that can be tagged have the following tags:

Wiv: Wiv-infrastructure
Wiv:Original:ResourceId: {StackName}-Stack

The following are infrastructure resources created during the onboarding process:

CUR 2.0

IAM Roles:

WivAccessRole (management and member accounts)
Lambda execution roles (WivCURLambda, WivClean_Up_Buckets, Wiv_CostAndComputeOptimization_OptIn, Wiv_SplitCostAllocation)

S3 Bucket:

wiv-cur-{AccountId} — stores BCM Data Export files; bucket policy grants write access to both billingreports.amazonaws.com and bcm-data-exports.amazonaws.com

Lambda Functions:

PreCheck Lambda
WivCURLambdaFunction — creates the CUR 2.0 BCM Data Export and opens an AWS Support backfill case
WivClean_Up_Buckets — empties the S3 bucket before stack deletion
Wiv_CostAndComputeOptimization_OptIn — opts in to Compute Optimizer and Cost Optimization Hub (created when either service is enabled)
Wiv_SplitCostAllocation — enables ECS/EKS split cost allocation preferences (created when ECS or EKS split cost is enabled)

Glue Resources:

Glue Database (wivdb)
Glue Table (wiv_cur2) — static schema with Partition Projection; no Glue Crawler required
CUR Status Table (cost_and_usage_data_status)

Athena Resources:

Athena Workgroup (WivWorkspace)

CloudFormation StackSet:

WivOrgStackSet — deploys WivAccessRole to member accounts (created when Deploy Organization Role StackSet is set to Yes)

CloudWatch Log Groups:

For each Lambda function

EventBridge Resources (created when Enable EventBridge permissions and resources is set to Yes):

EventBridge rules, API destinations, and connections for the cross-account role

Cost Optimization Services (enrolled when the corresponding parameters are set to Yes):

AWS Compute Optimizer — organization-wide opt-in and member account enrollment
AWS Cost Optimization Hub — organization-wide opt-in and member account enrollment

Split Cost Allocation (created when the corresponding parameters are set to Yes):

ECS Split Cost Allocation Data — container-level cost visibility for ECS workloads
EKS Split Cost Allocation Data — container-level cost visibility for EKS workloads

Legacy CUR