使用AWS re:Post即您表示您同意 AWS re:Post 使用条款
AWS re:Postre:Post

Users are not able to access cost explorer or reports with billing AWS managed policy

0

Users are not able to access cost explorer or reports with billing AWS-managed policy

Getting the below error while accessing Cost explorer and reports in the AWS console: "You don’t have permission to perform the following operation on the AWS Cost Management console: ce:GetCostAndUsage, ce:GetCostForecast, ce:GetReservationUtilization, ce:GetReservationPurchaseRecommendation, ce:DescribeReport, and ce:GetDimensionValues. Contact your AWS administrator if you need help. If you are an AWS administrator, you can provide permissions for your users or groups by creating IAM policies. "

Policy that is attached to a user --> arn:aws:iam::aws:policy/job-function/Billing

  • Raksha S
    10 个月前

    To add more details, we have a parent account and the linked/child accounts associated with it. How to modify the organization-based IAM policy for all the linked accounts from the parent account?

主题
云财务管理安全、身份和合规性
标签
AWS 支出管理器AWS 身份和访问权限管理
语言
English
Raksha S
已提问 10 个月前2397 查看次数
1 回答
2

Billing policy arn:aws:iam::aws:policy/job-function/Billing doesn't include these permissions(mentioned in question) in it, can you create your own managed policy and attach it to your user/role. Follow this re:Post Knowledge Center Article for step by step guidance.

If you are still not able to access then, you'd need to check, if there is any service control policy or permissions boundary attached to user/role through which you are trying to access Cost Explorer. You need to make sure that there is no explicit deny for these actions(mentioned in question) either in SCP or permissions boundary.

Hope it helps. Abhishek

profile pictureAWS
专家
secondabhi_aws
已回答 10 个月前
  • Adam Gardner
    24 天前

    This seems a little bit like nonsense, though. Like, you're correct, the managed policy in question doesn't include those permissions, but, why? Lacking ce:DescribeReport, in particular, is crazy, given that the same policy does include ce:CreateReport, ce:DeleteReport, and ce:UpdateReport. Without ce:DescribeReport you can't even load the Cost Explorer console to begin with, so, what good is the policy?

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈，并能促进提问者的职业发展。

回答问题的准则

相关内容