Amazon Web Services checklist · Wiv onboarding checklist

Before you start

Verify these in the AWS Management (payer) account. The stack pre-checks them and fails fast if any are missing.

0/8

Sign in to the AWS Management (payer) account
The stack must run from the root account of your AWS Organization — the one that receives the consolidated bill.
Switch the console to us-east-1 (N. Virginia)
CUR and BCM Data Exports APIs only exist in us-east-1. The stack refuses to deploy anywhere else.
Confirm you have fewer than 10 CUR reports
AWS allows 10 Cost & Usage Reports per account. Wiv needs one free slot.
Confirm Lambda unreserved concurrency is at least 102
The onboarding Lambdas need headroom. Request an increase in the Service Quotas console if needed.
Enable "All features" in AWS Organizations
Required for StackSets, Compute Optimizer and Cost Optimization Hub. Consolidated billing only is not enough.
Make sure you can create one more S3 bucket
Onboarding creates wiv-cur-{AccountId} to store CUR data.
Use an IAM role that can deploy the stack
CloudFormation, IAM, S3, Lambda, Glue, Athena, CUR/BCM Data Exports, Organizations and Cost Explorer permissions are needed.
Enable resource-level data at daily granularity
Lets Wiv attribute costs to individual resources. No additional AWS charge.

The stack takes about five minutes. Keep the Wiv tab open while CloudFormation runs.

0/5

In Wiv, go to Integrations → AWS → New AWS integration
Give the integration a name. Open your AWS payer account in another tab first so the stack lands in the right account.
Click "Connect via CloudFormation"
CloudFormation opens in your payer account with every parameter pre-filled by Wiv.
Review the stack parameters — keep the defaults
External ID, Integration Name and OnBoarding ID are pre-filled; do not change them.
Tick both IAM acknowledgement checkboxes and click Create stack
Wiv shows "Deployment in progress" until the stack completes.
Wait until every nested stack shows CREATE_COMPLETE
Roughly five minutes. The PreCheck Lambda fails early if a prerequisite is missing — fix it and retry.

WivAccessRole is deployed to member accounts through the WivOrgStackSet.

0/3

Check WivOrgStackSet → Stack instances lists your linked accounts
With "Deploy Organization Role StackSet" left at Yes the role is deployed across the whole organization automatically.
Add missing OUs or accounts to the StackSetOptional
Only needed when some accounts were skipped.
Confirm the Operations tab shows SUCCEEDED
New accounts joining the organization are covered by auto-deployment.

0/4

The integration shows as connected under Integrations → AWS
Allow up to 24 hours for CUR data to appear
The first Cost & Usage Report delivery is scheduled by AWS. Cost dashboards fill in once it lands.
Share the permissions and architecture references with your security teamOptional
Review the estimated monthly cost of the stack resourcesOptional
S3, Lambda, Glue, Athena and CloudWatch resources created in your account.