View a markdown version of this page

Understanding scheduled report emails - Amazon Cost Management
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Understanding scheduled report emails

When a scheduled report is generated, recipients receive an email notification containing:

  • A secure, time-limited download link to access the PDF report. The link expires after 15 days.

  • A unique password required to open the PDF file. Each report generation produces a new password.

  • The report name, dashboard name, and generation timestamp.

PDF reports are encrypted and stored in Amazon-managed Amazon S3 buckets. The download links use pre-signed URLs that grant time-limited access to the specific PDF file.

Controlling access to report download links and passwords

Scheduled reports are delivered through Amazon User Notifications, and the notification event that Amazon User Notifications creates for each delivery contains the download link and the PDF password. Permissions to read notification events are separate from permissions for Amazon Billing and Cost Management and Amazon Cost Explorer. For example, a principal with the notifications:ListNotificationEvents and notifications:GetNotificationEvent permissions can retrieve the link and the password even if it can't otherwise view your cost and usage data, and no Amazon permissions are required to open the link.

Grant permissions to read notification events only to principals that you intend to have access to the cost and usage data in your reports. For more information, see Identity and access management for Amazon User Notifications in the Amazon User Notifications User Guide.