1 Answer
- Newest
- Most votes
- Most comments
0
The email, which you have got has step by step process to take care of the warnings. This is required as some of the IAM actions related to Billing, Cost Management, and Account consoles are retired and new actions have been created as replacement of those older actions with enhanced features.
To ensure you have continued access to our consoles, we are granting you a final extension until December 11, 2023, to migrate your policies to new actions. To help you with the migration, we have published a mapping between old and new actions in our user guide [1]. If you need to update policies across multiple member accounts in your organization, we have built bulk policy migration scripts to help you update all policies quickly and securely from your management account. See the bulk policy migration scripts user guide [2] for more information. You can find a detailed guide on how and which policies you need to update on our blog [3] and definitions of new IAM actions in Cost Management [4] and Billing [5] user guides.
Please update your policies before December 11, 2023, to ensure your users' access to the AWS Billing, Cost Management, and Account consoles is not affected. If you have more questions or need help making updates to your policies, please contact AWS support [6].
[1] https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/migrate-granularaccess-iam-mapping-reference.html
[2] https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/migrate-iam-permissions.html
[3] https://aws.amazon.com/blogs/aws-cloud-financial-management/changes-to-aws-billing-cost-management-and-account-consoles-permissions/
[4] https://docs.aws.amazon.com/cost-management/latest/userguide/migrate-granularaccess-whatis.html#migrate-user-permissions
[5] https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/migrate-granularaccess-whatis.html
[6] https://support.console.aws.amazon.com/support/home?#/
I understand that you may not have support plan to log a case, but if you follow the second link given above, you should be able to take care of this pretty easily as it walks you through step by step.
You can always comment here for more guidance, if you feel stuck somewhere.
Relevant content
AWS OFFICIALUpdated 2 months ago- AWS OFFICIALUpdated 4 months ago
- AWS OFFICIALUpdated a year ago
- AWS OFFICIALUpdated 2 months ago
I'm sorry, I am not a programmer and I only have the most basic understanding of scripting. Reading through the documentation and clicking the Affected Policies button, I see there are four: BillingFullAccess, CostExplorerPreferences, CostExplorerReports, ReservationExpirationalertsCustomer, and I can click them to see the script. I can also click the "enable fine actions" button, but it is unclear to this actually does. Do I need to do anything else? I can see how to get into and edit the policy code, but I have no idea what I need to change the code to and the examples don't help.
Allow me sometime, I'll do that in my personal account and will share the steps.
Thank you, I'd greatly appreciate it. I can probably muddle through putting the coding in, I'm just very unclear as to what exactly coding I need to add. (I suspect the IAM stuff is literally just steps I followed rote when first setting up and may contain stuff I don't truly need for my very simple purposes.)
Message 1/2(Character limit):
Hey Aorts,
I'll assist you step by step but would prefer not to throw all steps at once as that might not be needed too. Note: The steps that I'm mentioning here are no different than what you'd have received from AWS.
Sign in to the AWS Management Console and open the AWS Billing console at https://console.aws.amazon.com/billing/.
Paste the following URL into your browser to access the Affected policies tool: https://us-east-1.console.aws.amazon.com/poliden/home?region=us-east-1#/.
Note that you require iam:GetAccountAuthorizationDetails permission to view this page, if you logged in a IAM user, then add this permission to IAM policy attached to your IAM user. If you log in through IAM role, then this permission should be added to one of the policy to attached to IAM role.
Important: If you don't see any policy here, you are good and no further actions are required. If you see some policies here then following steps would be required.
Message 2/2:
Choose an IAM policy name you wish to edit.
Once you're redirected to the IAM console, update the impacted IAM action with the new action. Don't remove any existing aws-portal or purchase-orders action if you have any. Mapping of existing IAM action to New IAM action is listed here at https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/migrate-granularaccess-iam-mapping-reference.html
Repeat steps 3 to 5 for all listed policies.
Once all of the policies are resolved, access the Affected policies tool to confirm there are no policies listed.
Feel free to comment here, I'll assist you.