AWS IAM policy for payment and usage activity view only (for accountant staff)

Question

I am looking for a policy to let accountant to manage payment methods and observe usage activity only. Would it be possible to construct such policy?

Thanks

Answer 1

AWS have made it possible to control access to payments and usage using IAM.

When logged in as the root account, go to Account Settings in the Billing and Cost Management area, scroll down to "IAM User Access to Billing Information", click "Edit", and enable the option.

With that done, the following policy will permit access to the payment and usage activity view:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1423852703000",
      "Effect": "Allow",
      "Action": [
        "aws-portal:ModifyBilling",
        "aws-portal:ModifyPaymentMethods",
        "aws-portal:ViewBilling",
        "aws-portal:ViewPaymentMethods",
        "aws-portal:ViewUsage"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

A reference to the available permissions can be found here