AWS Identity and Access Management (IAM) permissions update

 

On March 6th 2023, AWS will be changing AWS Identity and Access Management (IAM) actions and replacing them with new fine-grained service specific permissions that give you more control over access to Billing, Cost Management, and Account Consoles.

Due to the new AWS change, customers should align the payer account policy used for Anodot Cost to allow validation of their data.

 


Note

Not taking any action from your side means that Anodot Cost Support will not be able to verify and fully validate your billing invoice in case investigation is required.
But, all processing and flow will function as normal regardless of this change.

We still recommend following this update to avoid delay in case investigation is required.

How to Update your payer policy(s):

Option1: 

  1. Login to AWS Console, Services->IAM->Policies.
  2. Select "PileusPolicy" (if it doesn't exist it means that while onboarding a different name was used).
  3. Edit Policy.
  4. Paste the updated Payer policy taken from here and save.
  5. Once done, go to Policy versions - and verify a new version is created as version 2(Default).
  6. Repeat above steps for all AWS payer accounts used by Anodot Cost.

Screenshot_2023-03-01_at_11.42.18.png

 

Option2: 

Use the below command in AWS CLI to align all your payer accounts with AWS requirements. 

1. From the AWS Console: download your current policy :
https://us-east-1.console.aws.amazon.com/iam/home#/policies/arn:aws:iam::<CUSTOMER-PAYER-ACCOUNT-ID>:policy/PileusPolicy  and save it as "PileusPolicy".

If the policy name "PileusPolicy" doesn't exist, it means that while onboarding a different name was used.

2. Download NewPolicyVersion from here.

3. Open AWS CLI and run the below command.



aws iam create-policy-version 
 --policy-arn arn:aws:iam::[CUSTOMER-PAYER-ACCOUNT]:policy/PileusPolicy 
 --policy-document file://NewPolicyVersion.json --set-as-default


Where NewPolicyVersion is the updated policy 
and PileusPolicy is the old policy that needs to be updated.

4. Repeat above steps for all AWS payer accounts used by Anodot Cost.