Skip to main content
This article walks you through connecting your AWS account — or your entire AWS Organization — to BRM so we can show your AWS Marketplace agreements and spend, AWS service costs, and Amazon Bedrock AI usage. Why this matters: software bought through AWS Marketplace — including large, privately negotiated contracts — often never reaches your procurement or finance systems, so renewal dates and payment schedules stay invisible. Bedrock AI spend similarly hides inside a much larger cloud bill. ⚠️ Important: Unlike most integrations, this one uses no API keys or passwords at all. You launch a CloudFormation stack that creates a read-only IAM role in your account, and BRM connects to that role through identity federation. There is no credential to copy, store, or rotate — and you can cut off access at any time by deleting the role.

​
Choose your setup type

The BRM connect dialog asks which setup you have. Pick based on how your AWS is structured: If you’re not sure, check whether your AWS bill is consolidated: if multiple accounts roll up into one bill, you have an AWS Organization, and the account that owns that bill is the management account.

​
What you’ll need

​
Before you connect

Two account-level settings must be on in the account you’re connecting (for an AWS Organization, the management account). Both are one-time toggles:
  1. Enable Cost Explorer. In the AWS console, open Cost Explorer from the Billing console. If it has never been opened, AWS takes up to 24 hours to prepare your data — do this first.
  2. Activate IAM access to billing information. In Account settings (in the Billing console), enable IAM user and role access to billing information. Without this, no IAM role — including BRM’s — can read billing data, regardless of its permissions.

​
Connect a single AWS account

​
Step 1: Open the AWS integration in BRM

In BRM, click your profile in the lower-left corner, then Integrations. Find AWS and click Connect. Leave the setup type on Single AWS account.

​
Step 2: Launch the CloudFormation stack

Sign in to the AWS console for the account you want to connect (an admin who can create IAM roles), then click Launch CloudFormation stack in the AWS console in the BRM dialog. The stack opens with everything pre-filled — you don’t need to change any parameters. Check the acknowledgment box (“I acknowledge that AWS CloudFormation might create IAM resources with custom names”) and click Create stack.

​
Step 3: Copy the role ARN

When the stack finishes (usually under a minute), open its Outputs tab and copy the RoleArn value. It looks like arn:aws:iam::123456789012:role/BRMIntegrationRole.

​
Step 4: Paste the ARN into BRM

Back in the BRM dialog, paste the role ARN and click Create Integration. BRM verifies it can assume the role and confirms the connection.

​
Connect an AWS Organization

​
Step 1: Choose organization mode

In the BRM connect dialog, switch the setup type to AWS Organization (multiple accounts).

​
Step 2: Launch the stack in your management account

Follow the same stack launch as a single account, but sign in to your management account — the account that owns your consolidated bill. This matters: BRM verifies at connect time that the role really is in the management account, and will tell you if it isn’t. Copy the RoleArn from the stack’s Outputs tab, paste it into BRM, and click Create Integration. The management account’s billing data covers spend for every account in your organization, so this single connection is already complete for cost tracking.

​
Step 3 (optional): Cover member accounts with a StackSet

Some data only exists inside each member account — most importantly, AWS Marketplace agreements purchased from that account. To cover them, create a CloudFormation StackSet from the management account. It deploys the same read-only role to every member account, and automatically to new accounts as they join your organization. The BRM dialog shows the exact commands with your values pre-filled. You can run them now or any time later — spend tracking works either way. ℹ️ If any account already has the BRMIntegrationRole from an earlier standalone stack, exclude it from the StackSet targets (or delete its standalone stack first) — otherwise the deployment to that account fails because the role name already exists.

​
What BRM reads

The role is strictly read-only and scoped to procurement and cost data:
  • AWS Marketplace agreements (including private offers), their terms, and contract documents
  • Cost and spend data from Cost Explorer, including committed spend such as Savings Plans and Reserved Instances
  • Amazon Bedrock usage and per-model spend
  • Invoices, budgets, and organization account names
BRM cannot create, modify, or delete anything in your AWS account, cannot read your workloads or data, and cannot see anything outside these billing and procurement APIs.

​
Common mistakes

  • Connecting a member account in organization mode. Organization mode requires the management account. If BRM reports the role is in a member account, either launch the stack in the management account instead, or switch to single-account mode for that account.
  • Skipping the billing toggles. If Cost Explorer was never enabled or “IAM access to billing information” is off, the connection succeeds but spend data can’t be read. Both toggles live in the Billing console of the connected account.
  • The stack fails with a role-name error. The account already has a BRMIntegrationRole from an earlier launch. Delete the old stack first (CloudFormation → Stacks), then relaunch.
  • Connecting the wrong account. Marketplace agreements are only visible from the account that purchased them. If your subscriptions were bought in a different account, connect that account too (or cover it with the StackSet).
  • Deleting the stack or role after connecting. This immediately cuts off BRM’s access — which is exactly what to do if you ever want to disconnect, but do it deliberately.

​
Provider documentation

Our steps above should stay current, but if AWS changes their interface, these are the source-of-truth docs:

​
Still stuck?

Reach out to BRM support and let us know which step you’re stuck on. There’s no secret credential involved in this integration, so it’s safe to share the role ARN or a screenshot of the CloudFormation Outputs tab with support.