AWS FinOps Agent is in preview release and is subject to change.

Identity and access management for AWS FinOps Agent

AWS Identity and Access Management (IAM) is an AWS service that helps an administrator securely control access to AWS resources. IAM administrators control who can be authenticated (signed in) and authorized (have permissions) to use AWS FinOps Agent resources. IAM is an AWS service that you can use with no additional charge.

Audience

How you use AWS Identity and Access Management (IAM) differs based on your role:

Authenticating with identities

To use AWS FinOps Agent, sign in to AWS as an IAM user or assume an IAM role that has the required permissions.

AWS account root user

When you create an AWS account, you begin with one sign-in identity called the AWS account root user that has complete access to all AWS services and resources. We strongly recommend that you don't use the root user for everyday tasks. For tasks that require root user credentials, see Tasks that require root user credentials in the IAM User Guide.

Federated identity

AWS FinOps Agent does not support federated identities.

IAM users and groups

An IAM user is an identity with specific permissions for a single person or application. An IAM group specifies a collection of IAM users and makes permissions easier to manage for large sets of users.

IAM roles

An IAM role is an identity with specific permissions that provides temporary credentials. To use a role with AWS FinOps Agent, configure the role with the permissions required for the workflows it performs. For more information, see Methods to assume a role in the IAM User Guide.

Managing access using policies

You control access in AWS by creating policies and attaching them to AWS identities or resources. A policy defines permissions when associated with an identity or resource. AWS evaluates these policies when a principal makes a request. Most policies are stored in AWS as JSON documents. For more information about JSON policy documents, see Overview of JSON policies in the IAM User Guide.

Using policies, administrators specify who has access to what by defining which principal can perform actions on what resources, and under what conditions.

By default, users and roles have no permissions. An IAM administrator creates IAM policies and adds them to roles, which users can then assume. IAM policies define permissions regardless of the method used to perform the operation.

Identity-based policies

Identity-based policies are JSON permissions policy documents that you attach to an identity (user, group, or role). These policies control what actions identities can perform, on which resources, and under what conditions. To learn how to create an identity-based policy, see Define custom IAM permissions with customer managed policies in the IAM User Guide.

Identity-based policies can be inline policies (embedded directly into a single identity) or managed policies (standalone policies attached to multiple identities). To learn how to choose between managed and inline policies, see Choose between managed policies and inline policies in the IAM User Guide.

Resource-based policies

AWS FinOps Agent does not support resource-based policies. You cannot use a resource-based policy to grant another AWS account access to an agent or its data. AWS FinOps Agent uses the roles and policies described in the IAM setup guide. Adding a policy to the agent role does not add supported access to additional AWS services or resources.

To analyze organization-wide cost data, deploy AWS FinOps Agent in your organization's management account (the payer account). Cost Explorer in that account provides organization-wide visibility, subject to the IAM permissions you configure.

Other policy types

AWS supports additional policy types that can set the maximum permissions granted by more common policy types:

Multiple policy types

When multiple types of policies apply to a request, the resulting permissions are more complicated to understand. To learn how AWS determines whether to allow a request when multiple policy types are involved, see Policy evaluation logic in the IAM User Guide.