AWS cost-management documentation change
Summary
Restructured permissions documentation with granular IAM policy breakdowns, added new Cost Explorer actions, removed redundant sections, and clarified multi-account access controls
Security assessment
The changes improve security documentation by providing more granular IAM policy examples with specific actions (e.g., ce:GetCostAndUsageWithResources, compute-optimizer actions) and explicit guidance on scoping permissions. However, there's no evidence this addresses a specific security vulnerability - it appears to be routine documentation improvement for clarity and completeness.
Diff
diff --git a/cost-management/latest/userguide/ce-q-security.md b/cost-management/latest/userguide/ce-q-security.md index 3130556b4..64ef50b0b 100644 --- a//cost-management/latest/userguide/ce-q-security.md +++ b//cost-management/latest/userguide/ce-q-security.md @@ -5 +5 @@ -Cost analysis permissionsCost optimization permissionsPricing and cost estimation permissionsq:PassRequest permissionCross-region callsData protection +Permissions overviewPermissions for cost management capabilitiesq:PassRequest permissionMulti-account accessCross-region callsData protection @@ -11 +11 @@ The following provides an overview of permissions and data protection for the co -## Cost analysis permissions +## Permissions overview @@ -13 +13 @@ The following provides an overview of permissions and data protection for the co -All cost data provided by Amazon Q Developer is sourced from Cost Explorer. The IAM user who accesses the cost analysis capability in Amazon Q Developer must have permissions to use Amazon Q Developer and permissions to retrieve cost and usage data from Cost Explorer. The quickest way for an administrator to grant users access to Amazon Q Developer is to use the `AmazonQFullAccess` managed policy. +To use the cost management capabilities in Amazon Q Developer, you need three sets of Identity and Access Management (IAM) permissions: @@ -15 +15 @@ All cost data provided by Amazon Q Developer is sourced from Cost Explorer. The -The following IAM policy statement grants users access to the cost analysis capability in Amazon Q Developer: + 1. **Amazon Q permissions** : Permissions to chat with Amazon Q in the console (such as `q:StartConversation` and q:SendMessage) @@ -17 +17 @@ The following IAM policy statement grants users access to the cost analysis capa -JSON + 2. **Service permissions** : Permissions to access the underlying Billing and Cost Management services that provide cost data @@ -18,0 +19 @@ JSON + 3. **PassRequest permission** : The `q:PassRequest` permission that allows Amazon Q to call AWS APIs on your behalf @@ -20 +20,0 @@ JSON -**** @@ -23,0 +24,7 @@ JSON +The quickest way for an administrator to grant users access to Amazon Q Developer is to use the `AmazonQFullAccess` managed policy. + +## Permissions for cost management capabilities + +The following IAM policy statement grants users access to all cost management capabilities in Amazon Q Developer: + + @@ -28 +35 @@ JSON - "Sid": "EnablesCostAnalysisInAmazonQ", + "Sid": "AllowAmazonQChatAndPassRequest", @@ -35 +42,10 @@ JSON - "q:PassRequest", + "q:UpdateConversation", + "q:DeleteConversation", + "q:PassRequest" + ], + "Resource": "*" + }, + { + "Sid": "AllowCostExplorerAccess", + "Effect": "Allow", + "Action": [ @@ -36,0 +53 @@ JSON + "ce:GetCostAndUsageWithResources", @@ -38 +55 @@ JSON - "ce:GetDimensionValues", + "ce:GetUsageForecast", @@ -40 +57,13 @@ JSON - "ce:GetCostCategories" + "ce:GetCostCategories", + "ce:GetDimensionValues", + "ce:GetSavingsPlansUtilization", + "ce:GetSavingsPlansCoverage", + "ce:GetSavingsPlansUtilizationDetails", + "ce:GetReservationUtilization", + "ce:GetReservationCoverage", + "ce:GetSavingsPlansPurchaseRecommendation", + "ce:GetReservationPurchaseRecommendation", + "ce:GetRightsizingRecommendation", + "ce:GetAnomalies", + "ce:GetCostAndUsageComparisons", + "ce:GetCostComparisonDrivers" @@ -43,20 +72 @@ JSON - } - ] - } - - - -## Cost optimization permissions - -The following IAM policy statement grants users access to the cost optimization capability in Amazon Q Developer: - -JSON - - -**** - - - - { - "Version":"2012-10-17", - "Statement": [ + }, @@ -64 +74 @@ JSON - "Sid": "EnablesCostOptimizationInAmazonQ", + "Sid": "AllowCostOptimizationHubAccess", @@ -67,5 +76,0 @@ JSON - "q:StartConversation", - "q:SendMessage", - "q:GetConversation", - "q:ListConversations", - "q:PassRequest", @@ -74 +79,8 @@ JSON - "cost-optimization-hub:ListRecommendationSummaries", + "cost-optimization-hub:ListRecommendationSummaries" + ], + "Resource": "*" + }, + { + "Sid": "AllowComputeOptimizerAccess", + "Effect": "Allow", + "Action": [ @@ -79 +90,0 @@ JSON - "compute-optimizer:GetLambdaFunctionRecommendations", @@ -80,0 +92 @@ JSON + "compute-optimizer:GetLambdaFunctionRecommendations", @@ -82,3 +94,2 @@ JSON - "compute-optimizer:GetEffectiveRecommendationPreferences", - "ce:GetReservationPurchaseRecommendation", - "ce:GetSavingsPlansPurchaseRecommendation" + "compute-optimizer:GetLicenseRecommendations", + "compute-optimizer:GetEffectiveRecommendationPreferences" @@ -87,16 +98 @@ JSON - } - ] - } - - -## Pricing and cost estimation permissions - -The following IAM policy statement grants users access to the pricing and cost estimation capability in Amazon Q Developer: - -JSON - - -**** - - - + }, @@ -104,2 +100,7 @@ JSON - "Version":"2012-10-17", - "Statement": [ + "Sid": "AllowBudgetsAccess", + "Effect": "Allow", + "Action": [ + "budgets:ViewBudget" + ], + "Resource": "*" + }, @@ -107 +108 @@ JSON - "Sid": "EnablesCostOptimizationInAmazonQ", + "Sid": "AllowFreeTierAccess", @@ -110,6 +111,12 @@ JSON - "q:StartConversation", - "q:SendMessage", - "q:GetConversation", - "q:ListConversations", - "q:PassRequest", - "pricing:DescribeServices", + "freetier:GetFreeTierUsage", + "freetier:GetAccountPlanState", + "freetier:ListAccountActivities", + "freetier:GetAccountActivity" + ], + "Resource": "*" + }, + { + "Sid": "AllowPricingAccess", + "Effect": "Allow", + "Action": [ + "pricing:GetProducts", @@ -117 +124 @@ JSON - "pricing:GetProducts" + "pricing:DescribeServices" @@ -123,0 +131 @@ JSON +You can scope down this policy to grant access to only specific cost management capabilities. For example, if you don't want users to access resource-level cost data, you can remove the `ce:GetCostAndUsageWithResources` action, or add an explicit deny statement. @@ -129,7 +137 @@ JSON -You can also allow IAM principals to access Cost Explorer and to use Amazon Q Developer, but restrict them from using the cost analysis or cost optimization capabilities in Amazon Q Developer, by using the `aws:CalledVia` [global condition key](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-calledvia). The following IAM policy provides an example of using this condition key. - -JSON - - -**** - +You can also allow IAM principals to access Cost Explorer and to use Amazon Q Developer, but restrict them from using the cost analysis or cost optimization capabilities in Amazon Q Developer, by using the `aws:CalledVia` [global condition key](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-calledvia). The following IAM policy provides an example of using this condition key: @@ -141,0 +144 @@ JSON + "Sid": "AllowQDeveloperAccess", @@ -148 +151,8 @@ JSON - "q:PassRequest", + "q:PassRequest" + ], + "Resource": "*" + }, + { + "Sid": "AllowCostExplorerAccess", + "Effect": "Allow", + "Action": [ @@ -153,0 +164 @@ JSON + "Sid": "DenyCostExplorerAccessViaAmazonQ", @@ -169,0 +181 @@ JSON +## Multi-account access @@ -171,2 +183 @@ JSON - -For users of AWS Organizations, management account administrators can restrict member account users’ access to Cost Explorer and Cost Optimization Hub data (including access to discounts, credits, and refunds) using the Cost Management preferences in the AWS Billing and Cost Management console. These preferences apply to Amazon Q Developer in the same way that they apply to the management console, SDK, and CLI. Amazon Q Developer respects the existing preferences of customers. Note that the pricing and cost estimation capabilities in Amazon Q Developer only provide public pricing data; customer-specific discounts are not reflected.