AWS cost-management documentation change
Summary
Added documentation for scheduled email delivery of dashboard reports including prerequisites, required permissions, and IAM role creation requirements
Security assessment
This change adds documentation about security features including IAM permissions (iam:CreateServiceLinkedRole, iam:PassRole), email verification for users receiving reports, and specific dashboard permissions for scheduled reports. It enhances security awareness but doesn't address a specific security vulnerability.
Diff
diff --git a/cost-management/latest/userguide/dashboards-getting-started.md b/cost-management/latest/userguide/dashboards-getting-started.md index fa107d22b..7e90b3f01 100644 --- a//cost-management/latest/userguide/dashboards-getting-started.md +++ b//cost-management/latest/userguide/dashboards-getting-started.md @@ -20,0 +21,4 @@ Before creating or using dashboards, ensure you have: + * (Optional) If you plan to schedule email delivery of dashboard reports, ensure you have permissions to create a [service-linked role](https://docs.aws.amazon.com/cost-management/latest/userguide/schedule-dashboard-reports.html#schedule-dashboard-reports-slr) (`iam:CreateServiceLinkedRole`). This is a one-time opt-in per account. + + * (Optional) If you are setting up email delivery for a scheduled report for a user for the first time, the user will need to verify their email address through a one time verification email before they can start receiving scheduled reports. + @@ -58,0 +63,12 @@ Required dashboard permissions include: + * `CreateScheduledReport` \- Create scheduled email report configurations + + * `GetScheduledReport` \- View scheduled report details + + * `UpdateScheduledReport` \- Modify scheduled report configurations + + * `DeleteScheduledReport` \- Remove scheduled report configurations + + * `ListScheduledReports` \- View available scheduled reports + + * `ExecuteScheduledReport` \- Triggers immediate execution of a scheduled report + @@ -90,0 +107,15 @@ When working with dashboards, users need permissions to access the dashboard res +###### Note + +To schedule email delivery of dashboard reports, you also need the following permissions: + + * `iam:CreateServiceLinkedRole` – Allows AWS to create a service-linked role on your behalf that enables automated report generation and delivery. This is a one-time requirement per account. For more information, see [Service-linked roles for scheduled reports](https://docs.aws.amazon.com/cost-management/latest/userguide/schedule-dashboard-reports.html#schedule-dashboard-reports-slr). + + * `iam:PassRole` – Required for passing the IAM execution role to the API. + + * `bcm-dashboards:GetDashboard` – Required for retrieving the dashboard used by the scheduled report. + + * `ce:*` – Required for retrieving data for widgets on the dashboard. + + + +