AWS no billing

[helptec3012]

HI,
trying to use Splunk App for AWS, but no chance to get any billing into Splunk
I have multiple accounts mapped in to my main account with Consolidated Billing in AWS

How do I get Billing information into my Splunk App?
- In my app.conf I only put in the API key and Secret ID for my MAIN account only!

Do I need to enter all my API keys and Secret IDs for my accounts I have under consolidated billing? Is there a special order?
What if I do not have all Secret IDs and API keys for all accounts?

Thanks
Florian

[xueshanf]

Hi Florian,

You might have resolved your issue since it's been a while. Anyway, here is the steps that I think to setup the billing and usage configuration.

1. In your main account, enable AWS programmatic detailed billing service. It delivers CSV files to a bucket in your account
2. Create an IAM user in the main account to give it "Read Only" access to the S3 billing bucket. Assign key and key secret. Do not use your main account's key and key secret for this.
3. In aws.conf configuration, config [keys] and [misc] section with the main account's IAM user's key, key secret (e.g. the IAM user that has access to the billing S3 bucket), main account's name and account's number, and main account's S3 bucket.

Restart splunk service.

I have documented some details here.