1

In my AWS account I created a user and gave it full permissions using the AdministratorAccess policy. That's the document for the policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "*",
      "Resource": "*"
    }
  ]
}

Still, when I login using this user, I can't see my billing information. It says I don't have the permissions.

2 Answers 2

6

By default the AWS billing data is only accessible to the root account and not subject to IAM. In order to share access the root account has to go to the "Account Stettings" and enable "IAM User Access to Billing Information".

2
  • 2
    Yep. There are several instances of IAM permissions that must be explicitly granted because they are not included in *.
    – ceejayoz
    Jul 17, 2016 at 14:42
  • 1
    @ceejayoz - Could you mention other such cases? So I would avoid them beforehand.
    – Avi
    Jul 17, 2016 at 14:46
0

In case this question is interesting to anyone else - according to Perplexity.AI there are, in fact, only 3 policies that are not included by default in the AdministratorAccess group. They are:

  1. Billing
  2. Support
  3. ViewOnlyAccess

These need to be enabled separately by the root user for all AIM Admin identities. However - while they are all listed as "permissions", ViewOnlyAccess is actually a restriction (that prevents the user from doing anything other than viewing, as the name suggests) so it's entirely reasonable not to have that policy attached by default to an "admin" user.

Oh, and obviously that's not all you need to do... you then have to follow the advice on this page to enable it https://repost.aws/knowledge-center/iam-billing-access And then pray to a Greek or Egyptian deity of your choice. And then it will work... maybe.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .