Automated Savings

Automated Savings attaches a scoped, time-limited IAM policy to a dedicated role named LevelFourSavingsExec whenever you approve a specific savings action, then removes it when the action finishes. Accounts onboarded before this role existed do not have it. You enable it once per account by creating the empty role. Accounts onboarded with the current templates already have it, and need nothing here.

The role is created empty, with no attached permissions, and it trusts only LevelFour's AWS account (730335248431), gated by your handshake ID. See what the onboarding stack creates for the full trust model.

However you create the LevelFourSavingsExec role (AWS Console, Terraform, a CloudFormation StackSet, or by hand in IAM), LevelFour detects it automatically and clears the update prompt in the dashboard. You do not need to use the in-app link or notify anyone.

One account

Pick the route that matches how you manage the account. Both end at the same empty role.

The fastest path for a single account is the dashboard. Go to Connect Providers > AWS (https://dashboard.levelfour.ai/connect-accounts/aws). If any connected account is missing the role, an "update available" notice appears with an Update via AWS Console button that opens CloudFormation with the enablement template pre-loaded.

You can also skip the dashboard. Sign in to the account you want to enable, then use the Launch Stack link:

https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate?templateURL=https://cf-templates-1bsphth8u70q9-us-east-1.s3.amazonaws.com/onboarding/v2/onboarding-levelfour-enable-savings.template.json&stackName=LevelFour-Enable-Savings&param_LevelFourHandshakeID=

Enter your LevelFourHandshakeID (the value LevelFour gave you), tick the IAM capability acknowledgement, and click Create stack. The stack creates only the empty LevelFourSavingsExec role and finishes in about 30 to 60 seconds.

This stack only adds the role, so it is safe to run in an account that is already connected to LevelFour.

If CloudFormation reports that LevelFourSavingsExec already exists, that account is already enabled and there is nothing to do.

Add the role to the configuration you already use for this account.

levelfour-savings-exec.tf

variable "levelfour_handshake_id" {
  type        = string
  description = "The handshake ID LevelFour provided. Treat it like a secret."
}

resource "aws_iam_role" "levelfour_savings_exec" {
  name = "LevelFourSavingsExec"
  path = "/"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { AWS = "arn:aws:iam::730335248431:root" }
      Action    = "sts:AssumeRole"
      Condition = {
        StringEquals = { "sts:ExternalId" = var.levelfour_handshake_id }
      }
    }]
  })
}

Apply it the same way you manage the rest of the account. LevelFour picks up the role on its next probe.

Across an AWS Organization

Act only if your organization was onboarded before the role was added to the per-account onboarding template. In that case, redeploy the current onboarding template to your member accounts.

If you created the StackSet directly with the AWS CLI, update it in place. This re-fetches the current template and rolls it out to every targeted account:

aws cloudformation update-stack-set \
  --stack-set-name LevelFour-Onboarding \
  --template-url https://cf-templates-1bsphth8u70q9-us-east-1.s3.amazonaws.com/onboarding/v2/onboarding-levelfour-cloudformation-template.json \
  --capabilities CAPABILITY_NAMED_IAM \
  --parameters ParameterKey=LevelFourHandshakeID,UsePreviousValue=true

If you onboarded with the Launch Stack wrapper, manage the rollout through that wrapper stack rather than updating the StackSet directly, to avoid drift. See multi-account onboarding for the StackSet setup, prerequisites, and template URLs.

The management account is covered separately. AWS Organizations excludes it from service-managed StackSet targeting, so enable it with the one account routes above.

Prefer Terraform for your organization? Add the aws_iam_role from the Terraform tab above to the per-account module or StackSet template you already use to manage LevelFourCrossAccountRole.

Confirming it worked

Once the role exists, open Connect Providers > AWS in the dashboard.

The update notice and the header indicator clear on their own within about a minute. Automated Savings actions that previously reported "not enabled" will then run.

Use Re-check on the notice if you want to confirm immediately after applying with Terraform or the CLI.

For an organization rollout, multi-account onboarding covers reading the StackSet's per-account rollout status.

Removing access

Deleting the stack (or StackSet) that created the role removes it. If you manage it in Terraform, terraform destroy does the same. Deleting the empty role has no effect on the read-only LevelFourCrossAccountRole that LevelFour uses to analyze costs.

What the onboarding stack creates is the full trust model for both roles
Multi-account onboarding is the StackSet setup, prerequisites and template URLs
l4 rec execute is what an approved action runs

Automated Savings

One account

Across an AWS Organization

Confirming it worked

Removing access

Next

On this page