Enable IAM principals to access Billing in AWS Org member accounts

Question

Given:
1. Only roots can enable "IAM User and Role Access to Billing Information"
2. New member accounts are created with root creds disabled.

Does it mean that I have to go through incredibly tedious process of enabling root, attaching MFA, resetting password and then rolling it all back just to enable this one single option?

Am I correct? I desperately want a simpler way

Matt Barbieri · Answer

Hi THere

Yes you will need to enable COst Explorer as root for each account.  Here are some alternatives

* [Take a look at the Custom Billing Views Feature](https://docs.aws.amazon.com/cost-management/latest/userguide/billing-view-getting-started.html#billing-view-prerequisite)
* [Create a central FinOps account and implement Cloud Intelligence dashboards](https://docs.aws.amazon.com/guidance/latest/cloud-intelligence-dashboards/cudos-cid-kpi.html)

EricG · Answer

If you created the member account using Organizations you should be able to access the member accounts using the assumed role "OrganizationAccountAccessRole" which will have full admin rights and should be able to enable billing access in the member account.

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access-cross-account-role.html

Enable IAM principals to access Billing in AWS Org member accounts

Add your answer

Relevant content