AWS Cost Explorer (IAM)

aws management

AWS Cost Explorer provides a user-friendly interface to visualize, understand, and manage AWS costs and usage over time.

Common permissions

ce:GetCostAndUsagece:GetCostForecastce:GetUsageForecastce:GetDimensionValuesce:GetTagsce:GetReservationCoveragece:GetSavingsPlansCoveragece:GetCostCategories

Least-privilege example

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ce:GetCostAndUsage",
        "ce:GetCostForecast",
        "ce:GetUsageForecast",
        "ce:GetDimensionValues",
        "ce:GetTags",
        "ce:GetReservationCoverage",
        "ce:GetSavingsPlansCoverage",
        "ce:GetCostCategories"
      ],
      "Resource": "*"
    }
  ]
}

Warnings

Avoid ce:* — grants full control including creating, updating, and deleting cost reports, anomaly monitors, and cost categories
Avoid ce:CreateAnomalyMonitor and ce:DeleteAnomalyMonitor — can disrupt cost anomaly detection and alerting

Resources

AWS referenceservicereference.us-east-1.amazonaws.com/v1/ce/ce.json ↗

API

full doc /v1/iam/ce