By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Users are not able to access cost explorer or reports with billing AWS managed policy

0

Users are not able to access cost explorer or reports with billing AWS-managed policy

Getting the below error while accessing Cost explorer and reports in the AWS console: "You don’t have permission to perform the following operation on the AWS Cost Management console: ce:GetCostAndUsage, ce:GetCostForecast, ce:GetReservationUtilization, ce:GetReservationPurchaseRecommendation, ce:DescribeReport, and ce:GetDimensionValues. Contact your AWS administrator if you need help. If you are an AWS administrator, you can provide permissions for your users or groups by creating IAM policies. "

Policy that is attached to a user --> arn:aws:iam::aws:policy/job-function/Billing

  • Raksha S
    9 months ago

    To add more details, we have a parent account and the linked/child accounts associated with it. How to modify the organization-based IAM policy for all the linked accounts from the parent account?

Topics
Cloud Financial ManagementSecurity, Identity, & Compliance
Tags
AWS Cost ExplorerAWS Identity and Access Management
Language
English
Raksha S
asked 9 months ago2286 views
1 Answer
2

Billing policy arn:aws:iam::aws:policy/job-function/Billing doesn't include these permissions(mentioned in question) in it, can you create your own managed policy and attach it to your user/role. Follow this re:Post Knowledge Center Article for step by step guidance.

If you are still not able to access then, you'd need to check, if there is any service control policy or permissions boundary attached to user/role through which you are trying to access Cost Explorer. You need to make sure that there is no explicit deny for these actions(mentioned in question) either in SCP or permissions boundary.

Hope it helps. Abhishek

profile pictureAWS
EXPERT
secondabhi_aws
answered 9 months ago
  • Adam Gardner
    9 days ago

    This seems a little bit like nonsense, though. Like, you're correct, the managed policy in question doesn't include those permissions, but, why? Lacking ce:DescribeReport, in particular, is crazy, given that the same policy does include ce:CreateReport, ce:DeleteReport, and ce:UpdateReport. Without ce:DescribeReport you can't even load the Cost Explorer console to begin with, so, what good is the policy?

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content