Overview

Torii integrates with AWS Marketplace and analyzes SaaS expenses:

• Torii will automatically match transactions to the correct application, summarize expenses and provide insights.
• Torii supports syncing multiple AWS Marketplace accounts.
• Torii syncs transaction data up to one year prior to first connection date.
• You can constantly stay updated with application information from our Integrations Page
  >> Integration Capabilities button >> Integration Capabilities table.

Requirements

Accounts & Permissions

• An AWS account where you receive AWS Marketplace charges, with admin access to create IAM Policies and Roles.
• AWS Cost Explorer must be enabled in that account (it may take ~24 hours for the first data to appear after enabling).

Required keys

• To connect this integration, we require the following:
  • Role ARN (Required)

How to Generate the Required Values

Step 1: Enable AWS Cost Explorer

1. Open the AWS Billing console and go to Cost Explorer.
2. Click Enable Cost Explorer. Initial data may take up to ~24 hours to populate.

Step 2: Create the IAM Policy

1. Navigate to the IAM page in your AWS Console.
2. Click Policies → Create Policy.
3. In the JSON tab, paste the following:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ce:GetCostAndUsage"
      ],
      "Resource": "*"
    }
  ]
}

1. Click Next, name the policy (for example, torii-marketplace-policy), and click Create Policy.

Step 3: Create the IAM Role

1. Go to Roles → Create Role.
2. Choose AWS Account → Custom trust policy.
3. Paste the JSON below and replace sts:ExternalId with your Torii organization ID.
   • (You can find your Org ID in the Torii URL: e.g., from https://app.toriihq.com/team/123456, the Org ID is 123456.)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::458158785647:role/torii-integration-delegator"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<Enter Your Torii Organization Id Here>"
        }
      }
    }
  ]
}

1. Click Next. Search for the policy you created in Step 2, select it, and click Next.
2. Name the role (for example, torii-marketplace-role) and click Create Role.
3. After creation, search for the role and copy its ARN.

This trust policy adds two security protections:

• Least-privilege access: only Torii’s dedicated integration role (torii-integration-delegator) is allowed to assume this role.
• External ID validation: Torii must present your unique Torii organization ID when assuming the role, adding protection against unauthorized access and the confused-deputy problem.

How to Connect the Integration

1. Go to the Integrations page in Torii.
2. Search for AWS Marketplace and click Connect.
3. Enter the required values:
   • Role ARN (required)
4. Click Connect to finalize the integration.

Additional Notes

• Transactions are synced once daily. On each sync, the most recent 30 days are re-fetched to capture any back-dated charges from AWS.
• Coverage is limited to charges where BILLING_ENTITY = AWS Marketplace — direct AWS service usage (e.g., EC2, S3) is not included.

For any further questions, please contact Torii Support.