Most accounts are unaffected. If your AWS account or organization was created on or after March 6, 2023, you can skip straight to verifying you’re not affected — the tool will confirm this in seconds.
Why this check exists
AWS retired a set of legacy IAM actions (aws-portal:*) used to control access to Billing and Cost Management. If your AWS account was created before March 6, 2023, some of your IAM policies may still reference these old actions — and AWS Billing Transfer requires the newer fine-grained permissions to work correctly.
The good news: AWS provides a free tool that scans your policies and tells you exactly what (if anything) needs to change, with suggested fixes ready to copy.
Check your affected policies
1
Sign in to your AWS management (payer) account
For the tool to show issues across your entire AWS Organization, sign in as a role or user with Organizational level access in your management (payer) account — organization admin or root access to that account works best so you can see all possible issues across the organization instead of just going account by account.If you only have access to a single member account, the tool will still show issues for that account.
2
Open the Affected Policies tool
Go directly to the tool:https://console.aws.amazon.com/poliden/home?region=us-east-1#/This is AWS’s built-in IAM policy migration tool under Billing preferences. You may be prompted to sign in if you’re not already.
3
Review the results
The tool will either show:✅ No policies listed — You’re all set. No action is required. Let your Cloud Capital contact know you’re clear to receive the billing transfer invite.⚠️ One or more policies listed — Each entry shows the policy name, the deprecated actions it contains, and a suggested updated policy you can copy directly. Follow the migration steps below to resolve them, then return here to confirm the list is empty.
Fixing affected policies
If the Affected Policies tool listed one or more policies, follow the steps below to update them. Come back to the tool afterward to confirm the list is empty, then let your Cloud Capital contact know you’re ready.- Using the Affected Policies Tool (recommended)
- Bulk Policy Migrator (AWS Organizations)
- Updating policies in code (IaC)
The tool generates an updated version of each affected policy — you don’t need to hand-write the new actions.
1
Copy the updated policy
In the Affected Policies tool, find the policy you want to update. Under the Copy updated policy column, click Copy.The copied policy includes your existing statements plus a new block (prefixed
AffectedPoliciesMigrator) with the equivalent fine-grained actions.2
Open the policy in IAM
Navigate to IAM → Policies, search for the policy by name, and click into it.
3
Edit and paste the updated policy
Click Edit policy → switch to the JSON tab → replace the existing policy document with the one you copied → click Review policy → Save changes.
4
Repeat for all affected policies
Return to the Affected Policies tool and repeat this process for each policy listed.
5
Verify the migration is complete
Refresh the Affected Policies tool. If the list is now empty, you’re done — let your Cloud Capital contact know.
Frequently asked questions
My account was created after March 6, 2023. Do I need to do anything?
My account was created after March 6, 2023. Do I need to do anything?
No — accounts created on or after that date already enforce fine-grained actions by default. The Affected Policies tool will show an empty list, confirming you’re ready to proceed. Just let your Cloud Capital contact know.
Will my team lose access during the migration?
Will my team lose access during the migration?
No — as long as you retain the old
aws-portal:* actions in your policy during the transition, access remains uninterrupted. The migration adds new fine-grained actions alongside the existing ones; it does not remove the old ones.I manage multiple AWS accounts. Do I need to do this for each one?
I manage multiple AWS accounts. Do I need to do this for each one?
No — use the Bulk Policy Migrator in your management (payer) account. It scans all member accounts at once and lets you apply recommended migrations in Customize mode. See the Bulk Policy Migrator tab above for step-by-step instructions.
Does this affect Service Control Policies (SCPs)?
Does this affect Service Control Policies (SCPs)?
The Affected Policies tool only scans IAM identity-based policies. SCPs are not included. If your organization uses SCPs to restrict billing or cost management access, review those separately using the AWS action mapping reference.
What happens if I don't complete this before the billing transfer invite?
What happens if I don't complete this before the billing transfer invite?
You may encounter permission errors when accepting the invite, or cost and billing data may not flow through correctly after onboarding. Completing this check first ensures the transfer goes through without interruption.
All clear? Let your Cloud Capital contact know
Once the Affected Policies tool shows an empty list, you’re ready for the billing transfer invite. Reach out to your Cloud Capital contact and they’ll send it right away.AWS Affected Policies Tool
Open the tool directly to check your IAM policies.
AWS fine-grained permissions reference
Official AWS documentation on the Affected Policies Tool.