FinOpsAgentAgentPolicy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184{
  "PolicyVersion": {
    "Document": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "FinOpsAgentDataAccess",
          "Effect": "Allow",
          "Action": [
            "ce:GetCostAndUsage",
            "ce:GetCostAndUsageWithResources",
            "ce:GetCostForecast",
            "ce:GetUsageForecast",
            "ce:GetDimensionValues",
            "ce:GetTags",
            "ce:GetCostCategories",
            "ce:GetCostAndUsageComparisons",
            "ce:GetCostComparisonDrivers",
            "ce:GetSavingsPlansCoverage",
            "ce:GetSavingsPlansUtilization",
            "ce:GetSavingsPlansUtilizationDetails",
            "ce:GetSavingsPlansPurchaseRecommendation",
            "ce:GetReservationCoverage",
            "ce:GetReservationUtilization",
            "ce:GetReservationPurchaseRecommendation",
            "ce:GetAnomalies",
            "ce:GetAnomalyMonitors",
            "ce:ListCostAllocationTags",
            "ce:ListCostAllocationTagBackfillHistory",
            "ce:DescribeCostCategoryDefinition",
            "ce:ListCostCategoryDefinitions",
            "ce:StartCommitmentPurchaseAnalysis",
            "ce:ListCommitmentPurchaseAnalyses",
            "ce:GetCommitmentPurchaseAnalysis",
            "ce:StartSavingsPlansPurchaseRecommendationGeneration",
            "ce:ListSavingsPlansPurchaseRecommendationGeneration",
            "ce:GetSavingsPlanPurchaseRecommendationDetails",
            "budgets:DescribeBudgetActionsForAccount",
            "budgets:DescribeBudgetActionsForBudget",
            "budgets:ViewBudget",
            "cost-optimization-hub:GetRecommendation",
            "cost-optimization-hub:ListRecommendations",
            "cost-optimization-hub:ListRecommendationSummaries",
            "compute-optimizer:DescribeRecommendationExportJobs",
            "compute-optimizer:GetEnrollmentStatus",
            "compute-optimizer:GetEnrollmentStatusesForOrganization",
            "compute-optimizer:GetRecommendationSummaries",
            "compute-optimizer:GetEC2InstanceRecommendations",
            "compute-optimizer:GetEC2RecommendationProjectedMetrics",
            "compute-optimizer:GetAutoScalingGroupRecommendations",
            "compute-optimizer:GetEBSVolumeRecommendations",
            "compute-optimizer:GetLambdaFunctionRecommendations",
            "compute-optimizer:GetRecommendationPreferences",
            "compute-optimizer:GetEffectiveRecommendationPreferences",
            "compute-optimizer:GetECSServiceRecommendations",
            "compute-optimizer:GetECSServiceRecommendationProjectedMetrics",
            "compute-optimizer:GetLicenseRecommendations",
            "compute-optimizer:GetRDSDatabaseRecommendations",
            "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics",
            "compute-optimizer:GetIdleRecommendations",
            "ec2:DescribeInstances",
            "ec2:DescribeVolumes",
            "ecs:ListServices",
            "ecs:ListClusters",
            "autoscaling:DescribeAutoScalingGroups",
            "autoscaling:DescribeAutoScalingInstances",
            "lambda:ListFunctions",
            "lambda:ListProvisionedConcurrencyConfigs",
            "organizations:ListAccounts",
            "organizations:DescribeOrganization",
            "organizations:DescribeAccount",
            "rds:DescribeDBInstances",
            "rds:DescribeDBClusters",
            "rds:DescribeDBMajorEngineVersions",
            "pricing:DescribeServices",
            "pricing:GetAttributeValues",
            "pricing:GetProducts",
            "freetier:GetFreeTierUsage",
            "bcm-pricing-calculator:GetPreferences",
            "bcm-pricing-calculator:GetWorkloadEstimate",
            "bcm-pricing-calculator:ListWorkloadEstimateUsage",
            "bcm-pricing-calculator:ListWorkloadEstimates",
            "cloudtrail:LookupEvents",
            "cloudtrail:DescribeTrails",
            "cloudtrail:GetTrailStatus",
            "cloudtrail:GetEventSelectors",
            "cloudwatch:GetMetricData",
            "cloudwatch:GetMetricStatistics",
            "cloudwatch:ListMetrics",
            "logs:StartQuery",
            "logs:GetQueryResults",
            "billing:GetBillingView",
            "billing:GetEnterpriseSupportChargeSummary",
            "billing:GetEnterpriseSupportContractDetails",
            "billing:ListBillingViews",
            "billing:ListEnterpriseSupportLinkedAccountCharges",
            "billing:ListSourceViewsForBillingView",
            "billing:GetResourcePolicy",
            "billingconductor:ListBillingGroups",
            "billingconductor:ListAccountAssociations",
            "billingconductor:ListBillingGroupCostReports",
            "billingconductor:GetBillingGroupCostReport",
            "billingconductor:ListCustomLineItems",
            "billingconductor:ListCustomLineItemVersions",
            "billingconductor:ListResourcesAssociatedToCustomLineItem",
            "billingconductor:ListPricingRules",
            "billingconductor:ListPricingPlans",
            "billingconductor:ListPricingRulesAssociatedToPricingPlan",
            "billingconductor:ListPricingPlansAssociatedWithPricingRule",
            "invoicing:ListInvoiceSummaries",
            "invoicing:ListInvoiceUnits",
            "invoicing:GetInvoiceUnit",
            "invoicing:BatchGetInvoiceProfile",
            "invoicing:ListProcurementPortalPreferences",
            "invoicing:GetProcurementPortalPreference",
            "aco-automation:GetAutomationEvent",
            "aco-automation:GetAutomationRule",
            "aco-automation:GetEnrollmentConfiguration",
            "aco-automation:ListAccounts",
            "aco-automation:ListAutomationEvents",
            "aco-automation:ListAutomationEventSteps",
            "aco-automation:ListAutomationEventSummaries",
            "aco-automation:ListAutomationRules",
            "aco-automation:ListRecommendedActions",
            "aco-automation:ListRecommendedActionSummaries",
            "aco-automation:ListAutomationRulePreview",
            "aco-automation:ListAutomationRulePreviewSummaries",
            "aco-automation:ListTagsForResource",
            "billing:GetCredits",
            "billing:GetCreditAllocationHistory",
            "health:DescribeEvents",
            "savingsplans:DescribeSavingsPlans",
            "savingsplans:DescribeSavingsPlanRates",
            "savingsplans:DescribeSavingsPlansOfferings",
            "savingsplans:DescribeSavingsPlansOfferingRates",
            "savingsplans:ListTagsForResource",
            "cost-optimization-hub:ListEfficiencyMetrics",
            "cost-optimization-hub:ListEnrollmentStatuses",
            "cost-optimization-hub:GetPreferences",
            "billing:GetBillingPreferences",
            "billing:ListBillingViewSegments"
          ],
          "Resource": "*"
        },
        {
          "Sid": "EventBridgeManagedRuleManagementWritePermissions",
          "Effect": "Allow",
          "Action": [
            "events:PutRule",
            "events:PutTargets",
            "events:DeleteRule",
            "events:RemoveTargets",
            "events:EnableRule",
            "events:DisableRule"
          ],
          "Resource": "arn:aws:events:*:*:rule/*",
          "Condition": {
            "StringEquals": {
              "events:ManagedBy": "finops-agent.amazonaws.com",
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            }
          }
        },
        {
          "Sid": "EventBridgeManagedRuleManagementReadPermissions",
          "Effect": "Allow",
          "Action": [
            "events:DescribeRule",
            "events:ListTargetsByRule"
          ],
          "Resource": "arn:aws:events:*:*:rule/*",
          "Condition": {
            "StringEquals": {
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            }
          }
        }
      ]
    },
    "VersionId": "v5",
    "IsDefaultVersion": true,
    "CreateDate": "2026-10-02T18:27:07+00:00"
  }
}