Skip to content

Cannot access cost explorer despite being admin

0

My AWS account belongs to an organisation where member accounts are allowed to use it. The Cost Management Preferences have been configured correctly, as outlined here: https://docs.aws.amazon.com/cost-management/latest/userguide/ce-access.html My IAM permissions (inherited from a IDC permissions set) allow me unrestricted access (I have the AdministratorAccess job function policy and no permissions boundaries).

However, I am still denied access to cost explorer in this specific account. Access Denied

I am able to access other accounts with the same permission set and view the cost explorer. Finally, I have created an IAM user with the same AdministratorAccess job function policy attached in the affected account, but I am still unable to view cost explorer when signed in as this IAM user.

2 Answers
1

If you can access Billing in other accounts and not this, then it sounds like IAM billing access has not been enabled for this account or you have an SCP at the ORG level blocking billing.

https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/control-access-billing.html#ControllingAccessWebsite-Activate

EXPERT

answered 2 years ago

EXPERT

reviewed 2 years ago

0

Hi Gary,

The link above shows these steps:

Activating IAM access to the AWS Billing and Cost Management console

By default, IAM roles within an AWS account can't access the Billing and Cost Management console. This is true even if the IAM user or role has IAM policies that grant access to specific Billing features. The root user can allow IAM users and roles access to Billing and Cost Management console by using the Activate IAM access setting.

To provide access to the Billing and Cost Management console

Sign in to the Account page in the Billing and Cost Management console at https://console.aws.amazon.com/billing/home?#/account.
Under IAM user and role access to Billing information, choose Edit.
Select Activate IAM access.
Choose Update.
For more information about this feature, see Activating access to the Billing and Cost Management console.

Using the https://console.aws.amazon.com/billing/home?#/account link only shows the Billing and Cost Management home page, within this, there is no section named 'IAM user and role access to Billing information', or any option to Activate IAM access.

Is this a AWS console option that is only available when signed in as the root user?

In addition, we have no restrictive SCPs enabled in our organisation' s management account.

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.