AWS cur documentation change

Service: cur · 2025-11-22 · Documentation low

File: cur/latest/userguide/bcm-data-exports-access.md

Summary

Added IAM policy examples for creating pro forma AWS CUR 2.0 reports with billing view access controls

Security assessment

The changes provide security-focused documentation about granular IAM permissions for cost data exports. While this improves security documentation by showing how to restrict access to specific billing views, there's no indication of addressing a specific vulnerability - rather standard permission configuration guidance.

Diff

diff --git a/cur/latest/userguide/bcm-data-exports-access.md b/cur/latest/userguide/bcm-data-exports-access.md
index a8ea0453f..8322daf82 100644
--- a//cur/latest/userguide/bcm-data-exports-access.md
+++ b//cur/latest/userguide/bcm-data-exports-access.md
@@ -89,0 +90,66 @@ For more information on access control and IAM permissions to use Data Exports i
+### Create a pro forma AWS CUR 2.0
+
+To create a pro forma CUR 2.0, you will need to include the following IAM policy:
+
+Allow IAM user to have full access to CUR 2.0 and Billing Group Billing View.
+
+JSON
+    
+
+****
+    
+    
+    
+    {
+        "Version":"2012-10-17",		 	 	 
+        "Statement": [
+            {
+                "Sid": "AllowCreateCur20AnyBillingView",
+                "Effect": "Allow",
+                "Action": "bcm-data-exports:CreateExport",
+                "Resource": [
+                    "arn:aws:bcm-data-exports:*:*:table/COST_AND_USAGE_REPORT",
+                    "arn:aws:bcm-data-exports:*:*:export/*",
+                    "arn:aws:billing::*:billingview/*"
+                ]
+            },{
+                "Sid": "CurDataAccess",
+                "Effect": "Allow",
+                "Action": "cur:PutReportDefinition",
+                "Resource": "*"
+            }
+        ]
+    }
+    
+
+If you want an IAM role to have access to a specific billing group, you can add the Billing View ARN the role is allowed to access.
+
+JSON
+    
+
+****
+    
+    
+    
+    {
+        "Version":"2012-10-17",		 	 	 
+        "Statement": [
+            {
+                "Sid": "AllowCreateSpecificBillingViewCur20",
+                "Effect": "Allow",
+                "Action": "bcm-data-exports:CreateExport",
+                "Resource": [
+                    "arn:aws:bcm-data-exports:*:*:table/COST_AND_USAGE_REPORT", 
+                    "arn:aws:bcm-data-exports:*:*:export/*", 
+                    "arn:aws:billing::444455556666:billingview/billing-group-111122223333"
+            ]
+            },{
+                "Sid": "CurDataAccess",
+                "Effect": "Allow",
+                "Action": "cur:PutReportDefinition",
+                "Resource": "*"
+            }
+        ]
+    }
+    
+