All Apps and Add-ons

AWS No billing from Consolidated Child account

wstallwood
New Member

Hi,

I have the AWS app configured to monitor a child account that has been consolidated, I don't have access to the account the bills are consolidated to but we do have a lambda function in place which copies the billing reports to an S3 bucket in the child account.

When I set up the AWS App for my account and go to the billing dashboard I get the following warning:

Some panels in this dashboard may not display correctly because you do not have the following inputs configured: CloudWatch - AWS/Billing

Cloudwatch is configured, so I am confused by that error, I saw the error when I removed US-East so put that region back, but it doesn't enabled any extra sources when I do.

Billing is configured and if I go back into the input configuration I can see:

Monthly cost allocation report (Currently 2 files to index, approximately <1MB.)
Detailed billing report with resources and tags (Currently 2 files to index, approximately 120MB. Learn more )

So it sees the files but seems to be somewhat confused as they never get indexed.

Anyone have ideas as to what is going wrong ?

0 Karma

wstallwood
New Member

Thanks for your help,

That is really unfortunate as there are commercial reasons why we cannot grant access to the billing account, might actually spanner the deployment of splunk for this purpose here (and anywhere else where services are being provided by an AWS Reseller Partner)

I don't get why they aren't accessing the data via the billing and cost management portal api. Which is available in child accounts, I might have to dig a bit deeper and see if I can do it myself, the AWS billing console in the child account has what I need, I just wanted to report on it via Splunk.

Also not getting the historical reports either but I'll look into that once I am back at work tomorrow.

Thanks again for your help.

0 Karma

stboch
SplunkTrust
SplunkTrust

Hi WStallWood,

There is two parts to the AWS billing features in the new splunk app. I learned the hard way, as well. The issue your having is with the lack of the Cloudwatch based billing reports. Unfortunately this is only available to the consolidated billing account and would require you to be permitted access to those cloudwatch metrics.

However, The historical reports should work via the dashboard.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...