Cloud Capital purchases AWS Savings Plans and Reserved Instances on your behalf using a dedicated AWS account and a cross-account IAM role. No root access to your AWS Organization is required, and your existing AWS Organization structure, account ownership, and infrastructure are not affected.Documentation Index
Fetch the complete documentation index at: https://docs.cloudcapital.co/llms.txt
Use this file to discover all available pages before exploring further.
How commitment purchasing works
Cloud Capital purchases commitments into a dedicated, empty AWS account that you create within your existing AWS Organization. This is how AWS Savings Plans and Reserved Instances are designed to work: when purchased in any account within an AWS Organization, the discount automatically applies to matching usage across all member accounts in the Organization — not just the account where the commitment was purchased. AWS handles this distribution automatically, with no additional configuration required on your end. The dedicated account stays empty of workloads by design. Because AWS applies commitment discounts to wherever the matching usage occurs across your Organization, keeping the purchasing account empty ensures the full benefit flows to your actual workloads. Cloud Capital accesses this account through an IAM role provisioned via CloudFormation. The role is scoped exclusively to purchasing and managing commitments — it has no read access to your cost data and no visibility into any of your workload accounts.Root access to your AWS Organization or management account is not required at any point. All purchasing is performed through the scoped IAM role in the dedicated commitment account.
Commitment models
Cloud Capital supports two commitment purchasing models depending on your AWS relationship:AWS Billing Transfer customers
If you are an AWS Billing Transfer customer, Cloud Capital is your payer of record. Commitments are purchased on your behalf through the dedicated commitment account within your AWS Organization, and discounts flow across your member accounts automatically. Follow the setup steps below.In-Place commitment customers
If your organization has a direct AWS relationship — including a Private Pricing Agreement (PPA), Enterprise Discount Program (EDP), or if you are working with an AWS Managed Service Provider (MSP) — Cloud Capital can purchase commitments in-place within your existing AWS Organization. The setup is the same: create a dedicated, empty account in your Organization and deploy the Optimization CloudFormation stack into it. Cloud Capital purchases commitments through that account, and AWS distributes the discounts across your Organization as normal. Your direct AWS relationship, PPA/EDP pricing, and MSP arrangement are all preserved.In-Place commitments work identically to Billing Transfer from a technical standpoint. The difference is only in who acts as the payer of record — your existing arrangement with AWS remains unchanged.
Setting up the dedicated commitment account
What Cloud Capital accesses
The Optimization CloudFormation template creates an IAM role scoped exclusively to purchasing and managing commitments in the dedicated account.| Purpose | AWS Services Used |
|---|---|
| Purchase and manage Savings Plans | savingsplans:* |
| Purchase EC2 Reserved Instances | ec2:PurchaseReservedInstancesOffering and related EC2 RI actions |
| Purchase RDS, Redshift, ElastiCache, and OpenSearch Reserved Instances | rds:PurchaseReservedDbInstancesOffering, redshift:PurchaseReservedNodeOffering, elasticache:PurchaseReservedCacheNodesOffering, es:PurchaseReservedInstanceOffering |
| Create service-linked roles required by AWS during first purchase | iam:CreateServiceLinkedRole |
| Manage service quota increases when required | servicequotas:*, support:* |
The Optimization role has no read access to your cost data, billing APIs, or any of your workload accounts. It is scoped exclusively to the dedicated commitment account and can only take the purchasing actions listed above.
Setup
Create a dedicated commitment account
In your AWS Organization, create a new empty account. This account will hold all commitments Cloud Capital purchases on your behalf. It must contain no running workloads or resources — this ensures AWS distributes commitment discounts optimally across your Organization.See Creating an AWS account in your organization in the AWS documentation.
Deploy the Optimization CloudFormation stack
In the dedicated commitment account, deploy the Optimization CloudFormation template. Cloud Capital pre-populates the required parameters — no manual entry needed.Once the stack completes, copy the Role ARN from the stack Outputs tab.
What Cloud Capital can and cannot do
| Commitment purchasing account | Management / payer account | |
|---|---|---|
| Purchase Savings Plans and Reserved Instances | Yes | No |
| Read cost and usage data (CUR, billing, pricing APIs) | No | Yes — via the Forecasting role |
| Access running workloads or resources | No | No |
| Modify IAM policies or account settings | No | No |
| Revoke at any time | Yes — delete the Optimization CloudFormation stack | Yes — delete the Forecasting CloudFormation stack |
All commitment customers must also have the Forecasting role deployed. Cloud Capital uses that role — installed in your management or payer account — to read cost and usage data and size commitments accurately. The two roles are separate and independently revocable.