Update Permissions associated with allow-billing-only-access-from-other-accounts role

[timrwilliams]

As per this AWS Blog a number of IAM permissions relating to the Billing Console have been deprecated and need to be updated prior to December 2023.

These permissions are referenced in the IAM role inline policy created by the Reference Architecture named allow-billing-only-access-from-other-accounts.

The following are deprecated:

purchase-orders:*PurchaseOrders, aws-portal:*Usage, aws-portal:*PaymentMethods, aws-portal:*Billing

The new granular permissions are:

aws-portal:ViewBilling, aws-portal:ModifyBilling, aws-portal:ViewAccount, aws-portal:ModifyAccount, aws-portal:ViewPaymentMethods, aws-portal:ModifyPaymentMethods, aws-portal:ViewUsage, purchase-orders:ViewPurchaseOrders, and purchase-orders:ModifyPurchaseOrders

What is the best way to update this policy with the new, equivalent AWS permissions?

https://github.com/gruntwork-io/terraform-aws-security

---

Tracked in ticket #110426

[arsci]

Hello @timrwilliams,

The Reference Architecture uses the AWS Managed Billing Policy (arn:aws:iam::aws:policy/job-function/Billing) to control access to Billing information, which should automatically get updated by AWS for this change. The new permission sets should already be added to the policy, and after retirement, AWS will automatically remove the old permissions.

Updates to existing managed policies - Changes to AWS Billing, Cost Management, and Account Consoles Permissions

Just to confirm what is in your Reference Architecture, can you take a look at the billing policy currently in place and confirm that the new permissions are in place (the new prefixes are consolidatedbilling, freetier, invoicing, and payments)?

[bendavies]

I'm not sure that the policy will automatically get updated, as gruntwork don't use arn:aws:iam::aws:policy/job-function/Billing directly, but make a copy of it with MFA requirements layered on top.

https://github.com/gruntwork-io/terraform-aws-security/blob/d550e81bc6cabb0894d9c0ff7a04b699fb1e0281/modules/iam-policies/main.tf#L61-L69

At time of writing, the aws managed policy contains the deprecated permissions, as can be seen here:
https://us-east-1.console.aws.amazon.com/iam/home#/policies/arn:aws:iam::aws:policy/job-function/Billing$jsonEditor

I think we'll just have to wait and see what happens in December 2023?