In case this question is interesting to anyone else - according to Perplexity.AI there are, in fact, only 3 policies that are not included by default in the AdministratorAccess
group. They are:
- Billing
- Support
- ViewOnlyAccess
These need to be enabled separately by the root user for all AIM Admin identities. However - while they are all listed as "permissions", ViewOnlyAccess
is actually a restriction (that prevents the user from doing anything other than viewing, as the name suggests) so it's entirely reasonable not to have that policy attached by default to an "admin" user.
Oh, and obviously that's not all you need to do... you then have to follow the advice on this page to enable it https://repost.aws/knowledge-center/iam-billing-access
And then pray to a Greek or Egyptian deity of your choice.
And then it will work... maybe.