Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅 中国的 Amazon Web Services 服务入门 (PDF)。

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

使用基于身份的策略（IAM 策略）进行成本管理 Amazon

本主题提供了基于身份的策略的示例，这些示例展示了账户管理员如何将权限策略附加到 IAM 身份（即用户、组和角色），从而授予对账单和成本管理资源执行操作的权限。

有关 Amazon 账户和用户的完整讨论，请参阅什么是 IAM？ 在 IAM 用户指南中。

有关如何能更新客户管理型策略的说明，请参阅 IAM 用户指南中的编辑客户管理型策略（控制台）。

Billing and Cost Management 操作策略

此表总结了允许或拒绝 用户访问您的账单信息和工具的权限。有关使用这些权限的策略示例，请参阅Amazon 成本管理政策示例。

有关账单控制台操作策略的列表，请参阅账单用户指南中的账单操作策略。

托管策略

托管策略是基于身份的独立策略，您可以将其附加到账户 Amazon 中的多个用户、群组和角色。在 Billing and Billing and Cost Management 中，您可以使用 Amazon 托管策略来控制访问权限。

Amazon 托管策略是由创建和管理的独立策略 Amazon。 Amazon 托管策略旨在为许多常见用例提供权限。 Amazon 与必须自己编写策略相比，托管策略使您可以更轻松地为用户、组和角色分配适当的权限。

您无法更改 Amazon 托管策略中定义的权限。 Amazon 偶尔会更新 Amazon 托管策略中定义的权限。当发生此情况时，更新会影响策略附加到的所有委托人实体（用户、组和角色）。

Billing and Cost Managem Amazon ent 为常见用例提供了多种托管策略。

允许完全访问 Amazon 预算，包括预算操作

托管策略名称：AWSBudgetsActionsWithAWSResourceControlAccess

此托管策略以用户为中心，确保您拥有适当的权限，可以授予 Amazon 预算执行定义操作的权限。此政策提供对 Amazon 预算（包括预算操作）的完全访问权限，以检索您的政策状态并使用管理 Amazon 资源 Amazon Web Services Management Console。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "budgets:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "aws-portal:ViewBilling"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": "budgets.amazonaws.com"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "aws-portal:ModifyBilling",
                "ec2:DescribeInstances",
                "iam:ListGroups",
                "iam:ListPolicies",
                "iam:ListRoles",
                "iam:ListUsers",
                "organizations:ListAccounts",
                "organizations:ListOrganizationalUnitsForParent",
                "organizations:ListPolicies",
                "organizations:ListRoots",
                "rds:DescribeDBInstances",
                "sns:ListTopics"
            ],
            "Resource": "*"
        }
    ]
}

允许对 Amazon Budgets 进行只读访问

托管策略名称：AWSBudgetsReadOnlyAccess

此托管策略允许通过对 Amazon 预算进行只读访问 Amazon Web Services Management Console。该策略可以附加到您的用户、组和角色。

{
  "Version" : "2012-10-17",
  "Statement" : [
    {
      "Sid": "AWSBudgetsReadOnlyAccess",
      "Effect" : "Allow",
      "Action" : [
        "aws-portal:ViewBilling",
        "budgets:ViewBudget",
        "budgets:Describe*"
        "budgets:ListTagsForResource"
      ],
      "Resource" : "*"
    }
  ]
}

允许控制 Amazon 资源的权限

托管策略名称：AWSBudgetsActions_RolePolicyForResourceAdministrationWithSSM

此托管政策侧重于 Budg Amazon ets 在完成特定操作时代表您采取的具体行动。此策略授予控制 Amazon 资源的权限。例如，通过运行 S Amazon ystems Manager (SSM) 脚本来启动和停止 Amazon EC2 或 Amazon RDS 实例。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstanceStatus",
                "ec2:StartInstances",
                "ec2:StopInstances",
                "rds:DescribeDBInstances",
                "rds:StartDBInstance",
                "rds:StopDBInstance"
            ],
            "Resource": "*",
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "aws:CalledVia": [
                        "ssm.amazonaws.com"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:StartAutomationExecution"
            ],
            "Resource": [
                "arn:aws:ssm:*:*:automation-definition/AWS-StartEC2Instance:*",
                "arn:aws:ssm:*:*:automation-definition/AWS-StopEC2Instance:*",
                "arn:aws:ssm:*:*:automation-definition/AWS-StartRdsInstance:*",
                "arn:aws:ssm:*:*:automation-definition/AWS-StopRdsInstance:*"
            ]
        }
    ]
}

允许成本优化中心调用使服务正常运行所需的服务

托管策略名称：CostOptimizationHubServiceRolePolicy

允许成本优化中心检索组织信息并收集与优化相关的数据和元数据。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AwsOrgsAccess",
            "Effect": "Allow",
            "Action":  [
                "organizations:DescribeOrganization",
                "organizations:ListAccounts",
                "organizations:ListAWSServiceAccessForOrganization",
                "organizations:ListParents",
                "organizations:DescribeOrganizationalUnit"
            ],
            "Resource":  [
                "*" 
            ]
        },
        {
            "Sid": "AwsOrgsScopedAccess",
            "Effect": "Allow",
            "Action":  [
                "organizations:ListDelegatedAdministrators"
            ],
            "Resource": "*",
            "Condition": { 
                "StringLikeIfExists": {
                    "organizations:ServicePrincipal": [ "cost-optimization-hub.bcm.amazonaws.com" ]
                }
            }
        },
        {
            "Sid": "CostExplorerAccess",
            "Effect": "Allow",
            "Action": [
                "ce:ListCostAllocationTags",
                "ce:GetCostAndUsage"
            ],
            "Resource":  [
                "*" 
            ]
        }
    ]
}

有关更多信息，请参阅成本优化中心的服务相关角色。

允许对成本优化中心进行只读访问

托管策略名称：CostOptimizationHubReadOnlyAccess

此托管式策略提供对成本优化中心的只读访问权限。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CostOptimizationHubReadOnlyAccess",
            "Effect": "Allow",
            "Action": [
                "cost-optimization-hub:ListEnrollmentStatuses",
                "cost-optimization-hub:GetPreferences",
                "cost-optimization-hub:GetRecommendation",
                "cost-optimization-hub:ListRecommendations",
                "cost-optimization-hub:ListRecommendationSummaries"
            ],
            "Resource": "*"
        }
    ]
}

允许对成本优化中心进行管理员访问

托管策略名称：CostOptimizationHubAdminAccess

此托管式策略提供对成本优化中心的管理员访问权限。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CostOptimizationHubAdminAccess",
            "Effect": "Allow",
            "Action": [
                "cost-optimization-hub:ListEnrollmentStatuses",
                "cost-optimization-hub:UpdateEnrollmentStatus",
                "cost-optimization-hub:GetPreferences",
                "cost-optimization-hub:UpdatePreferences",
                "cost-optimization-hub:GetRecommendation",
                "cost-optimization-hub:ListRecommendations",
                "cost-optimization-hub:ListRecommendationSummaries",
                "organizations:EnableAWSServiceAccess"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AllowCreationOfServiceLinkedRoleForCostOptimizationHub",
            "Effect": "Allow",
            "Action": [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": [
                "arn:aws:iam::*:role/aws-service-role/cost-optimization-hub.bcm.amazonaws.com/AWSServiceRoleForCostOptimizationHub"
            ],
            "Condition": {
                "StringLike": {
                    "iam:AWSServiceName": "cost-optimization-hub.bcm.amazonaws.com"
                }
            }
        },
        {
            "Sid": "AllowAWSServiceAccessForCostOptimizationHub",
            "Effect": "Allow",
            "Action": [
                "organizations:EnableAWSServiceAccess"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "organizations:ServicePrincipal": [
                        "cost-optimization-hub.bcm.amazonaws.com"
                    ]
                }
            }
        }
    ]
}

允许拆分成本分配数据调用使服务正常运行所需的服务

托管策略名称：SplitCostAllocationDataServiceRolePolicy

允许拆分成本分配数据检索 Amazon Organizations 信息（如果适用），并收集客户选择加入的分割成本分配数据服务的遥测数据。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AwsOrganizationsAccess",
            "Effect": "Allow",
            "Action": [
                "organizations:DescribeOrganization",
                "organizations:ListAccounts",
                "organizations:ListAWSServiceAccessForOrganization",
                "organizations:ListParents"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonManagedServiceForPrometheusAccess",
            "Effect": "Allow",
            "Action": [
                "aps:ListWorkspaces",
                "aps:QueryMetrics"
            ],
            "Resource": "*"
        }
    ]
}

有关更多信息，请参阅拆分成本分配数据的服务相关角色。

允许数据导出访问其他 Amazon 服务

托管策略名称：AWSBCMDataExportsServiceRolePolicy

允许数据导出代表您访问其他 Amazon 服务，例如成本优化中心。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CostOptimizationRecommendationAccess",
            "Effect": "Allow",
            "Action":  [
                "cost-optimization-hub:ListEnrollmentStatuses",
                "cost-optimization-hub:ListRecommendations"
            ],
            "Resource": "*" 
        }
    ]
}

有关更多信息，请参阅 Data Exports 的服务相关角色。

Amazon 成本管理对 Amazon 托管政策的更新

查看自该服务开始跟踪 Amazon 成本管理 Amazon 托管政策变更以来这些更新的详细信息。要获得有关此页面变更的自动提醒，请订阅 “ Amazon 成本管理文档历史记录” 页面上的 RSS feed。