Unable to view bills following IAM changes for Billing Console

0

Whatever permissions I set for an IAM user, I keep getting a "You need permissions" error when trying to view my bills. I have even tried actions . . The account has a Service Control Policy which allows everything. In CloudTrail, the event name which is causing Access Denied is "GetPaymentPreference", but there is no IAM permission of that name. I can see the bills by logging in as Root.

I have followed the advice here: https://aws.amazon.com/blogs/aws-cloud-financial-management/changes-to-aws-billing-cost-management-and-account-consoles-permissions/ to update the IAM policy. I also tried adding a . policy to this iam user, and that didn't help either. I checked the SCPs on this account, and they are not restricting.

The error message on the Bills page of Billing and Cost Management says "You Need Permissions You don't have permission to access billing information for this account. Contact your AWS administrator (etc ...)"

The relevant parts of the CloudTrail event looks like this:

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "IAMUser",
		...
    },
    "eventSource": "billingconsole.amazonaws.com",
    "eventName": "GetPaymentPreference",
    "awsRegion": "us-east-1",
    "errorCode": "AccessDenied",
    "eventType": "AwsConsoleAction",
    "managementEvent": true,
}

How do I work around this so that the IAM user can see bills in this account? What is the IAM action related to the event called "GetPaymentPreference". Thankyou.

  • Can you share your IAM policy? The one attached to your user?

1回答
2
承認された回答

The solution turned out to be a DENY section of a policy attached to this IAM user. The policy requires an ALLOW on at least "Billing:ListPaymentPreferences", "account.GetAccountInformation" and possibly some other components as well.

回答済み 4ヶ月前
profile picture
エキスパート
レビュー済み 3ヶ月前

ログインしていません。 ログイン 回答を投稿する。

優れた回答とは、質問に明確に答え、建設的なフィードバックを提供し、質問者の専門分野におけるスキルの向上を促すものです。

質問に答えるためのガイドライン

関連するコンテンツ