> For the complete documentation index, see [llms.txt](https://docs.north.cloud/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.north.cloud/docs/getting-started/quickstart/aws-onboarding.md).

# AWS Onboarding

Learn how to integrate your AWS account with North.cloud

## Connect Your AWS Account

{% embed url="<https://www.loom.com/share/c976d38a9d874424a9438a392a906dcc>" %}

{% hint style="info" %}
Prerequisites:

* [ ] If you do not have an account, we recommend you create a free account first at [app.north.cloud](https://app.north.cloud)
* [ ] You need to have the appropriate permissions to create IAM permissions into the payer account
* [ ] Enable cloudformation stackset. Guide from the [official AWS documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-activate-trusted-access.html).
  {% endhint %}

{% stepper %}
{% step %}

### Get your account information ready

**AWS Account ID**

{% hint style="info" %}
If your AWS account is part of an AWS organization, please sign up using the billing account only (also called payer account). This will allow North to analyze usage throughout all your accounts and centralize savings opportunities into one view.
{% endhint %}

To find your AWS account ID, sign in to the AWS console with your billing account. Select your account name in the top-right corner. The menu lists your 12-digit account ID.

**AWS Organizational Unit ID**

To find the ID, open [AWS Organizations](https://us-east-1.console.aws.amazon.com/organizations/v2/home/accounts) in the AWS console and select **AWS accounts**. Under **Organizational structure**, the ID of each unit appears below its name. Use the **Root** ID, which starts with `r-`, to include every account in your organization. Use an organizational unit ID, which starts with `ou-`, to include only the accounts in that unit. Your North stack adds `NorthCloudWatchCrossAccountSharingRole` to each account in the unit you enter.

<figure><img src="https://1793025303-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FeLw7hj1pxE38VmG1sYVW%2Fuploads%2FM0YVNyV1TDx5Agvlsh5z%2Faws-org-id-location.png?alt=media&#x26;token=b786d26b-3063-49d6-9923-3d1acc114c93" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Select your integration method

**We recommend using the CloudFormation stack** which deploys all the required permissions. We also offer Terraform, CLI, or console commands. [Learn more about the permissions.](/docs/getting-started/permissions-required.md)

{% tabs %}
{% tab title="CloudFormation" %}

* [Click here to open a pre-configured CloudFormation stack](https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate?templateURL=https%3A%2F%2Fnorth-cloudformation-template-public.s3.us-east-1.amazonaws.com%2Fbilling-and-usage-read-only-cf-stack%2Fv1%2Fnorth-all-features.yaml\&stackName=NorthCloudformationAllFeatures\&param_OrgId=ADD_ORG_ID_HERE) in a new tab. *This link has a placeholder for your Organizaitonal Unit ID, please add your own.*
* Once in the page, scroll to the bottom and click "I acknowledge".
* Finally, click "Create stack" to create the stack.
  {% endtab %}

{% tab title="Terraform" %}

* Create .tf file

{% code fullWidth="true" %}

```hcl
provider "aws" {
  region = "us-east-1"
}

variable "org_id" {
  type        = string
  description = "The OrgId you want to deploy this stack in"
}

locals {
  is_us_east_1 = data.aws_region.current.name == "us-east-1"
}

data "aws_region" "current" {}
data "aws_caller_identity" "current" {}

# IAM Role for Cost and Usage Access
resource "aws_iam_role" "north_cost_usage_role" {
  name = "NorthCostAndUsageRole"
  
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          AWS = "arn:aws:iam::480850768557:root"
        }
        Action = ["sts:AssumeRole"]
      }
    ]
  })
}

resource "aws_iam_policy" "north_cost_usage_policy" {
  name = "NorthCostAndUsageReadOnlyPolicy"
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "NorthCostAndUsageReadOnlyPolicyID"
        Effect = "Allow"
        Action = [
          "ce:Get*",
          "ce:StartSavingsPlansPurchaseRecommendationGeneration"
        ]
        Resource = "*"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "north_cost_usage_policy_attachment" {
  role       = aws_iam_role.north_cost_usage_role.name
  policy_arn = aws_iam_policy.north_cost_usage_policy.arn
}

# CloudWatch Cross-Account Access Role
resource "aws_iam_role" "cloudwatch_cross_account_access_role" {
  name = "NorthCloudWatchCrossAccountAccessRole"
  
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = ["sts:AssumeRole"]
        Principal = {
          AWS = "arn:aws:iam::480850768557:role/NorthCURReadOnly"
        }
      }
    ]
  })
  
  path = "/"
  
  tags = {
    Purpose = "CrossAccountMonitoring"
  }
}

resource "aws_iam_policy" "cloudwatch_cross_account_access_policy" {
  name = "NorthCloudWatchCrossAccountAccessPolicy"
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = ["sts:AssumeRole"]
        Resource = "arn:aws:iam::*:role/NorthCloudWatchCrossAccountSharingRole"
      },
      {
        Effect = "Allow"
        Action = [
          "s3:GetObject",
          "s3:ListBucket",
          "s3:GetBucketTagging"
        ]
        Resource = [
          "arn:aws:s3:::north-cur-bucket-${data.aws_caller_identity.current.account_id}",
          "arn:aws:s3:::north-cur-bucket-${data.aws_caller_identity.current.account_id}/*"
        ]
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "cloudwatch_cross_account_access_policy_attachment" {
  role       = aws_iam_role.cloudwatch_cross_account_access_role.name
  policy_arn = aws_iam_policy.cloudwatch_cross_account_access_policy.arn
}

# CloudWatch Cross-Account Sharing Role
resource "aws_iam_role" "cloudwatch_cross_account_sharing_role" {
  name = "NorthCloudWatchCrossAccountSharingRole"
  
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          AWS = aws_iam_role.cloudwatch_cross_account_access_role.arn
        }
        Action = ["sts:AssumeRole"]
      }
    ]
  })
  
  path = "/"
  
  depends_on = [aws_iam_role.cloudwatch_cross_account_access_role]
}

resource "aws_iam_policy" "cloudwatch_cross_account_sharing_policy" {
  name = "NorthCloudWatchCrossAccountSharingPolicy"
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "cloudwatch:GetMetricData",
          "ec2:DescribeVolumes"
        ]
        Resource = "*"
      },
      {
        Sid    = "NorthS3BucketSettingsReadOnly"
        Effect = "Allow"
        Action = [
          "s3:GetLifecycleConfiguration",
          "s3:GetBucketVersioning",
          "s3:GetReplicationConfiguration",
          "s3:GetIntelligentTieringConfiguration",
          "s3:GetBucketRequestPayment"
        ]
        Resource = "arn:aws:s3:::*"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "cloudwatch_cross_account_sharing_policy_attachment" {
  role       = aws_iam_role.cloudwatch_cross_account_sharing_role.name
  policy_arn = aws_iam_policy.cloudwatch_cross_account_sharing_policy.arn
}

# North Premium IAM Role
resource "aws_iam_role" "north_premium_role" {
  name = "NorthCostAndUsageRolePremium"
  
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          AWS = "arn:aws:iam::480850768557:root"
        }
        Action = ["sts:AssumeRole"]
      }
    ]
  })
}

resource "aws_iam_policy" "north_premium_policy" {
  name = "NorthPremiumPolicy"
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Sid    = "NorthPremiumPolicy3"
        Action = [
          "ec2:DescribeVolumes",
          "lambda:ListProvisionedConcurrencyConfigs",
          "organizations:ListAccounts"
        ]
        Resource = "*"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "north_premium_policy_attachment" {
  role       = aws_iam_role.north_premium_role.name
  policy_arn = aws_iam_policy.north_premium_policy.arn
}

# CUR S3 Bucket
resource "aws_s3_bucket" "cur_bucket" {
  bucket = "north-cur-bucket-${data.aws_caller_identity.current.account_id}"
  
  tags = {
    Purpose              = "CostAndUsageReports"
    NorthTemplateVersion = "v1"
  }
}

resource "aws_s3_bucket_ownership_controls" "cur_bucket_ownership" {
  bucket = aws_s3_bucket.cur_bucket.id
  
  rule {
    object_ownership = "BucketOwnerEnforced"
  }
}

resource "aws_s3_bucket_public_access_block" "cur_bucket_public_access" {
  bucket = aws_s3_bucket.cur_bucket.id
  
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket_versioning" "cur_bucket_versioning" {
  bucket = aws_s3_bucket.cur_bucket.id
  
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "cur_bucket_encryption" {
  bucket = aws_s3_bucket.cur_bucket.id
  
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

resource "aws_s3_bucket_lifecycle_configuration" "cur_bucket_lifecycle" {
  bucket = aws_s3_bucket.cur_bucket.id
  
  rule {
    id     = "expire365days"
    status = "Enabled"
    
    expiration {
      days = 365
    }
  }
}

resource "aws_s3_bucket_policy" "cur_bucket_policy" {
  bucket = aws_s3_bucket.cur_bucket.id
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "AWSBillingDeliveryPermissions"
        Effect = "Allow"
        Principal = {
          Service = "billingreports.amazonaws.com"
        }
        Action = [
          "s3:PutObject",
          "s3:GetBucketAcl",
          "s3:GetBucketLocation"
        ]
        Resource = [
          "arn:aws:s3:::${aws_s3_bucket.cur_bucket.id}/*",
          "arn:aws:s3:::${aws_s3_bucket.cur_bucket.id}"
        ]
      },
      {
        Sid    = "AllowCrossAccountAccess"
        Effect = "Allow"
        Principal = {
          AWS = aws_iam_role.cloudwatch_cross_account_access_role.arn
        }
        Action = [
          "s3:GetObject",
          "s3:ListBucket"
        ]
        Resource = [
          "arn:aws:s3:::${aws_s3_bucket.cur_bucket.id}/*",
          "arn:aws:s3:::${aws_s3_bucket.cur_bucket.id}"
        ]
      }
    ]
  })
  
  depends_on = [
    aws_s3_bucket.cur_bucket,
    aws_iam_role.cloudwatch_cross_account_access_role
  ]
}

# CUR Report (conditionally created in us-east-1)
resource "aws_cur_report_definition" "cur_report" {
  count = local.is_us_east_1 ? 1 : 0
  
  report_name                = "aws-cost-report"
  time_unit                  = "HOURLY"
  format                     = "Parquet"
  compression                = "Parquet"
  additional_schema_elements = ["RESOURCES", "SPLIT_COST_ALLOCATION_DATA"]
  s3_bucket                  = aws_s3_bucket.cur_bucket.id
  s3_prefix                  = "cur-reports"
  s3_region                  = "us-east-1"
  report_versioning          = "CREATE_NEW_REPORT"
  refresh_closed_reports     = false
  
  depends_on = [aws_s3_bucket_policy.cur_bucket_policy]
}

# CloudWatch StackSet
resource "aws_cloudformation_stack_set" "north_cloudwatch_stackset" {
  name             = "NorthCloudWatchStackSet"
  permission_model = "SERVICE_MANAGED"
  
  auto_deployment {
    enabled                          = true
    retain_stacks_on_account_removal = false
  }
  
  capabilities = ["CAPABILITY_IAM", "CAPABILITY_NAMED_IAM"]
  
  parameters = {
    ParentAccountId = data.aws_caller_identity.current.account_id
  }
  
  operation_preferences {
    failure_tolerance_percentage = 100
    max_concurrent_percentage    = 100
  }
  
  template_body = <<TEMPLATE
AWSTemplateFormatVersion: '2010-09-09'
Description: Propagates Stack to 'Enable CloudWatch in central monitoring account to assume permissions to view CloudWatch data in the downstream accounts'
Parameters:
  ParentAccountId:
    Type: String
Resources:
  NorthCloudWatchCrossAccountSharingRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: NorthCloudWatchCrossAccountSharingRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::$${ParentAccountId}:role/NorthCloudWatchCrossAccountAccessRole
            Action:
              - sts:AssumeRole
      Path: "/"
      Policies:
        - PolicyName: NorthCloudWatchCrossAccountSharingPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - cloudwatch:GetMetricData
                  - ec2:DescribeVolumes
                  - lambda:ListProvisionedConcurrencyConfigs
                Resource: "*"
              - Sid: NorthS3BucketSettingsReadOnly
                Effect: Allow
                Action:
                  - s3:GetLifecycleConfiguration
                  - s3:GetBucketVersioning
                  - s3:GetReplicationConfiguration
                  - s3:GetIntelligentTieringConfiguration
                  - s3:GetBucketRequestPayment
                Resource: "arn:aws:s3:::*"
TEMPLATE
  
  depends_on = [aws_iam_role.cloudwatch_cross_account_access_role]
}

resource "aws_cloudformation_stack_set_instance" "north_cloudwatch_stackset_instance" {
  stack_set_name       = aws_cloudformation_stack_set.north_cloudwatch_stackset.name
  deployment_targets {
    organizational_unit_ids = [var.org_id]
  }
  region = "us-east-1"
}

# Outputs
output "cur_bucket_name" {
  description = "Name of the CUR S3 bucket"
  value       = aws_s3_bucket.cur_bucket.id
}

output "cur_bucket_arn" {
  description = "ARN of the CUR S3 bucket"
  value       = aws_s3_bucket.cur_bucket.arn
}

output "cross_account_role_arn" {
  description = "ARN of the CloudWatch cross-account access role"
  value       = aws_iam_role.cloudwatch_cross_account_access_role.arn
}

output "premium_role_arn" {
  description = "ARN of the North Premium IAM role"
  value       = aws_iam_role.north_premium_role.arn
}

output "cur_report_status" {
  description = "Status of CUR Report creation"
  value       = local.is_us_east_1 ? "Created in us-east-1" : "Not created - deploy in us-east-1"
}
```

{% endcode %}
{% endtab %}

{% tab title="CLI" %}

* Run the following command on the AWS CLI. *The code below has a placeholder for your Organizaitonal Unit ID, please add your own.*

{% code overflow="wrap" %}

```bash
aws cloudformation create-stack --stack-name NorthCloudformationAllFeatures --template-url https://north-cloudformation-template-public.s3.us-east-1.amazonaws.com/billing-and-usage-read-only-cf-stack/v1/north-all-features.yaml --region us-east-1 --capabilities CAPABILITY_NAMED_IAM --parameters ParameterKey=OrgId,ParameterValue=ADD_ORG_ID_HERE
```

{% endcode %}
{% endtab %}

{% tab title="Console (manual)" %}

* Deploy a CloudFormation stack in the AWS console that will create a read-only cross-account role. This will enable North to recommend the best savings posture based on your usage.
* In the AWS Management Console, select CloudFormation and “Create Stack”.
* Select the "Specify an Amazon S3 template URL" and enter the URL below:

```url
https://north-cloudformation-template-public.s3.us-east-1.amazonaws.com/billing-and-usage-read-only-cf-stack/v1/north-all-features.yaml
```

* On the "Specify stack details" page, enter the following information:
  * Stack name: Enter "NorthCloudformationAllFeatures" (or your desired stack name)
  * Org ID: Enter your Organizational Unit ID
  * Click "Next"
  * Click “Create stack”
    {% endtab %}
    {% endtabs %}
    {% endstep %}

{% step %}

### Verify your access

North.cloud will automatically verify your access after your deployment and confirm if your onboarding has been completed successfully. You can also verify manually if any failures happen or need to run the processes asynchronously.

{% embed url="<https://www.loom.com/share/8c7731bc294a4acaa54d83699ed20d23>" %}
{% endstep %}

{% step %}

### Start saving

Once North.cloud completes your savings and data analysis, we will send you a confirmation email. You will then have access to all our AI-powered optimization features, the same tools that help leading companies achieve top 1% cloud efficiency.
{% endstep %}
{% endstepper %}

## Update Your North Stack

Update your North stack when North needs a permission that your current stack does not grant. Your North stack is the CloudFormation stack that you deployed during onboarding. The update applies the current North template to your North stack. You will typically need to do this when North releases new features that you may want to use.

The update keeps your role names and your `OrgId` value, so you do not need to connect your account to North again.

### Check Your Template Version

North began versioning its template on October 27, 2026. The current version is `v1`. To check your version, open your North stack in CloudFormation and select the **Outputs** tab. If you see no `TemplateVersion` output, you are on the legacy template, and you need to update your North stack.

If you deployed North with Terraform, open your Cost and Usage Report bucket in S3 and select the **Properties** tab. The default bucket name is `north-cur-bucket-<account-id>`. If the bucket has no `NorthTemplateVersion` tag, you are on the legacy template, and you need to update your deployment.

If you removed permissions from the roles of the legacy template, you can update to v1 without removing them again. The v1 roles contain no IAM write, Organizations write, or Compute Optimizer permissions. Apply other role changes again after the update, such as an external ID condition. See [Run the Update](/docs/getting-started/quickstart/aws-onboarding.md#run-the-update).

### Run the Update

{% hint style="info" %}
Before you update your North stack, check these two points:

* Trusted access for CloudFormation StackSets is on in AWS Organizations. See the [official AWS documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-activate-trusted-access.html).
* A CloudFormation update replaces any change you made to the roles in your North stack, such as an external ID condition in a trust policy. Apply those changes again after the update. See [Supported Customizations](/docs/getting-started/permissions-required/aws-permissions.md#supported-customizations).
  {% endhint %}

{% tabs %}
{% tab title="CloudFormation" %}

1. Sign in to the AWS console in the account where you deployed your North stack.
2. Select the region where you deployed your North stack. The North onboarding link and commands use US East (N. Virginia).

   <figure><img src="https://1793025303-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FeLw7hj1pxE38VmG1sYVW%2Fuploads%2F5cMVKoxI86PzEo8CrKrz%2Funknown.png?alt=media&amp;token=72c32f0a-7092-4b5a-ad08-fa5250fd863f" alt="Select AWS Region" height="237" width="624"><figcaption></figcaption></figure>
3. Open CloudFormation, then select **Stacks**.

   <figure><img src="https://1793025303-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FeLw7hj1pxE38VmG1sYVW%2Fuploads%2FZSvDF7gD0FAkynlhaaSa%2Funknown.png?alt=media&amp;token=34dd8576-833b-4549-8df8-f3e7f7a7513f" alt="Select CloudFormation stack option" height="179" width="624"><figcaption></figcaption></figure>
4. Select your North stack. The default name is `NorthCloudformationAllFeatures`. If you used a different name, look for the stack that lists `CURBucketName` on its **Outputs** tab.

   <figure><img src="https://1793025303-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FeLw7hj1pxE38VmG1sYVW%2Fuploads%2F2A07Q1C0GwVR43tjrNH1%2FScreenshot%202026-10-27%20at%205.02.44%E2%80%AFPM.png?alt=media&amp;token=2f374493-0479-42de-a74c-0cade72645a5" alt=""><figcaption></figcaption></figure>

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>A note on older deployments.</strong> In some older North deployments, the roles and the Cost and Usage Report bucket are in two separate stacks. Each stack's <strong>Resources</strong> tab lists what it holds. If you have two stacks, delete the stack that holds only IAM roles and policies. Then update the stack that holds the bucket right away, because North cannot use your roles until the update completes.</p><p><img src="https://1793025303-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FeLw7hj1pxE38VmG1sYVW%2Fuploads%2FDnpZDHXHQp1OIm5ZaW23%2FScreenshot%202026-10-27%20at%205.03.41%E2%80%AFPM.png?alt=media&amp;token=65b90927-2c8c-49e4-825c-ecee9ef48b73" alt="" data-size="original"></p></div>
5. Select **Update stack**, then select **Create a change set**.

   <figure><img src="https://1793025303-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FeLw7hj1pxE38VmG1sYVW%2Fuploads%2FRbnzc1HYlptHiCDSlEEC%2Funknown.png?alt=media&amp;token=4a84975f-ec01-4146-9d9f-75602e09cf5e" alt="Create change set" height="67" width="624"><figcaption></figcaption></figure>
6. Select **Replace existing template**, then select **Amazon S3 URL**.
7. Enter this URL: `https://north-cloudformation-template-public.s3.us-east-1.amazonaws.com/billing-and-usage-read-only-cf-stack/v1/north-all-features.yaml`

   <figure><img src="https://1793025303-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FeLw7hj1pxE38VmG1sYVW%2Fuploads%2Fji8sqjOC4C6ODNdcn8P5%2Funknown.png?alt=media&amp;token=bc57e142-741d-4a89-99db-4b7dafd47651" alt="Enter North&#x27;s stack URL" height="336" width="624"><figcaption></figcaption></figure>
8. Keep the existing value of the `OrgId` parameter. If the field is empty, enter your Organizational Unit ID.
9. Select **Next** on each page until you reach the review page. Keep the stack options as they are.
10. Under **Capabilities**, acknowledge that CloudFormation might create IAM resources with custom names. The update fails without this acknowledgement.

    <figure><img src="https://1793025303-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FeLw7hj1pxE38VmG1sYVW%2Fuploads%2Fd4eOczICj1lSDrzuCBFR%2Funknown.png?alt=media&amp;token=8dd65423-ab9e-4cd2-89a7-b92d9caed6c4" alt="Click the Acknowledge checkbox" height="328" width="624"><figcaption></figcaption></figure>
11. Select **Submit** to create the change set.
12. Review the change set. It lists the action **Modify** for the IAM roles and policies. If it lists **Replacement** or **Remove** for the Cost and Usage Report bucket, stop. Ask your North Customer Success contact before you continue.

    <figure><img src="https://1793025303-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FeLw7hj1pxE38VmG1sYVW%2Fuploads%2FOV6YZ6Y3XW5h9neFjLvb%2Funknown.png?alt=media&amp;token=ee25e4a6-703f-4222-a791-8bf1df2e3d95" alt="Review change set" height="293" width="624"><figcaption></figcaption></figure>
13. Select **Execute change set**.

    <figure><img src="https://1793025303-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FeLw7hj1pxE38VmG1sYVW%2Fuploads%2FpzJ2amu5nP0Jo1pHz2s0%2Funknown.png?alt=media&amp;token=1c47501d-8896-499d-965c-7792fe765654" alt="Execute change set" height="48" width="624"><figcaption></figcaption></figure>
14. Open the **Events** tab and wait for the stack status `UPDATE_COMPLETE`. Refresh the page if the status does not change.
    {% endtab %}

{% tab title="CLI" %}
Run the following command on the AWS CLI. If your North stack has a different name, replace `NorthCloudformationAllFeatures` with that name.

{% code overflow="wrap" %}

```bash
aws cloudformation update-stack --stack-name NorthCloudformationAllFeatures --template-url https://north-cloudformation-template-public.s3.us-east-1.amazonaws.com/billing-and-usage-read-only-cf-stack/v1/north-all-features.yaml --region us-east-1 --capabilities CAPABILITY_NAMED_IAM --parameters ParameterKey=OrgId,UsePreviousValue=true
```

{% endcode %}
{% endtab %}

{% tab title="Terraform" %}

1. Copy the current Terraform file from the Terraform tab under Select your integration method.
2. Compare the file with your existing North Terraform. Apply the North changes, and keep your own changes, such as resource names, providers, and backends.
3. Run `terraform plan` in the Terraform workspace that you used for your first deployment.
4. Review the plan. Expect updates in place, marked `~`, to the IAM resources and to the tags of your Cost and Usage Report bucket. If the plan marks a role, the bucket, or the Cost and Usage Report for replacement (`-/+`) or destruction (`-`), stop. Ask your North Customer Success contact before you continue.
5. Run `terraform apply` and approve the changes. The StackSet update in member accounts can take a few minutes.

Terraform reads the existing state of that workspace and updates your existing resources. A new workspace tries to create every resource again. That fails, because your Cost and Usage Report bucket already exists.
{% endtab %}
{% endtabs %}

### If the Update Fails

If a CloudFormation update fails, the **Events** tab shows one of two stack statuses:

* **`UPDATE_ROLLBACK_COMPLETE`** - CloudFormation rolled the stack back to the previous template, and North continues to use the roles from that template. Find the first event with the status `UPDATE_FAILED`, and copy its **Status reason**.
* **`UPDATE_ROLLBACK_FAILED`** - The rollback did not complete. Do not retry the update. Copy the **Status reason**, and take a screenshot of the **Events** tab.

If the status reason states that you are not authorized to perform an action, ask an administrator of your AWS account to run the update. For any other failure, send the status reason and a screenshot of the **Events** tab to your North Customer Success contact.

If `terraform apply` fails, send the full error text to your North Customer Success contact. You can run `terraform apply` again after you fix the cause.

### Member Accounts

Your North stack adds the `NorthCloudWatchCrossAccountSharingRole` role to each member account in the Organizational Unit that you entered as `OrgId`. Member accounts that join that Organizational Unit later get the role automatically.

To include an account outside that Organizational Unit, change `OrgId` to an Organizational Unit ID that contains the account.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.north.cloud/docs/getting-started/quickstart/aws-onboarding.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.