本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

針對 AWS 成本管理使用身分型政策 (IAM 政策）

本主題提供以身分為基礎的政策範例，示範帳戶管理員如何將許可政策連接至 IAM 身分 （角色和群組），進而授予許可，以對 Billing and Cost Management 資源執行操作。

如需 AWS 帳戶和使用者的完整討論，請參閱 IAM 使用者指南中的什麼是 Word？。 IAM

如需有關如何更新客戶受管政策的資訊，請參閱 IAM 使用者指南中的編輯客戶受管政策 （主控台）。

Billing and Cost Management 動作政策

下表摘要說明允許或拒絕 使用者存取帳單資訊和工具的許可。如需使用這些許可的政策範例，請參閱 AWS 成本管理政策範例。

如需帳單主控台的動作政策清單，請參閱帳單使用者指南中的帳單動作政策。

受管政策

受管政策是獨立的身分型政策，您可以連接到 AWS 帳戶中的多個使用者、群組和角色。您可以使用 AWS 受管政策來控制 Billing and Cost Management 中的存取。

AWS 受管政策是由 AWS. AWS managed 政策建立和管理的獨立政策旨在為許多常見使用案例提供許可。受 AWS 管政策可讓您比必須自行撰寫政策時更輕鬆地將適當的許可指派給使用者、群組和角色。

您無法變更 AWS 受管政策中定義的許可。 AWS 偶爾會更新 AWS 受管政策中定義的許可。執行這項動作時，更新會影響政策連接到的所有委託人實體 (使用者、群組和角色)。

Billing and Cost Management 為常見使用案例提供數個 AWS 受管政策。

允許完整存取 AWS 預算，包括預算動作

受管政策名稱：AWSBudgetsActionsWithAWSResourceControlAccess

此受管政策著重於使用者，確保您擁有適當的許可，以授予許可給 AWS Budgets 來執行定義的動作。此政策提供 AWS Budgets 的完整存取權，包括預算動作，以擷取政策的狀態並使用 執行 AWS 資源 AWS Management Console。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "budgets:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "aws-portal:ViewBilling"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": "budgets.amazonaws.com"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "aws-portal:ModifyBilling",
                "ec2:DescribeInstances",
                "iam:ListGroups",
                "iam:ListPolicies",
                "iam:ListRoles",
                "iam:ListUsers",
                "organizations:ListAccounts",
                "organizations:ListOrganizationalUnitsForParent",
                "organizations:ListPolicies",
                "organizations:ListRoots",
                "rds:DescribeDBInstances",
                "sns:ListTopics"
            ],
            "Resource": "*"
        }
    ]
}

允許唯讀存取 AWS Budgets

受管政策名稱：AWSBudgetsReadOnlyAccess

此受管政策允許透過 唯讀存取 AWS Budgets AWS Management Console。政策可以連接到您的使用者、群組和角色。

{
  "Version" : "2012-10-17",
  "Statement" : [
    {
      "Sid": "AWSBudgetsReadOnlyAccess",
      "Effect" : "Allow",
      "Action" : [
        "aws-portal:ViewBilling",
        "budgets:ViewBudget",
        "budgets:Describe*"
        "budgets:ListTagsForResource"
      ],
      "Resource" : "*"
    }
  ]
}

允許控制 AWS 資源的許可

受管政策名稱：AWSBudgetsActions_RolePolicyForResourceAdministrationWithSSM

此受管政策著重於 AWS Budgets 在完成特定動作時代表您採取的特定動作。此政策提供控制 AWS 資源的許可。例如， 會透過執行 AWS Systems Manager (EC2) 指令碼來啟動和停止 Amazon Word 或 Amazon SSM RDS執行個體。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstanceStatus",
                "ec2:StartInstances",
                "ec2:StopInstances",
                "rds:DescribeDBInstances",
                "rds:StartDBInstance",
                "rds:StopDBInstance"
            ],
            "Resource": "*",
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "aws:CalledVia": [
                        "ssm.amazonaws.com"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:StartAutomationExecution"
            ],
            "Resource": [
                "arn:aws:ssm:*:*:automation-definition/AWS-StartEC2Instance:*",
                "arn:aws:ssm:*:*:automation-definition/AWS-StopEC2Instance:*",
                "arn:aws:ssm:*:*:automation-definition/AWS-StartRdsInstance:*",
                "arn:aws:ssm:*:*:automation-definition/AWS-StopRdsInstance:*"
            ]
        }
    ]
}

允許 Cost Optimization Hub 呼叫讓服務運作所需的服務

受管政策名稱：CostOptimizationHubServiceRolePolicy

允許 Cost Optimization Hub 擷取組織資訊，並收集最佳化相關資料和中繼資料。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AwsOrgsAccess",
            "Effect": "Allow",
            "Action":  [
                "organizations:DescribeOrganization",
                "organizations:ListAccounts",
                "organizations:ListAWSServiceAccessForOrganization",
                "organizations:ListParents",
                "organizations:DescribeOrganizationalUnit"
            ],
            "Resource":  [
                "*" 
            ]
        },
        {
            "Sid": "AwsOrgsScopedAccess",
            "Effect": "Allow",
            "Action":  [
                "organizations:ListDelegatedAdministrators"
            ],
            "Resource": "*",
            "Condition": { 
                "StringLikeIfExists": {
                    "organizations:ServicePrincipal": [ "cost-optimization-hub.bcm.amazonaws.com" ]
                }
            }
        },
        {
            "Sid": "CostExplorerAccess",
            "Effect": "Allow",
            "Action": [
                "ce:ListCostAllocationTags",
                "ce:GetCostAndUsage"
            ],
            "Resource":  [
                "*" 
            ]
        }
    ]
}

如需詳細資訊，請參閱 Cost Optimization Hub 的服務連結角色。

允許唯讀存取 Cost Optimization Hub

受管政策名稱：CostOptimizationHubReadOnlyAccess

此受管政策提供對 Cost Optimization Hub 的唯讀存取權。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CostOptimizationHubReadOnlyAccess",
            "Effect": "Allow",
            "Action": [
                "cost-optimization-hub:ListEnrollmentStatuses",
                "cost-optimization-hub:GetPreferences",
                "cost-optimization-hub:GetRecommendation",
                "cost-optimization-hub:ListRecommendations",
                "cost-optimization-hub:ListRecommendationSummaries"
            ],
            "Resource": "*"
        }
    ]
}

允許管理員存取 Cost Optimization Hub

受管政策名稱：CostOptimizationHubAdminAccess

此受管政策可讓管理員存取 Cost Optimization Hub。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CostOptimizationHubAdminAccess",
            "Effect": "Allow",
            "Action": [
                "cost-optimization-hub:ListEnrollmentStatuses",
                "cost-optimization-hub:UpdateEnrollmentStatus",
                "cost-optimization-hub:GetPreferences",
                "cost-optimization-hub:UpdatePreferences",
                "cost-optimization-hub:GetRecommendation",
                "cost-optimization-hub:ListRecommendations",
                "cost-optimization-hub:ListRecommendationSummaries",
                "organizations:EnableAWSServiceAccess"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AllowCreationOfServiceLinkedRoleForCostOptimizationHub",
            "Effect": "Allow",
            "Action": [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": [
                "arn:aws:iam::*:role/aws-service-role/cost-optimization-hub.bcm.amazonaws.com/AWSServiceRoleForCostOptimizationHub"
            ],
            "Condition": {
                "StringLike": {
                    "iam:AWSServiceName": "cost-optimization-hub.bcm.amazonaws.com"
                }
            }
        },
        {
            "Sid": "AllowAWSServiceAccessForCostOptimizationHub",
            "Effect": "Allow",
            "Action": [
                "organizations:EnableAWSServiceAccess"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "organizations:ServicePrincipal": [
                        "cost-optimization-hub.bcm.amazonaws.com"
                    ]
                }
            }
        }
    ]
}

允許分割成本分配資料呼叫使服務正常運作所需的服務

受管政策名稱：SplitCostAllocationDataServiceRolePolicy

允許分割成本分配資料擷取 AWS Organizations 資訊，如適用，並收集客戶選擇加入的分割成本分配資料服務的遙測資料。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AwsOrganizationsAccess",
            "Effect": "Allow",
            "Action": [
                "organizations:DescribeOrganization",
                "organizations:ListAccounts",
                "organizations:ListAWSServiceAccessForOrganization",
                "organizations:ListParents"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonManagedServiceForPrometheusAccess",
            "Effect": "Allow",
            "Action": [
                "aps:ListWorkspaces",
                "aps:QueryMetrics"
            ],
            "Resource": "*"
        }
    ]
}

如需詳細資訊，請參閱分割成本分配資料的服務連結角色。

允許資料匯出存取其他 AWS 服務

受管政策名稱：AWSBCMDataExportsServiceRolePolicy

允許資料匯出代表您存取其他 AWS 服務，例如 Cost Optimization Hub。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CostOptimizationRecommendationAccess",
            "Effect": "Allow",
            "Action":  [
                "cost-optimization-hub:ListEnrollmentStatuses",
                "cost-optimization-hub:ListRecommendations"
            ],
            "Resource": "*" 
        }
    ]
}

如需詳細資訊，請參閱資料匯出的服務連結角色。

AWSAWS 受管政策的成本管理更新

檢視自此服務開始追蹤這些變更以來 AWS ，成本管理的受 AWS 管政策更新詳細資訊。如需此頁面變更的自動提醒，請訂閱 AWS 成本管理文件歷史記錄頁面上的 RSS 摘要。