billing

billingAka

aws-billing

A read-only policy generated by Guardrails that lists the APIs that&#92;nshould be added to the guardrails-managed (hard) boundary policy,&#92;nthereby enabling them to be assigned to users and roles.&#92;nThis value will change depending on the value of the value of the&#92;n`AWS &gt; Billing &gt; Permissions &gt; Lockdown &gt; API Boundary` policy&#92;n

AWS > Turbot > Permissions > Compiled > API Boundary

AWS > Account

AWS > Turbot > Permissions > Compiled > API Boundary > @turbot/aws-billing

A calculated policy that Guardrails uses to create a compiled list of ALL permissions for AWS Billing&#92;nthat is used as input to the control that manages the IAM stack.&#92;n

AWS > Turbot > Permissions > Compiled > Service Permissions

AWS > Turbot > Permissions > Compiled > Service Permissions > @turbot/aws-billing

A calculated policy that Guardrails uses to create a compiled list of ALL permissions for AWS Billing&#92;nthat is used as input to the stack that manages the Guardrails IAM permissions objects.&#92;n

AWS > Turbot > Permissions > Compiled > Levels

AWS > Turbot > Permissions > Compiled > Levels > @turbot/aws-billing

Configure whether the AWS Billing API is enabled.&#92;n&#92;n**Note:** Disabling the service disables the API for ALL users and roles, and Guardrails will have no access to the API.&#92;n&#92;nSetting the `AWS &gt; Billing &gt; Enabled` policy to `Enabled` is necessary but insufficient to enabled Billing access for non-root users.  More information and setup instructions can can be found in the [AWS Billing docs](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/control-access-billing.html#ControllingAccessWebsite-Activate).&#92;n

AWS > Billing

AWS > Billing > API Enabled

Configure whether the AWS Billing service is enabled.&#92;nThis will only affect Guardrails managed User Roles and will allow the Guardrails managed user to access AWS Billing service.&#92;n  - `Enabled` policy allows Guardrails managed users to perform all the actions for the service&#92;n  - `Enabled: Metadata Only` policy allows Guardrails managed users to perform only the metadata level actions for the service (like `describe*`, `list*`)&#92;n&#92;n**Note:**&#92;n  - `Disabled` policy disables the service but does NOT disable the API for Guardrails or SuperUsers&#92;n  - All the resource data stored in the Guardrails CMDB is considered to be metadata&#92;n  - For more information related to permissions and grant levels, please check the [documentation](https://turbot.com/guardrails/docs/concepts/iam/permissions)&#92;n

AWS > Billing > Enabled

AWS > Billing > Permissions > Levels

AWS > Billing > Permissions > Lockdown

Configure whether permissions policies are in effect for AWS Billing.&#92;n&#92;nThis setting does not affect account level permissions (AWS/Admin, AWS/Owner, etc)&#92;n&#92;n**Note:** The behavior of this policy depends on the value of AWS &gt; Permissions.&#92;n

AWS > Billing > Permissions

AWS > Billing > Permissions > Levels > Modifiers

Define the permissions levels that can be used to grant access to an AWS account.&#92;nPermissions levels defined will appear in the UI to assign access to Guardrails users.&#92;nThis policy provides a default for Permissions &gt; Levels in each service,&#92;nhowever you can explicitly override the setting for each service if desired&#92;n

A map of AWS API to Guardrails Permission Level used to customize Guardrails&#39; standard permissions.&#92;nYou can add, remove or redefine the mapping of AWS API operations to Guardrails permissions levels here.&#92;n&#92;n**Note:** Modifiers are cumulative - if you add a permission to the Metadata level, it is also added to ReadOnly, Operator and Admin.&#92;nModifier policies set here apply ONLY to the AWS level&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;glacier:createvault&quot;: admin&#92;n  - &quot;glacier:ListVaults&quot;: metadata&#92;n  - &quot;s3:DeleteBucket&quot;: none&#92;n```&#92;n

AWS > Billing > Permissions > Lockdown > API Boundary

Configure whether the AWS billing API is enabled for all users and roles in guardrails-managed boundary policies.&#92;n&#92;n**Note:** Disabling the service disables the API for ALL users and roles, and Guardrails will have no access to the API.&#92;n

AWS/Billing/Admin

AWS/Billing/Metadata

AWS/Billing/Owner

aws-acm

aws-amplify

aws-apigateway

aws-appconfig

aws-appfabric

aws-appflow

aws-appmesh

aws-appstream

aws-appsync

aws-artifact

aws-athena

aws-auditmanager

aws-backup

aws-batch

aws-bedrock

aws-braket

aws-chatbot

aws-chime

aws-cisv1

aws-cisv1-4

aws-cisv2-0

aws-cisv3-0

aws-cleanrooms

aws-cloud9

aws-clouddirectory

aws-cloudformation

aws-cloudfront

aws-cloudhsm

aws-cloudmap

aws-cloudsearch

aws-cloudshell

aws-cloudtrail

aws-cloudwatch

aws-codebuild

aws-codecommit

aws-codedeploy

aws-codepipeline

aws-codestar

aws-codewhisperer

aws-cognito

aws-comprehend

aws-computeoptimizer

aws-config

aws-connect

aws-datapipeline

aws-datasync

aws-dax

aws-devicefarm

aws-directconnect

aws-directoryservice

aws-dms

aws-docdb

aws-dynamodb

aws-ec2

aws-ec2imagebuilder

aws-ecr

aws-ecs

aws-efs

aws-eks

aws-elasticache

aws-elasticbeanstalk

aws-elasticinference

aws-elasticsearch

aws-elastictranscoder

aws-emr

aws-eventbridgepipes

aws-eventbridgescheduler

aws-events

aws-fms

aws-fsx

aws-gamelift

aws-glacier

aws-globalaccelerator

aws-glue

aws-gluedatabrew

aws-greengrass

aws-guardduty

aws-health

aws-hipaa

aws-iam

aws-inspector

aws-iot

aws-iot1click

aws-iotanalytics

aws-iotevents

aws-iotsitewise

aws-iotthingsgraph

aws-kendra

aws-kinesis

aws-kms

aws-lakeformation

aws-lambda

aws-lex

aws-lightsail

aws-location

aws-logs

aws-machinelearning

aws-macie

Mod: aws-billing

Recommended Version

Resource Types

IAM Roles

Policies