Page Comparison

...

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<LHM_App_Host_AWS_Account_ID>:role/<LHM_App_IAM_Role>"
            },
            "Action": "sts:AssumeRole",
        }
    ]
}

Permissions for cost-tagging NAT and S3

In order to obtain workspace storage and network costs, the LHO should be provided permissions to tag S3 bucket and NAT Gateway associated with the DBX

IAM_Role_Cost_Tag_For_S3_And_NAT permission policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "BplmNatGatewayTaggingPolicy",
            "Effect": "Allow",
            "Action": [
                "ec2:DeleteTags",
                "ec2:CreateTags"
            ],
            "Resource": "arn:aws:ec2:*:<Databricks_Wksp_AWS_Account_Id>:natgateway/*"
        }
    ]
}

Trust policy for the IAM_Role_Cost_Tag_For_S3_And_NAT that allows the LHO Application IAM Role in the app-host AWS Account to assume the role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<LHM_App_Host_AWS_Account_ID>:role/<LHM_App_IAM_Role>"
            },
            "Action": "sts:AssumeRole",
        }
    ]
}

LHO application IAM Role permission policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AssumeCostExplorerRole",
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::<Databricks_Wksp_AWS_Account_Id>:role/<IAM_Role_Cost_Explorer>"
        },
        {
            "Sid": "AssumeS3AndNatTagRole",
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::<Databricks_Wksp_AWS_Account_Id>:role/<IAM_Role_Cost_Tag_For_S3_And_NAT>"
        }
    ]
}

And in the Lakehouse Monitor .env config file provide the source role name for cost explorer and tags.

CROSS_ACCOUNT_ASSUME_IAM_ROLE_COST_EXPLORER_APP=arn:aws:iam::<Databricks_Wksp_AWS_Account_Id>:role/<IAM_Role_Cost_Explorer>
CROSS_ACCOUNT_ASSUME_IAM_ROLE_TAG_WORKSPACE_RESOURCE_APP=arn:aws:iam::<Databricks_Wksp_AWS_Account_Id>:role/<IAM_Role_Cost_Tag_For_S3_And_NAT>

In case of multiple AWS accounts hosting cloud resources for Databricks workspaces, you need to provide a role for each of them comma-separated.