AWS cost-management medium security documentation change
Summary
Added 'Pricing and cost estimation permissions' section with IAM policy example, removed explicit mention of requiring 'ce:GetCostAndUsage' permission, clarified that pricing data excludes customer-specific discounts, and updated cross-region call details.
Security assessment
The addition of pricing-related IAM permissions and explicit clarification about customer-specific discounts not being reflected directly addresses access control and data exposure risks. The policy changes impact security by defining granular permissions for pricing APIs and preventing potential leakage of sensitive discount information.
Diff
diff --git a/cost-management/latest/userguide/ce-q-security.md b/cost-management/latest/userguide/ce-q-security.md index 113af57d5..cdcee59f3 100644 --- a//cost-management/latest/userguide/ce-q-security.md +++ b//cost-management/latest/userguide/ce-q-security.md @@ -5 +5 @@ -Cost analysis permissionsCost optimization permissionsq:PassRequest permissionCross-region callsData protection +Cost analysis permissionsCost optimization permissionsPricing and cost estimation permissionsq:PassRequest permissionCross-region callsData protection @@ -13 +13 @@ The following provides an overview of permissions and data protection for the co -All cost data provided by Amazon Q Developer is sourced from Cost Explorer. The IAM user who accesses the cost analysis capability in Amazon Q Developer must have permissions to use Amazon Q Developer and permissions to retrieve cost and usage data from Cost Explorer. The quickest way for an administrator to grant users access to Amazon Q Developer is to use the `AmazonQFullAccess` managed policy. Users also need access to the `ce:GetCostAndUsage` permission. +All cost data provided by Amazon Q Developer is sourced from Cost Explorer. The IAM user who accesses the cost analysis capability in Amazon Q Developer must have permissions to use Amazon Q Developer and permissions to retrieve cost and usage data from Cost Explorer. The quickest way for an administrator to grant users access to Amazon Q Developer is to use the `AmazonQFullAccess` managed policy. @@ -91,0 +92,26 @@ JSON +## Pricing and cost estimation permissions + +The following IAM policy statement grants users access to the pricing and cost estimation capability in Amazon Q Developer: + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "EnablesCostOptimizationInAmazonQ", + "Effect": "Allow", + "Action": [ + "q:StartConversation", + "q:SendMessage", + "q:GetConversation", + "q:ListConversations", + "q:PassRequest", + "pricing:DescribeServices", + "pricing:GetAttributeValues", + "pricing:GetProducts" + ], + "Resource": "*" + } + ] + } + @@ -94 +120 @@ JSON -`q:PassRequest` is an Amazon Q Developer permission that allows Amazon Q Developer to call AWS APIs on your behalf. When you add the `q:PassRequest` permission to an IAM identity, Amazon Q Developer gains permission to call any API that the IAM identity has permission to call. For example, if an IAM role has the `ce:GetCostAndUsage` permission and the `q:PassRequest` permission, Amazon Q Developer is able to call the GetCostAndUsage API when a user assuming that IAM role asks Amazon Q Developer to retrieve cost and usage data from Cost Explorer. +`q:PassRequest` is an Amazon Q Developer permission that allows Amazon Q Developer to call AWS APIs on your behalf. When you add the `q:PassRequest` permission to an IAM identity, Amazon Q Developer gains permission to call any API that the IAM identity has permission to call. For example, if an IAM role has the `ce:GetCostAndUsage` permission and the `q:PassRequest` permission, Amazon Q Developer can call the GetCostAndUsage API when a user assuming that IAM role asks Amazon Q Developer to retrieve cost and usage data from Cost Explorer. @@ -139 +165 @@ JSON -For users of AWS Organizations, management account administrators can restrict member account users’ access to Cost Explorer and Cost Optimization Hub data (including access to discounts, credits, and refunds) using the Cost Management preferences in the AWS Billing and Cost Management console. These preferences apply to Amazon Q Developer in the same way that they apply to the management console, SDK, and CLI. Amazon Q Developer respects the existing preferences of customers. +For users of AWS Organizations, management account administrators can restrict member account users’ access to Cost Explorer and Cost Optimization Hub data (including access to discounts, credits, and refunds) using the Cost Management preferences in the AWS Billing and Cost Management console. These preferences apply to Amazon Q Developer in the same way that they apply to the management console, SDK, and CLI. Amazon Q Developer respects the existing preferences of customers. Note that the pricing and cost estimation capabilities in Amazon Q Developer only provide public pricing data; customer-specific discounts are not reflected. @@ -143 +169 @@ For users of AWS Organizations, management account administrators can restrict m -Data from the Cost Optimization Hub and Cost Explorer services is hosted in the US East (N. Virginia) Region. Data from AWS Compute Optimizer is hosted in the AWS Region where the underlying resources, such as EC2 instances, are located. Cost analysis and cost optimization requests may require cross-region calls. For more information, see [Cross-region processing in Amazon Q Developer](https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/cross-region-processing.html) in the _Amazon Q Developer User Guide_. +Data from the Cost Optimization Hub and Cost Explorer services is hosted in the US East (N. Virginia) Region. Data from AWS Compute Optimizer is hosted in the AWS Region where the underlying resources, such as EC2 instances, are located. Data served from the AWS Price List APIs is hosted in us-east-1, eu-central-1, and ap-south-1 (note that AWS Price List APIs do not serve any customer-specific data). Cost management requests in Amazon Q Developer may require cross-region calls. For more information, see [Cross-region processing in Amazon Q Developer](https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/cross-region-processing.html) in the _Amazon Q Developer User Guide_.