Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅 中国的 Amazon Web Services 服务入门 (PDF)。

为 Amazon Billing 使用基于身份的策略（IAM policy）

本主题提供几个基于身份的策略的示例。这些策略说明了账户管理员如何将权限策略附加到 IAM 身份（用户、组和角色），从而授予对 Billing 资源执行操作的权限。

有关 Amazon 账户和 IAM 用户的全面讨论，请参阅 IAM 用户指南中的什么是 IAM？。

有关如何能更新客户托管策略的说明，请参阅 IAM 用户指南中的编辑客户托管策略（控制台）。

Amazon Billing 操作策略

此表总结了允许或拒绝 IAM 用户访问您的账单信息和工具的权限。有关使用这些权限的策略示例，请参阅Amazon Billing 策略示例。

有关 Amazon Cost Management 控制台操作策略的列表，请参阅 Amazon Cost Management 用户指南中的 Amazon Cost Management 操作策略。

托管式策略

托管策略是基于身份的独立策略，可以将其附加到 Amazon 账户中的多个用户、组和角色。您可以使用Amazon托管式策略来控制 Billing 中的访问权限。

Amazon 托管策略是由 Amazon 创建和管理的独立策略。Amazon 托管策略可用于为很多常见使用案例提供权限。与必须自己编写策略相比，通过 Amazon 托管策略可以更轻松地将适当的权限分配给用户、组和角色。

您不能更改 Amazon 托管策略中定义的权限。Amazon 有时会更新 Amazon 托管策略中定义的权限。当发生此情况时，更新会影响策略附加到的所有委托人实体（用户、组和角色）。

Billing 为常见使用案例提供了多个Amazon托管式策略。

允许完全访问 Billing 控制台并管理采购订单

托管策略名称：AWSPurchaseOrdersServiceRolePolicy

此托管式策略授予对 Billing 控制台和采购订单控制台的完全访问权限。此策略允许用户查看、创建、更新和删除账户的采购订单。

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Effect":"Allow",
         "Action":[
            "account:GetAccountInformation",
            "account:GetContactInformation",
            "aws-portal:*Billing",
            "consolidatedbilling:GetAccountBillingRole",
            "invoicing:GetInvoicePDF",
            "payments:GetPaymentInstrument",
            "payments:ListPaymentPreferences",
            "purchase-orders:AddPurchaseOrder",
            "purchase-orders:DeletePurchaseOrder",
            "purchase-orders:GetPurchaseOrder",
            "purchase-orders:ListPurchaseOrderInvoices",
            "purchase-orders:ListPurchaseOrders",
            "purchase-orders:ModifyPurchaseOrders",
            "purchase-orders:UpdatePurchaseOrder",
            "purchase-orders:UpdatePurchaseOrderStatus",
            "purchase-orders:ViewPurchaseOrders",
            "tax:ListTaxRegistrations"
         ],
         "Resource":"*"
      }
   ]
}

允许用户在 Billing 控制台上查看账单

托管策略名称：AWSBillingReadOnlyAccess

此托管式策略授予用户查看 Amazon Billing 控制台的权限。

{
      "Version": "2012-10-17",
      "Statement": [
            {
                "Sid": "VisualEditor0",
                "Effect": "Allow",
                "Action": [
                    "account:GetAccountInformation",
                    "aws-portal:ViewBilling",
                    "billing:GetBillingData",
                    "billing:GetBillingDetails",
                    "billing:GetBillingNotifications",
                    "billing:GetBillingPreferences",
                    "billing:GetContractInformation",
                    "billing:GetCredits",
                    "billing:GetIAMAccessPreference",
                    "billing:GetIAMAccessPreference", 
                    "billing:GetSellerOfRecord", 
                    "billing:ListBillingViews",
                    "consolidatedbilling:GetAccountBillingRole",
                    "consolidatedbilling:ListLinkedAccounts",
                    "cur:GetClassicReport",
                    "cur:GetClassicReportPreferences", 
                    "cur:GetUsageReport",
                    "freetier:GetFreeTierAlertPreference",
                    "freetier:GetFreeTierUsage",
                    "invoicing:GetInvoiceEmailDeliveryPreferences",
                    "invoicing:GetInvoicePDF",
                    "invoicing:ListInvoiceSummaries",
                    "payments:GetPaymentInstrument", 
                    "payments:GetPaymentStatus",
                    "payments:ListPaymentPreferences",
                    "purchase-orders:GetPurchaseOrder",
                    "purchase-orders:ListPurchaseOrderInvoices",
                    "purchase-orders:ListPurchaseOrders",
                    "purchase-orders:ViewPurchaseOrders",
                    "tax:GetTaxInheritance",
                    "tax:GetTaxRegistrationDocument",
                    "tax:ListTaxRegistrations"
            ],
        "Resource": "*"
      }
   ]
}

允许用户查看 Billing 控制台和 Amazon Cost Management 控制台

托管策略名称：Billing

此托管式策略授予用户查看和编辑 Billing 控制台和 Amazon Cost Management 控制台的权限。这包括查看账户使用量、修改预算和付款方式。

{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": [            
            "account:GetAccountInformation",
            "aws-portal:*Billing",
            "aws-portal:*PaymentMethods",
            "aws-portal:*Usage",
            "billing:GetBillingData",
            "billing:GetBillingDetails",
            "billing:GetBillingNotifications",
            "billing:GetBillingPreferences",
            "billing:GetContractInformation",
            "billing:GetCredits",
            "billing:GetIAMAccessPreference",
            "billing:GetSellerOfRecord",
            "billing:ListBillingViews",
            "billing:PutContractInformation",
            "billing:RedeemCredits",
            "billing:UpdateBillingPreferences",
            "billing:UpdateIAMAccessPreference",
            "budgets:ModifyBudget", 
            "budgets:ViewBudget", 
            "ce:CreateNotificationSubscription", 
            "ce:CreateReport", 
            "ce:DeleteNotificationSubscription", 
            "ce:DeleteReport", 
            "ce:UpdateNotificationSubscription", 
            "ce:UpdatePreferences", 
            "ce:UpdateReport", 
            "consolidatedbilling:GetAccountBillingRole",
            "consolidatedbilling:ListLinkedAccounts",
            "cur:DeleteReportDefinition", 
            "cur:DescribeReportDefinitions", 
            "cur:GetClassicReport",
            "cur:GetClassicReportPreferences",
            "cur:GetUsageReport",
            "cur:ModifyReportDefinition", 
            "cur:PutClassicReportPreferences",
            "cur:PutReportDefinition", 
            "cur:ValidateReportDestination",
            "freetier:GetFreeTierAlertPreference",
            "freetier:GetFreeTierUsage",
            "freetier:PutFreeTierAlertPreference",
            "invoicing:GetInvoiceEmailDeliveryPreferences",
            "invoicing:GetInvoicePDF",
            "invoicing:ListInvoiceSummaries",
            "invoicing:PutInvoiceEmailDeliveryPreferences",
            "payments:CreatePaymentInstrument",
            "payments:DeletePaymentInstrument",
            "payments:GetPaymentInstrument",
            "payments:GetPaymentStatus",
            "payments:ListPaymentPreferences",
            "payments:MakePayment",
            "payments:UpdatePaymentPreferences",
            "purchase-orders:AddPurchaseOrder",
            "purchase-orders:DeletePurchaseOrder",
            "purchase-orders:GetPurchaseOrder",
            "purchase-orders:ListPurchaseOrderInvoices",
            "purchase-orders:ListPurchaseOrders",
            "purchase-orders:ModifyPurchaseOrders", 
            "purchase-orders:UpdatePurchaseOrder",
            "purchase-orders:UpdatePurchaseOrderStatus",
            "purchase-orders:ViewPurchaseOrders",
            "tax:BatchPutTaxRegistration",
            "tax:DeleteTaxRegistration",
            "tax:GetExemptions",
            "tax:GetTaxInheritance",
            "tax:GetTaxInterview",
            "tax:GetTaxRegistration",
            "tax:GetTaxRegistrationDocument",
            "tax:ListTaxRegistrations",
            "tax:PutTaxInheritance",
            "tax:PutTaxInterview",
            "tax:PutTaxRegistration",
            "tax:UpdateExemptions"
        ],
       "Resource": "*"
      }
   ]
}

允许用户访问账户活动页面

托管策略名称：AWSAccountActivityAccess

此托管式策略授予用户查看账户活动页面的权限。

{
      "Version": "2012-10-17",
      "Statement": [
            {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": [
                "account:GetRegionOptStatus",
                "account:GetAccountInformation",
                "account:GetAlternateContact",
                "account:GetChallengeQuestions",
                "account:GetContactInformation",
                "account:ListRegions",
                "aws-portal:ViewBilling",
                "billing:GetIAMAccessPreference",
                "billing:GetSellerOfRecord",
                "payments:ListPaymentPreferences"
        ],
        "Resource": "*"
      }
   ]
}

对 Amazon 托管式策略的 Amazon Billing 更新

查看有关 Amazon Billing 的 Amazon 托管式策略更新的详细信息（从该服务开始跟踪这些更改开始）。有关此页面更改的自动提示，请订阅 Amazon Billing 文档历史记录页面上的 RSS 源。