IAM / management / ce

AWS Cost Explorer (IAM)

JSON →
AWScemanagement

AWS Cost Explorer provides a user-friendly interface to visualize, understand, and manage AWS costs and usage over time.

iamaws
docs ↗
Permissions
Actions in this service
ce:GetCostAndUsage
ce:GetCostForecast
ce:GetUsageForecast
ce:GetDimensionValues
ce:GetTags
ce:GetReservationCoverage
ce:GetSavingsPlansCoverage
ce:GetCostCategories
Policy
Minimal privilege example

Copy-paste least-privilege policy statement — not yet harness-verified.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ce:GetCostAndUsage", "ce:GetCostForecast", "ce:GetUsageForecast", "ce:GetDimensionValues", "ce:GetTags", "ce:GetReservationCoverage", "ce:GetSavingsPlansCoverage", "ce:GetCostCategories" ], "Resource": "*" } ] }
SDK mapping
Method → permission

SDK method mapping (e.g. boto3.get_object() → s3:GetObject) is not yet collected.

Footguns
Known gotchas
Avoid ce:* — grants full control including creating, updating, and deleting cost reports, anomaly monitors, and cost categories
Avoid ce:CreateAnomalyMonitor and ce:DeleteAnomalyMonitor — can disrupt cost anomaly detection and alerting
Resources
docshttps://servicereference.us-east-1.amazonaws.com/v1/ce/ce.json ↗