"Update your Policies" email - but only AWS-managed policies have the old permission!

Question

We're getting the emails about "Update your policies for enhanced Billing, Cost Management, and Account consoles access"   but the only policies we have that have the retired permissions are 
 AdministratorAccess  - AWS managed - job function ( arn:aws:iam::aws:policy/AdministratorAccess )
 Billing   - AWS managed - job function ( arn:aws:iam::aws:policy/job-function/Billing )
which have
*  purchase-orders:ViewPurchaseOrders
* purchase-orders:ModifyPurchaseOrders

I thought AWS would update any AWS - managed policies. Did they miss these, or are AdministratorAccess and Billing  somehow outdated, or what? Are we going to have a problem?
We are not using Organizations

(also, without a higher-level account, is this the only way to ask?)
Thanks very much

betsysad · Answer

I still see the incorrect permissions in the AWS-managed policies:

arn:aws:iam::aws:policy/AdministratorAccess 
 arn:aws:iam::aws:policy/job-function/Billing

Are these not the right policies, or am I getting an outdated version somehow, or are the policies incorrect?
I did try creating a new user and applying the policy and still see the permissions. 
We only have eight user-managed policies and none of them include any of the outdated permissions

AWS Support - Rick · Answer

Hello,

I apologize for any inconvenience this has caused you. Our Accounts & Billing team would be happy to address your concerns this concern, you can create a case from our Support Center: https://go.aws/support-center. After researching, it does seem these permissions have been retired & require your action, you can find more details from our blog: [https://aws.amazon.com/blogs/aws-cloud-financial-management/changes-to-aws-billing-cost-management-and-account-consoles-permissions/]().

\- Rick N.

Riku_Kobayashi · Answer

Hello.

All operations are already permitted for "AdministratorAccess" in the AWS management policy, so there is no need to update it.  
Also, AWS managed policies cannot be updated by us users.  
AWS will update automatically.  
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#managed-policies  
> An AWS managed policy is a standalone policy that's created and administered by AWS. AWS managed policies are designed to provide permissions for many common use cases. AWS managed policies make it easier for you to assign appropriate permissions to users, groups, and roles than if you had to write the policies yourself.
> 
> You can't change the permissions defined in AWS managed policies. AWS occasionally updates the permissions that are defined in an AWS managed policy. When this occurs, the update affects all principal entities (users, groups, and roles) that the policy is attached to.

I think if you check the managed policies for "AdministratorAccess" and "Billing", the old policies will probably be gone.

"Update your Policies" email - but only AWS-managed policies have the old permission!

Relevant content