env0 will assume an AWS IAM Role in your account, in order to query AWS's billing API.
Read more about cross account role delegation.

To begin, log in to your AWS Console, and select the Identity and Access Management (IAM) service.

Create an AWS IAM Policy

1. Click on Policies -> Create Policy
2. Select the Cost Explorer Service
3. Select the GetCostAndUsage Action
4. Choose a name for your policy and save it.

Create an AWS IAM Role

1. Click on Roles -> Create Role
2. Under type of trusted entity select Another AWS Account
3. Under Account ID enter 913128560467
4. Select **Require external ID**
5. Enter an External ID of your choosing - consider this like a password env0 will use in order to assume the role.
6. Click Next:Permissions
7. Select the policy you created in step 2.
8. Click Next:Tags
9. Add the Key env0_environment_id and the Key env0_project_id. Values are not needed.
10. Click Next:Review
11. Enter a name for the role, and click Create Role
12. Click on the Role you just created - We will need the Role ARN and the External ID in subsequent steps.

Enable User Defined Cost Allocation Tags

1. Go to the "Billing" Service (Billing & Cost Management). You'll need to log into to the parent account, if you are using sub-accounts.
2. Under the left side menu, click Cost allocation tags.
3. Under the User-Defined Cost Allocation Tags section, check the checkboxes for the tag-keys env0_environment_id and env0_project_id.
4. Click Activate
5. After this step, it can take up to 24 hours to see actual cost values in your environments.

Add Credentials to your Organization

1. Under your Organization Settings, Select the Credentials tab
2. Under Cost Credentials, click Add Credential
3. Select the AWS Assumed Role type, and enter the Role ARN and External ID from the previous step.
4. Click Add