AWS cost-management documentation change
Summary
Added documentation for Billing and Cost Management recommended actions policies, specifying required IAM permissions for various recommended action types
Security assessment
The change adds documentation about required IAM permissions for accessing specific billing/cost management recommended actions. While this relates to access control (a security concept), there's no evidence of addressing a specific vulnerability. It enhances security documentation by clarifying permission requirements for financial operations.
Diff
diff --git a/cost-management/latest/userguide/billing-permissions-ref.md b/cost-management/latest/userguide/billing-permissions-ref.md index c954d16e7..446e2c682 100644 --- a//cost-management/latest/userguide/billing-permissions-ref.md +++ b//cost-management/latest/userguide/billing-permissions-ref.md @@ -5 +5 @@ -Billing and Cost Management actions policiesManaged policiesPolicy updates +Billing and Cost Management actions policiesBilling and Cost Management recommended actions policiesManaged policiesPolicy updates @@ -37,0 +38,2 @@ For information on how you can update customer managed policies, see [Editing cu + * Billing and Cost Management recommended actions policies + @@ -106,0 +109,170 @@ To allow users to modify these console pages, you must allow both `ModifyBilling +## Billing and Cost Management recommended actions policies + +To get started with recommended actions, you need to have the following core permission: + + * `bcm-recommended-actions:ListRecommendedActions` + + + + +Additional permissions are then required based on recommended action type. The following table summarizes the different recommended action types and the corresponding IAM policy permissions needed in order to see the recommended actions. + +###### Note + +Even with a granted IAM policy permission, the corresponding recommended action type is only seen if the recommended action actually applies. + +Recommended action type | Required permission name | Description +---|---|--- +Expired payment method | + + + "bcm-recommended-actions:ListRecommendedActions", + "payments:ListPaymentPreferences", + "payments:GetPaymentInstrument" + + +| For payment-related recommended actions. +Invalid payment method | + + + "bcm-recommended-actions:ListRecommendedActions", + "payments:ListPaymentPreferences", + "payments:GetPaymentInstrument" + + +| For payment-related recommended actions. +Payments past due | + + + "bcm-recommended-actions:ListRecommendedActions", + "payments:GetPaymentStatus" + +| For payment-related recommended actions. +Payments due | + + + "bcm-recommended-actions:ListRecommendedActions", + "payments:GetPaymentStatus" + +| For payment-related recommended actions. +Fix tax registration information | + + + "bcm-recommended-actions:ListRecommendedActions", + "tax:GetTaxRegistration" + +| For recommended actions related to tax settings. +Update tax exemption certificate | + + + "bcm-recommended-actions:ListRecommendedActions", + "tax:GetExemptions" + +| For recommended actions related to tax settings. +Migrate to granular permissions | + + + "bcm-recommended-actions:ListRecommendedActions", + "aws-portal:GetConsoleActionSetEnforced", + "ce:GetConsoleActionSetEnforced", + "purchase-orders:GetConsoleActionSetEnforced" + + +| For recommended actions related to IAM permissions. +Review budget alerts | + + + "bcm-recommended-actions:ListRecommendedActions", + "budgets:DescribeBudgetNotificationsForAccount", + "budgets:DescribeBudget" + +| For budget-related recommended actions. +Review budgets exceeded | + + + "bcm-recommended-actions:ListRecommendedActions", + "budgets:DescribeBudgets" + +| For budget-related recommended actions. +Review Free Tier usage alerts | + + + "bcm-recommended-actions:ListRecommendedActions", + "freetier:GetFreeTierUsage" + +| For recommended actions related to Free Tier. +Review anomalies | + + + "bcm-recommended-actions:ListRecommendedActions", + "ce:GetAnomalies" + +| For recommended actions related to cost anomaly detection. +Review expiring reservations | + + + "bcm-recommended-actions:ListRecommendedActions", + "ce:GetReservationUtilization" + +| For recommended actions related to cost optimization. +Review expiring Savings Plans | + + + "bcm-recommended-actions:ListRecommendedActions", + "ce:GetSavingsPlansUtilizationDetails" + +| For recommended actions related to cost optimization. +Review savings opportunity recommendations | + + + "bcm-recommended-actions:ListRecommendedActions", + "cost-optimization-hub:ListEnrollmentStatuses", + "cost-optimization-hub:ListRecommendationSummaries" + + +| For recommended actions related to cost optimization. +Enable Cost Optimization Hub | + + + "bcm-recommended-actions:ListRecommendedActions", + "cost-optimization-hub:ListEnrollmentStatuses" + +| For recommended actions related to cost optimization. +Create a budget | + + + "bcm-recommended-actions:ListRecommendedActions", + "budgets:DescribeBudgets" + +| For budget-related recommended actions. +Create a reservation budget | + + + "bcm-recommended-actions:ListRecommendedActions", + "budgets:DescribeBudgets", + "ce:GetReservationUtilization" + +| For budget-related recommended actions. +Create a Savings Plans budget | + + + "bcm-recommended-actions:ListRecommendedActions", + "budgets:DescribeBudgets", + "ce:GetSavingsPlansUtilizationDetails" + +| For budget-related recommended actions. +Add an alternate billing contact | + + + "bcm-recommended-actions:ListRecommendedActions", + "account:GetAlternateContact" + +| For account-related recommended actions. +Create an anomaly monitor | + + + "bcm-recommended-actions:ListRecommendedActions", + "ce:GetAnomalyMonitors" + +| For recommended actions related to cost anomaly detection. +