Single account

LevelFour reads your AWS costs through IAM roles it creates in your account. You can connect one account from the dashboard in a click, with a CloudFormation Launch Stack link where you enter the handshake ID LevelFour gave you, or with Terraform.

If your accounts sit under AWS Organizations, the multi-account path onboards every one of them in a single deployment.

Self-service path (recommended)

The whole flow runs from the LevelFour dashboard without an onboarding contact in the loop. Go to Connect Providers > AWS in the dashboard (https://dashboard.levelfour.ai/connect-accounts/aws) and click Connect via AWS Console. The dashboard opens AWS Console with the v2 CloudFormation template pre-loaded. Click Create stack, and the deployed stack pings LevelFour automatically.

Prerequisites

• An AWS account with permission to create IAM roles and CloudFormation stacks (typically an admin role)
• The LevelFour Handshake ID provided by your LevelFour contact

Deploy with a Launch Stack link

Use the steps below when you cannot reach the dashboard, for example when the person who holds AWS access is not the LevelFour admin.

https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate?templateURL=https://cf-templates-1bsphth8u70q9-us-east-1.s3.amazonaws.com/onboarding/v2/onboarding-levelfour-cloudformation-template.json&stackName=LevelFour

Deploy with Terraform

Use this path when you manage the account as code. Terraform deploys the same LevelFour template through an aws_cloudformation_stack resource. The roles and their permissions match the Launch Stack link, and the stack lives in your Terraform state.

provider "aws" {
  region              = "us-east-1"
  allowed_account_ids = ["<your-account-id>"]
}

variable "levelfour_handshake_id" {
  description = "The handshake ID LevelFour gave you"
  type        = string
  sensitive   = true
}

resource "aws_cloudformation_stack" "levelfour" {
  name         = "LevelFour"
  template_url = "https://cf-templates-1bsphth8u70q9-us-east-1.s3.amazonaws.com/onboarding/v2/onboarding-levelfour-cloudformation-template.json"
  capabilities = ["CAPABILITY_NAMED_IAM"]

  parameters = {
    LevelFourHandshakeID = var.levelfour_handshake_id
  }
}

output "levelfour_role_arn" {
  value = aws_cloudformation_stack.levelfour.outputs["RoleArn"]
}

output "levelfour_savings_exec_role_arn" {
  value = aws_cloudformation_stack.levelfour.outputs["SavingsExecRoleArn"]
}

export TF_VAR_levelfour_handshake_id='<your-handshake-id>'
terraform init
terraform apply

Onboarding more accounts

Repeat the deploy in each additional AWS account, using the same handshake ID. Each account gets its own role with the same predictable name. With Terraform, that is one aws_cloudformation_stack per account, each under a provider for that account.

Past three or four accounts, switch to the multi-account path.

What the stack creates

The stack creates two roles. Both trust LevelFour's AWS account (730335248431) and only accept AssumeRole requests that include your specific LevelFourHandshakeID as the external ID.

LevelFourCrossAccountRole is the read-only role LevelFour uses to analyze your costs. Its permissions:

• AWS managed ReadOnlyAccess (read-only access to all resources)
• A focused inline policy covering: Cost Explorer, Compute Optimizer, Cost Optimization Hub, Savings Plans, Pricing, AWS Support, Trusted Advisor, S3 Storage Lens, BCM Data Exports, Container Insights, and the IAM service-linked role creation needed to enroll in those services

LevelFourSavingsExec is created empty, with no attached permissions. It exists so that, when you approve a specific Automated Savings action, a scoped policy covering only that action and its resources is attached for a short, time-limited window and then expires on its own. Nothing in your account can be changed until you explicitly approve such an action.

You can review the full template before deploying:

https://cf-templates-1bsphth8u70q9-us-east-1.s3.amazonaws.com/onboarding/v2/onboarding-levelfour-cloudformation-template.json

Removing access

To revoke LevelFour's access to an account, delete the CloudFormation stack:

aws cloudformation delete-stack --stack-name LevelFour

This removes both roles (LevelFourCrossAccountRole and LevelFourSavingsExec). LevelFour stops being able to read data from that account immediately.

If you deployed with Terraform, remove the aws_cloudformation_stack.levelfour resource and its two outputs from your configuration, then run terraform apply. Do not delete the stack with the AWS CLI instead: the resource is still in your configuration, so the next terraform apply creates the stack again.

Troubleshooting

Next

• Detailed cost data turns on the Cost and Usage Report, which is what gives you resource-level and tag-level breakdowns
• Automated Savings covers the LevelFourSavingsExec role, including accounts onboarded before it existed