AWS amazonq documentation change

Service: amazonq · 2025-11-22 · Documentation medium

File: amazonq/latest/qdeveloper-ug/id-based-policy-examples-users.md

Summary

Expanded cost-related IAM policy permissions with new services and granular actions

Security assessment

Adds documentation for expanded AWS service integrations (Budgets, Free Tier, Pricing) and detailed cost management permissions, but does not address security vulnerabilities. Improves security documentation by clarifying required permissions.

Diff

diff --git a/amazonq/latest/qdeveloper-ug/id-based-policy-examples-users.md b/amazonq/latest/qdeveloper-ug/id-based-policy-examples-users.md
index f1ea4cafb..8f818c929 100644
--- a//amazonq/latest/qdeveloper-ug/id-based-policy-examples-users.md
+++ b//amazonq/latest/qdeveloper-ug/id-based-policy-examples-users.md
@@ -317 +317 @@ JSON
-The following example policy grants permission to chat with Amazon Q about your costs and allows Amazon Q to access your cost data and provide cost analysis and optimization recommendations. This policy includes the relevant permissions in AWS Cost Explorer, AWS Cost Optimization Hub, and AWS Compute Optimizer.
+The following example policy grants permission to chat with Amazon Q about your costs and allows Amazon Q to access your cost data and provide cost analysis and optimization recommendations. This policy includes permissions for AWS Cost Explorer, AWS Cost Optimization Hub, AWS Compute Optimizer, AWS Budgets, AWS Free Tier, AWS Pricing, and Savings Plans and reservation recommendations.
@@ -344 +344 @@ JSON
-          "Sid": "AllowCostAnalysis",
+          "Sid": "AllowCostExplorerAccess",
@@ -347,0 +348 @@ JSON
+            "ce:GetCostAndUsageWithResources",
@@ -348,0 +350 @@ JSON
+            "ce:GetUsageForecast",
@@ -351 +353,12 @@ JSON
-            "ce:GetDimensionValues"
+            "ce:GetDimensionValues",
+            "ce:GetSavingsPlansUtilization",
+            "ce:GetSavingsPlansCoverage",
+            "ce:GetSavingsPlansUtilizationDetails",
+            "ce:GetReservationUtilization",
+            "ce:GetReservationCoverage",
+            "ce:GetSavingsPlansPurchaseRecommendation",
+            "ce:GetReservationPurchaseRecommendation",
+            "ce:GetRightsizingRecommendation",
+            "ce:GetAnomalies",
+           "ce:GetCostAndUsageComparisons",
+           "ce:GetCostComparisonDrivers"
@@ -356 +369 @@ JSON
-          "Sid": "AllowCostOptimization",
+          "Sid": "AllowCostOptimizationHubAccess",
@@ -361 +374,8 @@ JSON
-            "cost-optimization-hub:ListRecommendationSummaries",
+            "cost-optimization-hub:ListRecommendationSummaries"
+          ],
+          "Resource": "*"
+       },
+        {
+          "Sid": "AllowComputeOptimizerAccess",
+          "Effect": "Allow",
+          "Action": [
@@ -369,3 +389,31 @@ JSON
-            "compute-optimizer:GetEffectiveRecommendationPreferences",
-            "ce:GetReservationPurchaseRecommendation",
-            "ce:GetSavingsPlansPurchaseRecommendation"
+            "compute-optimizer:GetLicenseRecommendations",
+            "compute-optimizer:GetEffectiveRecommendationPreferences"
+          ],
+          "Resource": "*"
+       },
+        {
+          "Sid": "AllowBudgetsAccess",
+          "Effect": "Allow",
+          "Action": [
+            "budgets:ViewBudget"
+          ],
+          "Resource": "*"
+       },
+        {
+          "Sid": "AllowFreeTierAccess",
+          "Effect": "Allow",
+          "Action": [
+            "freetier:GetFreeTierUsage",
+            "freetier:GetAccountPlanState",
+            "freetier:ListAccountActivities",
+           "freetier:GetAccountActivity"
+          ],
+          "Resource": "*"
+       },
+        {
+          "Sid": "AllowPricingAccess",
+          "Effect": "Allow",
+          "Action": [
+            "pricing:GetProducts",
+            "pricing:GetAttributeValues",
+            "pricing:DescribeServices"