AWSFinOpsAgentServiceRolePolicy
Last Modified
Oct 20, 2026
October 20, 2026 at 05:04 PM UTC
Version
v1
Total Versions
1
Created
Oct 20, 2026
Actions
231
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can read secrets
Reads Lambda environment variables, where credentials often live, on any resource with no condition.
lambda:GetFunctionConfigurationUse with caution: Where the holder needs only some secrets, write your own policy scoped to their ARNs or tags, and limit decryption in the KMS key policies.
IAM Access Analyzer (1)
- Warning / POLICY_SIZE_EXCEEDS_IDENTITY_POLICY_QUOTA
The 10995 characters in the identity policy, excluding whitespace, exceed the 10240 character maximum for inline and managed policies. We recommend that you use multiple granular policies. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CostExplorerReadAndAnalyzeAccess",
"Effect": "Allow",
"Action": [
"ce:DescribeCostCategoryDefinition",
"ce:GetAnomalies",
"ce:GetAnomalyMonitors",
"ce:GetCommitmentPurchaseAnalysis",
"ce:GetCostAndUsage",
"ce:GetCostAndUsageComparisons",
"ce:GetCostAndUsageWithResources",
"ce:GetCostCategories",
"ce:GetCostComparisonDrivers",
"ce:GetCostForecast",
"ce:GetDimensionValues",
"ce:GetReservationCoverage",
"ce:GetReservationPurchaseRecommendation",
"ce:GetReservationUtilization",
"ce:GetSavingsPlanPurchaseRecommendationDetails",
"ce:GetSavingsPlansCoverage",
"ce:GetSavingsPlansPurchaseRecommendation",
"ce:GetSavingsPlansUtilization",
"ce:GetSavingsPlansUtilizationDetails",
"ce:GetTags",
"ce:GetUsageForecast",
"ce:ListCommitmentPurchaseAnalyses",
"ce:ListCostAllocationTagBackfillHistory",
"ce:ListCostAllocationTags",
"ce:ListCostCategoryDefinitions",
"ce:ListCostCategoryResourceAssociations",
"ce:ListSavingsPlansPurchaseRecommendationGeneration",
"ce:ListTagsForResource",
"ce:StartCommitmentPurchaseAnalysis",
"ce:StartSavingsPlansPurchaseRecommendationGeneration"
],
"Resource": "*"
},
{
"Sid": "CostAndUsageReportReadAccess",
"Effect": "Allow",
"Action": [
"bcm-data-exports:GetExport",
"bcm-data-exports:ListExports",
"cur:DescribeReportDefinitions"
],
"Resource": "*"
},
{
"Sid": "BillingReadAccess",
"Effect": "Allow",
"Action": [
"billing:GetBillingData",
"billing:GetBillingDetails",
"billing:GetBillingNotifications",
"billing:GetBillingPreferences",
"billing:GetBillingView",
"billing:GetContractInformation",
"billing:GetCreditAllocationHistory",
"billing:GetCredits",
"billing:GetEnterpriseSupportChargeSummary",
"billing:GetEnterpriseSupportContractDetails",
"billing:GetIAMAccessPreference",
"billing:GetResourcePolicy",
"billing:GetSellerOfRecord",
"billing:ListBillingViews",
"billing:ListEnterpriseSupportLinkedAccountCharges",
"billing:ListSourceViewsForBillingView"
],
"Resource": "*"
},
{
"Sid": "BillingConductorReadAccess",
"Effect": "Allow",
"Action": [
"billingconductor:GetBillingGroupCostReport",
"billingconductor:ListAccountAssociations",
"billingconductor:ListBillingGroupCostReports",
"billingconductor:ListBillingGroups",
"billingconductor:ListCustomLineItemVersions",
"billingconductor:ListCustomLineItems",
"billingconductor:ListPricingPlans",
"billingconductor:ListPricingPlansAssociatedWithPricingRule",
"billingconductor:ListPricingRules",
"billingconductor:ListPricingRulesAssociatedToPricingPlan",
"billingconductor:ListResourcesAssociatedToCustomLineItem",
"billingconductor:ListTagsForResource"
],
"Resource": "*"
},
{
"Sid": "BudgetsReadAccess",
"Effect": "Allow",
"Action": [
"budgets:DescribeBudgetAction",
"budgets:DescribeBudgetActionHistories",
"budgets:DescribeBudgetActionsForAccount",
"budgets:DescribeBudgetActionsForBudget",
"budgets:ListTagsForResource",
"budgets:ViewBudget"
],
"Resource": "*"
},
{
"Sid": "InvoicingReadAccess",
"Effect": "Allow",
"Action": [
"invoicing:BatchGetInvoiceProfile",
"invoicing:GetInvoiceCorrection",
"invoicing:GetInvoiceEmailDeliveryPreferences",
"invoicing:GetInvoicePDF",
"invoicing:GetInvoiceUnit",
"invoicing:GetProcurementPortalPreference",
"invoicing:ListInvoiceCorrections",
"invoicing:ListInvoiceSummaries",
"invoicing:ListInvoiceUnits",
"invoicing:ListProcurementPortalPreferences",
"invoicing:ListProcurementPortalSuppliers",
"invoicing:ListProcurementPortals",
"invoicing:ListTagsForResource"
],
"Resource": "*"
},
{
"Sid": "PurchaseOrderReadAccess",
"Effect": "Allow",
"Action": [
"purchase-orders:GetPurchaseOrder",
"purchase-orders:ListPurchaseOrderInvoices",
"purchase-orders:ListPurchaseOrders",
"purchase-orders:ListTagsForResource",
"purchase-orders:ViewPurchaseOrders"
],
"Resource": "*"
},
{
"Sid": "FreeTierReadAccess",
"Effect": "Allow",
"Action": [
"freetier:GetAccountActivity",
"freetier:GetAccountPlanState",
"freetier:GetFreeTierAlertPreference",
"freetier:GetFreeTierUsage",
"freetier:ListAccountActivities"
],
"Resource": "*"
},
{
"Sid": "CreditProgramReadAccess",
"Effect": "Allow",
"Action": [
"mapcredits:ListAssociatedPrograms",
"mapcredits:ListQuarterCredits",
"mapcredits:ListQuarterSpend"
],
"Resource": "*"
},
{
"Sid": "PricingReadAccess",
"Effect": "Allow",
"Action": [
"pricing:DescribeServices",
"pricing:GetAttributeValues",
"pricing:GetProducts"
],
"Resource": "*"
},
{
"Sid": "PricingCalculatorReadAccess",
"Effect": "Allow",
"Action": [
"bcm-pricing-calculator:GetPreferences",
"bcm-pricing-calculator:GetWorkloadEstimate",
"bcm-pricing-calculator:ListWorkloadEstimateUsage",
"bcm-pricing-calculator:ListWorkloadEstimates"
],
"Resource": "*"
},
{
"Sid": "OrganizationStructureReadAccess",
"Effect": "Allow",
"Action": [
"account:GetRegionOptStatus",
"account:ListRegions",
"consolidatedbilling:GetAccountBillingRole",
"consolidatedbilling:ListLinkedAccounts",
"organizations:DescribeAccount",
"organizations:DescribeOrganization",
"organizations:DescribeOrganizationalUnit",
"organizations:ListAWSServiceAccessForOrganization",
"organizations:ListAccounts",
"organizations:ListChildren",
"organizations:ListOrganizationalUnitsForParent",
"organizations:ListParents",
"organizations:ListRoots"
],
"Resource": "*"
},
{
"Sid": "AwsOrgsScopedAccess",
"Effect": "Allow",
"Action": [
"organizations:ListDelegatedAdministrators"
],
"Resource": "*",
"Condition": {
"StringLikeIfExists": {
"organizations:ServicePrincipal": [
"finops-agent.amazonaws.com"
]
}
}
},
{
"Sid": "CostOptimizationHubReadAccess",
"Effect": "Allow",
"Action": [
"cost-optimization-hub:GetPreferences",
"cost-optimization-hub:GetRecommendation",
"cost-optimization-hub:ListEfficiencyMetrics",
"cost-optimization-hub:ListEnrollmentStatuses",
"cost-optimization-hub:ListRecommendationSummaries",
"cost-optimization-hub:ListRecommendations"
],
"Resource": "*"
},
{
"Sid": "ComputeOptimizerReadAccess",
"Effect": "Allow",
"Action": [
"compute-optimizer:DescribeRecommendationExportJobs",
"compute-optimizer:GetAutoScalingGroupRecommendations",
"compute-optimizer:GetEBSVolumeRecommendations",
"compute-optimizer:GetEC2InstanceRecommendations",
"compute-optimizer:GetEC2RecommendationProjectedMetrics",
"compute-optimizer:GetECSServiceRecommendationProjectedMetrics",
"compute-optimizer:GetECSServiceRecommendations",
"compute-optimizer:GetEffectiveRecommendationPreferences",
"compute-optimizer:GetEnrollmentStatus",
"compute-optimizer:GetEnrollmentStatusesForOrganization",
"compute-optimizer:GetIdleRecommendations",
"compute-optimizer:GetLambdaFunctionRecommendations",
"compute-optimizer:GetLicenseRecommendations",
"compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics",
"compute-optimizer:GetRDSDatabaseRecommendations",
"compute-optimizer:GetRecommendationPreferences",
"compute-optimizer:GetRecommendationSummaries"
],
"Resource": "*"
},
{
"Sid": "CostOptimizationAutomationReadAccess",
"Effect": "Allow",
"Action": [
"aco-automation:GetAutomationEvent",
"aco-automation:GetAutomationRule",
"aco-automation:GetEnrollmentConfiguration",
"aco-automation:ListAccounts",
"aco-automation:ListAutomationEventSteps",
"aco-automation:ListAutomationEventSummaries",
"aco-automation:ListAutomationEvents",
"aco-automation:ListAutomationRulePreview",
"aco-automation:ListAutomationRulePreviewSummaries",
"aco-automation:ListAutomationRules",
"aco-automation:ListRecommendedActionSummaries",
"aco-automation:ListRecommendedActions",
"aco-automation:ListTagsForResource"
],
"Resource": "*"
},
{
"Sid": "SavingsPlansReadAccess",
"Effect": "Allow",
"Action": [
"savingsplans:DescribeSavingsPlanRates",
"savingsplans:DescribeSavingsPlans",
"savingsplans:DescribeSavingsPlansOfferingRates",
"savingsplans:DescribeSavingsPlansOfferings",
"savingsplans:ListTagsForResource"
],
"Resource": "*"
},
{
"Sid": "ComputeResourceReadAccess",
"Effect": "Allow",
"Action": [
"application-autoscaling:DescribeScalableTargets",
"application-autoscaling:DescribeScalingPolicies",
"autoscaling:DescribeAutoScalingGroups",
"autoscaling:DescribeAutoScalingInstances",
"ec2:DescribeAddresses",
"ec2:DescribeInstanceTypes",
"ec2:DescribeInstances",
"ec2:DescribeNatGateways",
"ec2:DescribeReservedInstances",
"ec2:DescribeSnapshots",
"ec2:DescribeVolumes",
"ec2:DescribeVpcEndpoints"
],
"Resource": "*"
},
{
"Sid": "LambdaResourceReadAccess",
"Effect": "Allow",
"Action": [
"lambda:GetFunctionConfiguration",
"lambda:ListFunctions",
"lambda:ListProvisionedConcurrencyConfigs"
],
"Resource": "*"
},
{
"Sid": "ContainerResourceReadAccess",
"Effect": "Allow",
"Action": [
"ecs:ListClusters",
"ecs:ListServices"
],
"Resource": "*"
},
{
"Sid": "DatabaseResourceReadAccess",
"Effect": "Allow",
"Action": [
"dynamodb:DescribeContinuousBackups",
"dynamodb:DescribeTable",
"dynamodb:ListTables",
"elasticache:DescribeCacheClusters",
"elasticache:DescribeReplicationGroups",
"elasticache:DescribeReservedCacheNodes",
"elasticache:DescribeSnapshots",
"memorydb:DescribeClusters",
"memorydb:DescribeSnapshots",
"rds:DescribeDBClusterSnapshots",
"rds:DescribeDBClusters",
"rds:DescribeDBEngineVersions",
"rds:DescribeDBInstances",
"rds:DescribeDBSnapshots",
"rds:DescribeReservedDBInstances",
"redshift:DescribeClusterSnapshots",
"redshift:DescribeClusters",
"redshift:DescribeReservedNodes"
],
"Resource": "*"
},
{
"Sid": "StorageResourceReadAccess",
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:GetBucketVersioning",
"s3:GetIntelligentTieringConfiguration",
"s3:GetInventoryConfiguration",
"s3:GetLifecycleConfiguration",
"s3:GetReplicationConfiguration",
"s3:GetStorageLensConfiguration",
"s3:ListAllMyBuckets"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "MachineLearningResourceReadAccess",
"Effect": "Allow",
"Action": [
"sagemaker:DescribeEndpoint",
"sagemaker:DescribeEndpointConfig",
"sagemaker:DescribeNotebookInstance",
"sagemaker:ListApps",
"sagemaker:ListDomains",
"sagemaker:ListEndpointConfigs",
"sagemaker:ListEndpoints",
"sagemaker:ListNotebookInstances"
],
"Resource": "*"
},
{
"Sid": "WorkspacesReadAccess",
"Effect": "Allow",
"Action": [
"workspaces:DescribeWorkspaces",
"workspaces:DescribeWorkspacesConnectionStatus"
],
"Resource": "*"
},
{
"Sid": "ResourceDiscoveryReadAccess",
"Effect": "Allow",
"Action": [
"ram:GetResourceShares",
"resource-explorer-2:GetIndex",
"resource-explorer-2:ListIndexes",
"resource-explorer-2:Search",
"tag:GetResources"
],
"Resource": "*"
},
{
"Sid": "UtilizationMetricsReadAccess",
"Effect": "Allow",
"Action": [
"cloudwatch:GetMetricData",
"cloudwatch:GetMetricStatistics",
"cloudwatch:ListMetrics"
],
"Resource": "*"
},
{
"Sid": "LogConfigurationReadAccess",
"Effect": "Allow",
"Action": [
"logs:DescribeLogGroups",
"logs:DescribeSubscriptionFilters"
],
"Resource": "*"
},
{
"Sid": "CloudTrailConfigurationReadAccess",
"Effect": "Allow",
"Action": [
"cloudtrail:DescribeTrails",
"cloudtrail:GetEventSelectors",
"cloudtrail:GetTrailStatus",
"cloudtrail:LookupEvents"
],
"Resource": "*"
},
{
"Sid": "HealthEventReadAccess",
"Effect": "Allow",
"Action": [
"health:DescribeEvents"
],
"Resource": "*"
},
{
"Sid": "EventBridgeManagedRuleManagementWritePermissions",
"Effect": "Allow",
"Action": [
"events:DeleteRule",
"events:DisableRule",
"events:EnableRule",
"events:PutRule",
"events:PutTargets",
"events:RemoveTargets"
],
"Resource": "arn:aws:events:*:*:rule/*",
"Condition": {
"StringEquals": {
"events:ManagedBy": "finops-agent.amazonaws.com"
}
}
},
{
"Sid": "EventBridgeManagedRuleManagementReadPermissions",
"Effect": "Allow",
"Action": [
"events:DescribeRule",
"events:ListTargetsByRule"
],
"Resource": "arn:aws:events:*:*:rule/*"
}
]
},
"VersionId": "v1",
"IsDefaultVersion": true,
"CreateDate": "2026-10-20T16:07:08+00:00"
}
}Version History (1 recorded)
Raw historyv1new policy
231 actions added
Permissions management: billing:GetResourcePolicy: billing:GetResourcePolicy