AWS cost-management documentation change
Summary
Expanded custom billing view sharing to accounts outside the organization and added cross-organization consolidation capabilities
Security assessment
The change introduces external sharing capabilities which increases attack surface but does not address a specific security vulnerability. Security documentation is added regarding required IAM permissions for external sharing through AWS RAM.
Diff
diff --git a/cost-management/latest/userguide/billing-view-getting-started.md b/cost-management/latest/userguide/billing-view-getting-started.md index 81b9b4455..c28c39cd9 100644 --- a//cost-management/latest/userguide/billing-view-getting-started.md +++ b//cost-management/latest/userguide/billing-view-getting-started.md @@ -9 +9 @@ PrerequisitesAccessing the console to create custom billing views -Custom billing views in AWS Billing and Cost Management allow you to make cost management data accessible to member accounts within your organization. These views can only be created by the management account of an organization. By creating a custom billing view, and then sharing it with a member account, you provide that account with access to specific cost management data. End users of the member account can then select from a list of shared custom billing views in the navigation pane. For example, you can define a custom billing view to contain all cost management data for a business unit that spans multiple member accounts. When shared with a relevant member account, end users can monitor and analyze costs using Cost Explorer across all accounts and resources mapped to that business unit. This can be done without requiring direct access to the management account. +Custom billing views in AWS Billing and Cost Management allow you to make cost management data accessible to accounts both inside and outside your organization. These views can only be created by the management account of an organization. By creating and sharing a custom billing view, you provide recipient accounts with access to specific cost management data. End users of the recipient account can then select from a list of shared custom billing views in the navigation pane. For example, you can define a custom billing view to contain all cost management data for a business unit that spans multiple member accounts. When shared with a relevant accounts, end users can monitor and analyze costs using Cost Explorer across all accounts and resources mapped to that business unit without requiring direct access to the management account. Additionally, you can consolidate cost management data across multiple organizations by creating a custom billing view that combines data from multiple shared billing views, enabling centralized cost monitoring. @@ -15 +15 @@ To create custom billing views, you must use fine-grained AWS Cost Management ac -To share custom billing views with member accounts in your organization, you must access the management account of your organization using an IAM principal that has permissions to create and share resources using AWS Resource Access Manager (AWS RAM). Permissions are not required for member accounts who receive a shared custom billing view. For details about IAM actions for sharing custom billing views, see [How AWS RAM works with IAM](https://docs.aws.amazon.com/ram/latest/userguide/security-iam-policies.html) in the _AWS Resource Access Manager User Guide_. +To share custom billing views, you must access the management account of your organization using an IAM principal that has permissions to create and share resources using AWS Resource Access Manager (AWS RAM). Permissions are not required for member accounts who receive a shared custom billing view. When sharing a custom billing view outside of your organization, you must access the recipient account using an IAM principal that has permissions to accept resource invitation shares using AWS RAM. For details about IAM actions for sharing custom billing views, see [How AWS RAM works with IAM](https://docs.aws.amazon.com/ram/latest/userguide/security-iam-policies.html) in the _AWS Resource Access Manager User Guide_.