AWS cost-management documentation change
Summary
Removed requirement for iam:CreateServiceLinkedRole permission and replaced broad ce:* permission with specific Cost Explorer API permissions for scheduled dashboard reports execution role
Security assessment
This change implements the principle of least privilege by replacing the overly broad ce:* permission with specific, granular Cost Explorer API permissions. This reduces the attack surface by limiting the execution role to only necessary actions, which is a security best practice. However, there's no evidence this addresses a specific security vulnerability or incident.
Diff
diff --git a/cost-management/latest/userguide/dashboards-getting-started.md b/cost-management/latest/userguide/dashboards-getting-started.md index 3a87ec345..9aa47a794 100644 --- a//cost-management/latest/userguide/dashboards-getting-started.md +++ b//cost-management/latest/userguide/dashboards-getting-started.md @@ -23,2 +22,0 @@ Before creating or using dashboards, ensure you have: - * (Optional) If you plan to schedule email delivery of dashboard reports, ensure you have permissions to create a [service-linked role](https://docs.aws.amazon.com/cost-management/latest/userguide/schedule-dashboard-reports.html#schedule-dashboard-reports-slr) (`iam:CreateServiceLinkedRole`). This is a one-time opt-in per account. - @@ -65 +63 @@ Required dashboard permissions include: - * `CreateScheduledReport` \- Create scheduled email report configurations + * `CreateScheduledReport` \- Create scheduled email reports @@ -113,2 +110,0 @@ To schedule email delivery of dashboard reports, you also need the following per - * `iam:CreateServiceLinkedRole` – Allows AWS to create a service-linked role on your behalf that enables automated report generation and delivery. This is a one-time requirement per account. For more information, see [Service-linked roles for scheduled reports](https://docs.aws.amazon.com/cost-management/latest/userguide/schedule-dashboard-reports.html#schedule-dashboard-reports-slr). - @@ -117,3 +113 @@ To schedule email delivery of dashboard reports, you also need the following per - * `bcm-dashboards:GetDashboard` – Required for retrieving the dashboard used by the scheduled report. - - * `ce:*` – Required for retrieving data for widgets on the dashboard. + * `bcm-dashboards:GetDashboard`, `ce:GetDimensionValues`, `ce:GetCostAndUsageWithResources`, `ce:GetCostAndUsage`, `ce:GetCostForecast`, `ce:GetTags`, `ce:GetUsageForecast`, `ce:GetCostCategories`, `ce:GetSavingsPlansCoverage`, `ce:GetReservationUtilization`, `ce:GetReservationCoverage`, `ce:GetSavingsPlansUtilization`, `ce:GetSavingsPlansUtilizationDetails` – Required for the execution role to retrieve dashboard and cost data. For more information, see [Execution role permissions for scheduled reports](https://docs.aws.amazon.com/cost-management/latest/userguide/schedule-dashboard-reports.html#schedule-dashboard-reports-permissions).