AWS cost-management documentation change
Summary
Added budgets permissions to execution role requirements and included upgrade note for existing roles
Security assessment
The change updates required permissions for new dashboard functionality. While permissions are security-related, this is a routine feature update without addressing vulnerabilities.
Diff
diff --git a/cost-management/latest/userguide/schedule-dashboard-reports-permissions.md b/cost-management/latest/userguide/schedule-dashboard-reports-permissions.md index 661de264b..c3363cdee 100644 --- a//cost-management/latest/userguide/schedule-dashboard-reports-permissions.md +++ b//cost-management/latest/userguide/schedule-dashboard-reports-permissions.md @@ -42 +42,4 @@ When you create a scheduled report, you must provide an IAM execution role that - "ce:GetSavingsPlansUtilizationDetails" + "ce:GetSavingsPlansUtilizationDetails", + "budgets:ViewBudget", + "budgets:DescribeBudgetActionsForAccount", + "billing:ListBillingViews" @@ -48,0 +52,5 @@ When you create a scheduled report, you must provide an IAM execution role that + +###### Note + +If you created an execution role before the launch of the AWS Budgets report widget, your existing role will not include the budgets API permissions. To schedule reports for dashboards that contain AWS Budgets report widgets, update your execution role to include the budgets permissions listed above. You can update your service roles from the Additional configuration section when creating or editing a scheduled report. This update will fail if a role was manually modified in IAM. To resolve this, create a new role or restore the policy version to its original state. For more information, see [Setting the default version of a policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-edit-console.html) in the _IAM User Guide_. +