AWS billingconductor documentation change

Service: billingconductor · 2025-10-25 · Documentation medium

File: billingconductor/latest/userguide/security_iam_id-based-policy-examples.md

Summary

Added IAM policy examples for pro forma CUR creation by billing group and restored navigation links

Security assessment

Adds documentation about secure IAM policy configuration for billing data access, but does not address a specific vulnerability

Diff

diff --git a/billingconductor/latest/userguide/security_iam_id-based-policy-examples.md b/billingconductor/latest/userguide/security_iam_id-based-policy-examples.md
index 37811a9a8..3be24a33c 100644
--- a//billingconductor/latest/userguide/security_iam_id-based-policy-examples.md
+++ b//billingconductor/latest/userguide/security_iam_id-based-policy-examples.md
@@ -18,0 +19,6 @@ To learn how to create an IAM identity-based policy using these example JSON pol
+  * [AWS managed policies for AWS Billing Conductor](./security-iam-awsmanpol.html)
+
+  * [AWS Billing Conductor resource-based policy examples](./security_iam_resource-based-policy-examples.html)
+
+  * [Troubleshooting AWS Billing Conductor identity and access](./security_iam_troubleshoot.html)
+
@@ -60,0 +67,2 @@ This topic contains example policies that you can attach to your IAM user or gro
+  * Creating a pro forma CUR by billing group
+
@@ -321,0 +330,40 @@ For more information, see [AWS services that support pro forma costs](./service-
+### Creating a pro forma CUR by billing group
+
+Step 1: Allow IAM users to have full access to legacy CUR and billing group billing view.
+    
+    
+    {
+        "Version": "2012-10-17",		 	 	 
+        "Statement": [
+            {
+            "Sid": "CurDataAccess",
+            "Effect": "Allow",
+            "Action": "cur:PutReportDefinition",
+            "Resource": [
+                "arn:*:cur:*:*:definition/*",
+                "arn:aws:billing::*:billingview/*"
+            ]
+          }
+        ]
+    }
+
+Step 2: To assign IAM roles to have access to specific billing groups, add the billing view ARN the user can access.
+    
+    
+    {
+        "Version": "2012-10-17",		 	 	 
+        "Statement": [
+            {
+                "Sid": "CurDataAccess",
+                "Effect": "Allow",
+                "Action": "cur:PutReportDefinition",
+                "Resource":[
+                    "arn:aws:cur:us-east-1:123456789012:definition/*",
+                    "arn:aws:billing::AWS-account-ID:billingview/billing-group-$billinggroup-primary-account-ID"
+                    ]
+            }
+        ]
+    }
+
+For more information, see [Configuring Cost and Usage Reports by billing group](./configuring-abc.html).
+