AWS cost-management documentation change
Summary
Expanded IAM policy examples for Cost Optimization Hub enrollment with organization-wide and single-account scenarios
Security assessment
Adds detailed security policies but does not address a specific vulnerability - standard permission documentation improvement
Diff
diff --git a/cost-management/latest/userguide/coh-getting-started.md b/cost-management/latest/userguide/coh-getting-started.md index e46d91357..a28cb7994 100644 --- a/cost-management/latest/userguide/coh-getting-started.md +++ b/cost-management/latest/userguide/coh-getting-started.md @@ -46 +46,50 @@ When you opt in using your organization's management account and include all mem -The following policy statement grants you access to opt in to Cost Optimization Hub. It grants you access to create a service-linked role for Cost Optimization Hub. This role is required to opt in. For more information, see [Service-linked roles for Cost Optimization Hub](./cost-optimization-hub-SLR.html). It also grants access to update the enrollment status to the Cost Optimization Hub feature. +To opt in to Cost Optimization Hub, you need specific permissions. The required permissions differ depending on whether you're enabling it for a single account or for all accounts in your organization. + +Both policies grant permission to create the necessary service-linked role and update the Cost Optimization Hub enrollment status. For more information on service-linked roles, see [Service-linked roles for Cost Optimization Hub](./cost-optimization-hub-SLR.html). + +If enabling Cost Optimization Hub for all accounts, the management account also needs to set up AWS Organizations trusted access. For details, see [Cost Optimization Hub and AWS Organizations trusted access](https://docs.aws.amazon.com/cost-management/latest/userguide/coh-trusted-access.html). + +The following are two policy statements. Choose the appropriate one based on your needs: + +Policy for opting in all accounts in your organization + + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "iam:CreateServiceLinkedRole", + "Resource": "arn:aws:iam::*:role/aws-service-role/cost-optimization-hub.bcm.amazonaws.com/AWSServiceRoleForCostOptimizationHub", + "Condition": {"StringLike": {"iam:AWSServiceName": "cost-optimization-hub.bcm.amazonaws.com"}} + }, + { + "Effect": "Allow", + "Action": "iam:PutRolePolicy", + "Resource": "arn:aws:iam::*:role/aws-service-role/cost-optimization-hub.bcm.amazonaws.com/AWSServiceRoleForCostOptimizationHub" + }, + { + "Effect": "Allow", + "Action": [ + "organizations:EnableAWSServiceAccess" + ], + "Resource": "*", + "Condition": { + "StringLike": { + "organizations:ServicePrincipal": [ + "cost-optimization-hub.bcm.amazonaws.com" + ] + } + } + } + { + "Effect": "Allow", + "Action": "cost-optimization-hub:UpdateEnrollmentStatus", + "Resource": "*" + } + ] + } + +Policy for opting in a single account + @@ -100 +149 @@ After you enable Cost Optimization Hub, AWS starts to import cost optimization r -For Cost Optimization Hub to import recommendations from AWS Compute Optimizer, opt in to Compute Optimizer. Compute Optimizer supports standalone AWS accounts, member accounts of an organization, and the management account of an organization. For more information, see [Getting started with AWS Compute Optimizer](https://docs.aws.amazon.com/compute-optimizer/latest/ug/getting-started.html). +For Cost Optimization Hub to import recommendations from AWS Compute Optimizer, you need to opt in to Compute Optimizer. Compute Optimizer supports standalone AWS accounts, member accounts of an organization, and the management account of an organization. For more information, see [Getting started with AWS Compute Optimizer](https://docs.aws.amazon.com/compute-optimizer/latest/ug/getting-started.html). @@ -117 +166 @@ When your setup is complete, access Cost Optimization Hub. -You can opt out of Cost Optimization Hub at any time. However, the organization account can't opt out all member accounts. Each member needs to opt out at account level. +You can opt out of Cost Optimization Hub at any time. However, the organization account can't opt out for all member accounts. Each member needs to opt out at account level.