AWS billingconductor documentation change

Service: billingconductor · 2025-09-10 · Documentation medium

File: billingconductor/latest/userguide/security-iam-awsmanpol.md

Summary

Replaced inline IAM policies with references and detailed added permissions in AWS managed policies

Security assessment

The change updates documentation to reflect added permissions in AWS managed policies, enhancing clarity on security controls without addressing a specific security vulnerability.

Diff

diff --git a/billingconductor/latest/userguide/security-iam-awsmanpol.md b/billingconductor/latest/userguide/security-iam-awsmanpol.md
index b270b3444..5c430cf6b 100644
--- a//billingconductor/latest/userguide/security-iam-awsmanpol.md
+++ b//billingconductor/latest/userguide/security-iam-awsmanpol.md
@@ -19,15 +19 @@ The AWSBillingConductorFullAccess managed policy grants complete access to AWS B
-    
-    {
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Effect": "Allow",
-                "Action": [ 
-                   "billingconductor:*",
-                   "organizations:ListAccounts",
-                   "pricing:DescribeServices",
-                 ]
-                "Resource": "*"
-            }
-        ]
-    }
+To view the permissions for this policy, see [AWSBillingConductorFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSBillingConductorFullAccess.html) in the _AWS Managed Policy Reference_.
@@ -39,17 +25 @@ The AWSBillingConductorReadOnlyAccess managed policy grants read-only access to
-    
-    {
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Sid": "BillingConductorReadOnly",
-                "Effect": "Allow",
-                "Action": [
-                    "billingconductor:List*",
-                    "organizations:ListAccounts",
-                    "pricing:DescribeServices",
-                    "billingconductor:GetBillingGroupCostReport"
-                ],
-                "Resource": "*"
-            }
-        ]
-    }
+To view the permissions for this policy, see [AWSBillingConductorReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSBillingConductorReadOnlyAccess.html) in the _AWS Managed Policy Reference_.
@@ -62,0 +33,21 @@ Change | Description | Date
+AWSBillingConductorFullAccess \- Update to existing policies | We added the following actions to the `AWSBillingConductorFullAccess` policy:
+
+  * `organizations:ListRoots`
+  * `organizations:ListOrganizationalUnitsForParent`
+  * `organizations:ListChildren`
+  * `organizations:DescribeAccount`
+  * `pricing:GetAttributeValues`
+  * `pricing:GetProducts`
+
+| September 9, 2025  
+AWSBillingConductorReadOnlyAccess \- Update to existing policies |  We added the following actions to the `AWSBillingConductorReadOnlyAccess` policy:
+
+  * `billingconductor:GetBillingGroupCostReport`
+  * `organizations:ListRoots`
+  * `organizations:ListOrganizationalUnitsForParent`
+  * `organizations:ListChildren`
+  * `organizations:DescribeAccount`
+  * `pricing:GetAttributeValues`
+  * `pricing:GetProducts`
+
+| September 9, 2025